A Lending Service Provider, or LSP, in digital lending is generally treated as an agent of the Regulated Entity when it performs lender functions such as customer acquisition, underwriting support, pricing support, servicing, monitoring or recovery on behalf of a bank or NBFC. Even if the agreement between the Regulated Entity and the LSP describes their inter se relationship as “principal-to-principal”, the LSP may still be treated as acting on behalf of the Regulated Entity in its dealings with borrowers. Therefore, the Regulated Entity cannot escape customer-facing responsibility merely by calling the LSP an independent principal in the contract.
Table of Contents
Introduction
Digital lending has changed the Indian credit market. Many fintech companies now provide customer acquisition, digital onboarding, credit-tech support, underwriting assistance, repayment support, servicing, analytics and recovery support to banks and NBFCs. These fintech partners are commonly referred to as Lending Service Providers, or LSPs.
The legal question is critical: Is an LSP an agent of the lender, or an independent contractor working on a principal-to-principal basis?
This is not merely a drafting issue. The answer affects borrower rights, RBI compliance, liability for mis-selling, data privacy, recovery conduct, grievance redressal, outsourcing obligations, fund-flow restrictions, commission structure, indemnity, audit rights and regulatory exposure.
A common drafting mistake is to insert a standard clause stating that “the parties are acting on a principal-to-principal basis” and assume that the lender has no responsibility for the acts of the LSP. That approach is unsafe in digital lending. Under the RBI’s digital lending framework, the Regulated Entity remains accountable for the lending relationship and cannot use the LSP structure to distance itself from borrower-facing obligations.
What is a Lending Service Provider?
A Lending Service Provider is an entity engaged by a bank, NBFC or other RBI-regulated lender to perform one or more digital lending functions or part of such functions.
An LSP may perform functions such as:
- Customer acquisition.
- Lead generation.
- Digital onboarding.
- KYC assistance, subject to applicable law.
- Credit assessment support.
- Underwriting support.
- Pricing support.
- Loan servicing.
- Monitoring of specific loan or portfolio.
- Recovery support.
- Customer support.
- Technology interface through a digital lending app or platform.
An LSP is not automatically a lender. The lender is the Regulated Entity. The LSP is a service provider that supports lending functions, subject to RBI outsourcing and digital lending requirements.
Regulated Entity and LSP: Who Does What?
Regulated Entity
The Regulated Entity is the bank, NBFC or other lender regulated by RBI. It owns the lending relationship and remains responsible for regulatory compliance.
The RE must generally control:
- Loan approval.
- Credit decision.
- Sanction.
- Key Facts Statement.
- Loan agreement.
- Disbursement.
- Repayment flow.
- Customer grievance redressal.
- Outsourcing oversight.
- Data and privacy compliance.
- Recovery governance.
- Regulatory reporting.
Lending Service Provider
The LSP may assist the RE but should not act like an unregulated lender.
The LSP may support:
- Borrower sourcing.
- Technology platform.
- Customer interface.
- Document collection.
- Underwriting analytics.
- Servicing.
- Recovery assistance.
- Grievance escalation support.
- Operational reporting.
- DLA maintenance.
The LSP must operate within the mandate given by the RE.
Agency vs Principal-to-Principal: Why It Matters
The distinction between agency and principal-to-principal contracts is important because it decides whether one party acts for and on behalf of another party or as an independent contracting party.
Agency Relationship
In an agency relationship:
- Agent acts on behalf of the principal.
- Agent may represent the principal before third parties.
- Principal may be bound by authorised acts of the agent.
- Principal may be responsible for customer-facing conduct.
- Agent must act within authority and instructions.
- Principal may supervise the agent’s role.
Principal-to-Principal Relationship
In a principal-to-principal relationship:
- Each party acts independently.
- One party does not normally bind the other.
- Each party bears its own commercial risk.
- There may be no vicarious liability for the other party’s conduct.
- Liability depends on contract terms and law.
- There is usually no representative authority.
In digital lending, the difficulty is that the LSP may be contractually described as independent, but functionally it may be doing lender-facing work before borrowers. In such cases, labels are not conclusive.
The Contract Label Is Not Final
A contract may say “principal-to-principal”, but courts and regulators examine the real substance of the relationship.
The relevant factors include:
- Who owns the borrower relationship?
- Who approves the loan?
- Who disburses the loan?
- Who receives repayment?
- Whose name appears in loan documents?
- Who decides pricing?
