An NBFC LSP Agreement is a contractual arrangement between a regulated lender, such as an NBFC, and a Lending Service Provider that performs one or more digital lending functions for the regulated entity, such as customer acquisition, services incidental to underwriting, loan servicing, monitoring or recovery. Under RBI’s Digital Lending Directions, digital lending through an LSP must be carried out under a written contractual agreement clearly defining the roles, rights and obligations of each party. The regulated entity must conduct enhanced due diligence on the LSP, monitor the LSP’s conduct, ensure borrower disclosures, control fund flow directly between borrower and lender, and remain fully responsible for the acts and omissions of the LSP.
Table of Contents
Non-Solicitation Note
This article is for general legal awareness and educational purposes only and may be published by Fastrack Legal Solutions LLP. It is not an advertisement, solicitation, invitation or inducement for professional engagement. NBFC-LSP arrangements depend on RBI directions, product structure, fund flow, DLA ownership, borrower interface, outsourcing scope, data processing, KYC model, recovery process, DLG/FLDG exposure, commercial model and case-specific regulatory risk.
Introduction
Digital lending in India has grown rapidly. Fintech platforms, sourcing partners, loan apps, embedded finance players, marketplaces and technology service providers now frequently work with NBFCs and banks for loan origination and servicing.
However, the legal structure is not simple. An LSP cannot be treated as an informal “lead generator” if it is performing borrower-facing, credit-intermediation, loan-servicing or recovery functions. RBI’s Digital Lending Directions define an LSP as an agent of a regulated entity carrying out one or more digital lending functions, including customer acquisition, underwriting-related services, servicing, monitoring or recovery on behalf of the regulated entity.
The most important rule is this:
The NBFC remains responsible. The LSP may perform outsourced functions, but the regulated entity cannot outsource regulatory responsibility.
This article explains how an NBFC-LSP Agreement should be structured, what clauses are essential, what RBI compliance points must be covered, and what mistakes fintech founders and NBFCs must avoid.
What Is an LSP?
An LSP, or Lending Service Provider, is an agent of a regulated entity that performs one or more digital lending functions for that regulated entity. These functions may include:
- Customer acquisition.
- Services incidental to underwriting.
- Services incidental to pricing.
- Loan servicing.
- Monitoring.
- Recovery of a specific loan or loan portfolio.
- Operating or supporting a Digital Lending App.
- Customer interface and borrower support.
RBI’s definition makes it clear that the LSP acts on behalf of the regulated entity and must function in conformity with RBI’s outsourcing framework.
What Is an NBFC-LSP Agreement?
An NBFC-LSP Agreement is the main legal contract governing the relationship between:
- The NBFC / regulated entity, which lends, sanctions, disburses, books and owns the loan; and
- The LSP / fintech partner, which performs agreed outsourced digital lending functions.
The agreement should not be a generic service agreement. It must be a regulatory-grade contract covering:
- RBI compliance.
- Product scope.
- Borrower journey.
- DLA obligations.
- Data privacy.
- KFS and disclosures.
- Fund-flow restrictions.
- Grievance redressal.
- Recovery conduct.
- Audit and inspection rights.
- DLG/FLDG, if applicable.
- Monitoring and reporting.
- Termination and transition.
- Indemnity and regulatory liability.
RBI specifically requires digital lending involving an LSP to be carried out under a contractual agreement between the RE and LSP clearly defining the roles, rights and obligations of each party.
Why a Strong NBFC-LSP Agreement Matters
A weak agreement can create serious risks:
- RBI inspection risk.
- Borrower complaint risk.
- Data misuse risk.
- Unauthorised fund-flow risk.
- Illegal fee collection risk.
- Recovery harassment risk.
- Mis-selling risk.
- DLG/FLDG non-compliance.
- Data breach liability.
- Termination and portfolio transition disputes.
For a fintech founder, the agreement determines whether the business is bankable, compliant and scalable.
For an NBFC, the agreement determines whether the outsourced model can survive regulatory scrutiny.
RBI’s Core Principle: NBFC Remains Responsible
The RBI’s Digital Lending Directions state that outsourcing agreements with LSPs do not dilute or absolve the