- Who controls recovery?
- Who handles borrower complaints?
- Who controls customer data?
- Does the LSP represent itself as acting for the lender?
- Does the borrower understand the LSP as the lender’s representative?
- Does the lender supervise LSP conduct?
If the LSP is doing lender functions on behalf of the RE, the relationship may carry agency consequences in borrower-facing dealings even if the inter se contract uses principal-to-principal language.
RBI’s Position: LSP as Agent in Digital Lending
The RBI digital lending framework treats an LSP as an agent of a Regulated Entity when it performs digital lending functions on behalf of the RE.
This is the central legal point. The RBI’s approach is borrower-protective. It prevents a lender from saying: “The app or fintech partner did it, not us.”
For digital lending compliance, the RE remains answerable for:
- Borrower disclosures.
- KFS and APR transparency.
- Fund-flow compliance.
- Recovery agent conduct.
- Grievance redressal.
- Data collection and consent.
- Outsourcing supervision.
- LSP due diligence.
- DLA compliance.
- Borrower-facing mis-selling or unfair practices.
The RE cannot use the LSP as a shield against regulatory responsibility.
People Also Ask: Can an LSP Agreement Be Principal-to-Principal?
Yes, the RE and LSP may define their inter se commercial relationship as principal-to-principal for certain contractual purposes such as indemnity, tax, fees, confidentiality, IP ownership, service levels and liability allocation. However, in borrower-facing digital lending functions, the LSP may still be treated as acting as an agent or representative of the RE.
Therefore, a principal-to-principal clause is not a complete liability shield.
People Also Ask: Can a Fintech LSP Lend Money Directly?
An LSP cannot lend merely because it is an LSP. If the fintech itself lends from its own balance sheet, it must examine whether it is carrying on lending business requiring registration or regulatory status under applicable law. If the loan is being provided by an NBFC or bank, the fintech LSP should not present itself as the lender.
The documents, app journey and borrower communication must clearly identify the actual lender.
Why Principal-to-Principal Drafting Is Risky in Digital Lending
Principal-to-principal drafting becomes risky when it is used to avoid regulatory accountability.
Examples of risky drafting include:
- LSP has full control over customer acquisition and loan journey.
- Borrower does not know who the actual lender is.
- LSP collects fees directly from borrower.
- LSP controls repayment account or pass-through account.
- LSP handles recovery without proper lender oversight.
- LSP stores excessive borrower data.
- LSP decides pricing or sanction independently.
- LSP’s app hides the RE’s identity.
- Grievance redressal is handled only by LSP.
- RE has no real audit or intervention rights.
Such structures are vulnerable because they weaken the RE’s control over regulated lending.
RBI Outsourcing Framework: RE Remains Responsible
Digital lending LSP arrangements are also governed by outsourcing principles. Outsourcing does not reduce the RE’s obligations to borrowers or RBI.
A compliant outsourcing arrangement should ensure:
- Board-approved outsourcing policy.
- Due diligence on LSP.
- Written agreement.
- Clear scope of outsourced activity.
- Service standards.
- Monitoring rights.
- Audit rights.
- Data confidentiality.
- Grievance redressal.
- Business continuity.
- Termination rights.
- RBI access/inspection rights.
- Subcontracting control.
- Customer protection.
The lender must retain ultimate control.
People Also Ask: Who Is Liable for Misconduct by LSP?
The Regulated Entity may remain responsible for borrower-facing misconduct by its LSP, especially where the LSP acts on behalf of the RE in customer acquisition, servicing, monitoring or recovery. The RE may contractually recover losses from the LSP through indemnity, but borrower-facing and regulatory responsibility generally cannot be outsourced away.
Fund Flow Rules in Digital Lending
Fund flow is a critical compliance issue.
A compliant digital lending structure should ensure:
- Loan disbursement flows directly from RE to borrower.
- Repayment flows directly from borrower to RE.
- LSP should not control loan funds.
- Pass-through accounts controlled by LSP should be avoided.
- Charges payable to LSP should generally be paid by RE, not extracted from borrower through hidden deductions.
- Borrower should receive clear disclosure of all charges.
- Payment aggregators should not become disguised LSP fund-control layers.
The core principle is simple: the lender lends, the borrower repays the lender, and the LSP should not sit in the middle of funds.
Customer Disclosure Requirements
Digital lending arrangements must be transparent. Borrowers should know:
- Name of the Regulated Entity.
- Role of LSP.
- Loan amount.
- Tenure.
- Annual Percentage Rate.
- Processing fees.
- Penal charges.
- Cooling-off period.
- Recovery mechanism.
- Grievance redressal officer.
- Data being collected.
- Consent and revocation rights, where applicable.
- Key Facts Statement.
- Loan agreement terms.
The LSP should not create confusion about who the lender is.
Multi-Lender LSP Arrangements
Many LSPs work with multiple banks or NBFCs and display different loan offers to borrowers. This creates additional transparency issues.
A fair multi-lender LSP model should:
- Display lender options clearly.
- Avoid deceptive product ranking.
- Disclose lender name.
- Disclose APR and key terms.
- Avoid dark patterns.
- Provide comparable information.
- Show KFS-linked information.
- Not push a particular lender unfairly.
- Follow a consistent offer-generation method.
- Maintain audit trail of offer display.
This is especially important for loan marketplaces and credit aggregation platforms.
Data Protection and Privacy in LSP Models
LSPs often handle sensitive borrower data. Therefore, the RE-LSP agreement must have strong data protection controls.
Key clauses should include:
- Data minimisation.
- Purpose limitation.
- Consent capture.
- No unauthorised storage.
- No excessive phonebook/contact access.
- No biometric storage unless legally permitted.
- Data localisation, where applicable.
- Encryption and security standards.
- Breach reporting.
- Audit rights.
- Deletion/return of data after termination.
- DPDP Act compliance.
- Subprocessor controls.
- Confidentiality survival.
Borrower data cannot be treated as an unrestricted commercial asset of the LSP.
Recovery Conduct and LSP Liability
If an LSP or recovery partner contacts borrowers, the RE must ensure lawful and fair recovery conduct.
A compliant recovery structure should include:
- Board-approved recovery code.
- Training of recovery agents.
- Borrower communication protocols.
- Approved calling hours.
- No harassment.
- No public humiliation.
- No threats.
- No misuse of contacts or photos.
- Prior intimation of recovery agent details.
- Call recording and monitoring, where legally permissible.
- Complaint escalation mechanism.
- Strict termination for misconduct.
Recovery misconduct by an LSP can create regulatory, criminal, civil and reputational exposure for the lender.
DLG / FLDG and LSPs
Default Loss Guarantee, often called DLG or FLDG in industry usage, is a separate but related issue. Some LSPs provide limited credit-loss cover to REs for a specified loan portfolio.
Important compliance points include:
- DLG must be structured within RBI limits.
- DLG should be documented in writing.
- Portfolio must be specified upfront.
- Cap and invocation must follow RBI framework.
- DLG should not convert the LSP into an unregulated lender.
- Borrower-facing role must remain transparent.
- Accounting, provisioning and capital treatment must be reviewed.
- Contract must define invocation, replenishment prohibition and audit.
DLG should not be used to disguise balance-sheet lending by an unregulated fintech.
Key Clauses in an RE-LSP Agreement
A proper RE-LSP agreement should include:
1. Scope of Services
Define whether the LSP handles acquisition, onboarding, underwriting support, servicing, monitoring, recovery or technology interface.
2. Nature of Relationship
Clarify inter se commercial relationship, but expressly state that customer-facing conduct must comply with RBI digital lending and outsourcing norms.
3. No Lending Representation
The LSP must not represent itself as the lender unless it is legally the lender.
4. Regulatory Compliance
The LSP must comply with all applicable RBI directions, outsourcing norms, data protection law, consumer protection law and fair practices requirements.
5. Fund Flow Restriction
No loan disbursal or repayment funds should be routed through or controlled by the LSP, except where expressly permitted by law.
6. Borrower Disclosure
The agreement must require lender identity, KFS, APR, fees, grievance details and recovery information to be properly disclosed.
7. Data Protection
Insert detailed clauses on consent, storage, access, confidentiality, breach notification, deletion and audit.
8. Audit and Inspection
The RE must have audit rights, and the agreement must permit RBI access where required.
9. Grievance Redressal
Borrower complaints must be routed and resolved under the RE’s oversight.
10. Recovery Conduct
Recovery standards must be defined and breach must permit termination and indemnity.
11. Subcontracting
Subcontracting should require prior written approval of the RE.
12. Indemnity
The LSP should indemnify the RE for regulatory breach, data breach, recovery misconduct, misrepresentation, fraud, customer claims and non-compliance.
13. Business Continuity and Exit
The RE must be able to migrate operations, access records and continue servicing borrowers if the LSP arrangement terminates.
What LSPs Should Not Do
An LSP should not:
- Call itself the lender if it is not the lender.
- Decide loan sanction independently.
- Control disbursement or repayment flow.
- Collect hidden charges from borrower.
- Misrepresent APR or fees.
- Store excessive borrower data.
- Use borrower contacts for coercive recovery.
- Engage recovery agents without RE approval.
- Subcontract critical functions without consent.
- Use dark patterns to push loans.
- Hide the RE’s identity.
- Use principal-to-principal clause to defeat borrower rights.
What Regulated Entities Should Not Do
A bank or NBFC should not:
- Treat LSP onboarding as a simple vendor contract.
- Outsource credit decision-making.
- Allow LSP to control borrower funds.
- Permit unclear app branding.
- Permit LSP-only grievance redressal.
- Ignore recovery conduct.
- Allow excessive data collection.
- Fail to monitor DLA activity.
- Avoid audit rights.
- Use principal-to-principal drafting to escape liability.
The RE remains the regulated lender. That responsibility cannot be outsourced.
People Also Ask: Does an LSP Need RBI Registration?
An LSP does not automatically require RBI registration merely because it provides technology or outsourcing services to a regulated lender. However, if the LSP itself carries on lending, accepts deposits, operates as an NBFC, provides regulated financial services, controls loan funds or performs activities requiring registration, separate regulatory analysis is required.
The LSP should also comply with contractual, data, consumer-protection and outsourcing obligations imposed through the RE.
People Also Ask: Can LSP Charge Borrower Directly?
As a compliance principle, charges payable to the LSP should generally be paid by the Regulated Entity and transparently disclosed to the borrower where forming part of loan cost. Hidden or direct borrower charges by the LSP create regulatory risk, especially if they distort APR, KFS, fund flow or borrower consent.
Legal Structuring for Fintech Startups Acting as LSPs
A fintech startup planning to act as an LSP should prepare a compliance stack before approaching an NBFC or bank.
Entity and Governance
- Proper company incorporation.
- Board approvals.
- Authorised signatory documents.
- Compliance officer.
- Grievance officer, if borrower-facing.
- Data protection officer/lead, where appropriate.
- Internal control matrix.
Policies
- LSP compliance policy.
- Data protection policy.
- Privacy policy.
- Information security policy.
- Customer communication policy.
- Recovery support policy, if applicable.
- Vendor/subcontracting policy.
- Incident response policy.
- Business continuity plan.
- Grievance redressal SOP.
Documents for NBFC Onboarding
- Company profile.
- Product flow note.
- Customer journey map.
- Fund-flow note.
- Data-flow note.
- Information security controls.
- Draft RE-LSP agreement.
- Draft borrower communications.
- KFS integration process.
- Grievance escalation matrix.
- Recovery protocol.
- Compliance undertaking.
Agency Risk Matrix for LSP Agreements
| Issue | Principal-to-Principal Drafting | Agency / LSP Reality |
|---|---|---|
| Borrower interaction | LSP says it is independent | Borrower may see LSP as lender representative |
| Loan approval | LSP should not decide | RE must retain final sanction control |
| Fund flow | LSP should not control | Direct RE-borrower flow required |
| Fees | Commercially agreed | Must be transparent and compliant |
| Data | LSP processes data | RE remains accountable for lawful processing |
| Recovery | Outsourced support | RE responsible for conduct and complaints |
| Liability | Inter se indemnity | RE may remain borrower-facing accountable |
| Contract label | Useful internally | Not conclusive before regulator/court |
Practical Drafting Strategy
The safest drafting approach is not to blindly choose “principal-to-principal” or “agency”. The stronger approach is layered drafting:
Layer 1: Inter Se Commercial Relationship
Define fees, IP, indemnity, confidentiality, service levels, tax, ownership and liability allocation between RE and LSP.
Layer 2: Regulatory Character
Acknowledge that borrower-facing LSP functions will be performed on behalf of the RE and subject to RBI digital lending and outsourcing norms.
Layer 3: Customer Protection
Mandate disclosures, grievance redressal, fair conduct, data protection and recovery rules.
Layer 4: Control and Oversight
Preserve RE’s audit, monitoring, intervention, suspension and termination rights.
Layer 5: Exit and Continuity
Ensure borrower servicing, data, records and complaints can continue even if the LSP exits.
This structure protects both commercial flexibility and regulatory compliance.
People Also Ask: What Is the Main Legal Risk in LSP Contracts?
The main legal risk is drafting the LSP as an independent principal while operationally allowing it to act as the lender’s face before borrowers without proper oversight. This creates regulatory, consumer, data, recovery and mis-selling risk for both the RE and the fintech partner.
What is an LSP in digital lending?
An LSP is a service provider engaged by a regulated lender to perform one or more digital lending functions such as customer acquisition, underwriting support, servicing, monitoring or recovery.
Is LSP an agent of NBFC?
In borrower-facing digital lending functions, an LSP is generally treated as acting on behalf of the Regulated Entity. The RE remains responsible for oversight and customer protection.
Can LSP agreement be principal-to-principal?
It can define inter se commercial obligations as principal-to-principal, but this does not eliminate the RE’s borrower-facing regulatory responsibility.
Can LSP handle loan money?
As a compliance principle, LSP should not control the flow of loan disbursement or repayment funds between lender and borrower.
What documents are needed for an LSP arrangement?
A written RE-LSP agreement, due diligence documents, data-flow note, fund-flow note, customer journey, KFS process, grievance SOP, privacy policy, security controls and audit rights are essential.
Frequently Asked Questions
1. What is a Lending Service Provider?
A Lending Service Provider is an entity engaged by a Regulated Entity to perform digital lending functions such as customer acquisition, underwriting support, servicing, monitoring or recovery.
2. Is an LSP an agent or independent contractor?
For borrower-facing digital lending functions, the LSP is generally treated as acting on behalf of the Regulated Entity, even if the inter se agreement contains principal-to-principal language.
3. Can an LSP agreement be principal-to-principal?
Yes, for inter se commercial obligations. But such drafting cannot be used to defeat RBI compliance, borrower rights or RE responsibility.
4. Who is liable for LSP misconduct?
The Regulated Entity may remain responsible to borrowers and the regulator for LSP misconduct. The RE may separately claim indemnity from the LSP under the contract.
5. Can an LSP collect repayment from borrowers?
Loan repayment should ordinarily flow directly from borrower to the Regulated Entity. LSP control over fund flow creates serious compliance risk.
6. Can an LSP charge fees directly to borrower?
Direct or hidden borrower charges by LSP are risky. Charges must be transparent, properly disclosed and compliant with RBI’s digital lending framework.
7. Does an LSP need an RBI licence?
Not merely for providing technology or outsourced services. However, if the LSP carries on lending or regulated financial activity, separate licensing analysis is required.
8. What clauses must be in an RE-LSP agreement?
Scope, regulatory compliance, borrower disclosures, data protection, fund-flow restrictions, audit rights, grievance redressal, recovery conduct, subcontracting, indemnity and termination clauses are essential.
9. Can an LSP work with multiple lenders?
Yes, but multi-lender arrangements require transparent, fair and unbiased presentation of loan offers and clear disclosure of lender identity and loan terms.
10. What is the safest legal structure for LSPs?
The safest structure is a compliant outsourcing arrangement where the RE remains the lender, the LSP performs clearly defined support functions, fund flow remains direct between borrower and RE, disclosures are transparent, and the RE retains oversight, audit and intervention rights.
Conclusion
The agency versus principal-to-principal debate in digital lending cannot be solved by a drafting label alone. The real test is functional: what does the LSP do, whom does it represent, how does it interact with borrowers, who controls the loan journey, and whether the Regulated Entity retains oversight.
The commercially sensible approach is to define inter se obligations clearly while accepting the regulatory reality: in borrower-facing digital lending functions, the LSP acts on behalf of the RE, and the RE remains accountable.
A proper RE-LSP agreement should therefore balance commercial independence with regulatory control. It must protect borrower rights, ensure transparent disclosures, restrict fund-flow misuse, safeguard data, regulate recovery conduct, and preserve the RE’s audit and intervention rights.
In digital lending, the fintech may build the interface, but the regulated lender owns the responsibility.
Disclaimer
This article is intended for general legal awareness and educational purposes only. It does not constitute legal advice, regulatory advice, solicitation, advertisement or creation of an advocate-client relationship. LSP structuring depends on the business model, RBI-regulated entity type, loan product, fund flow, data flow, DLA design, recovery role, DLG/FLDG structure, outsourcing agreement and case-specific facts.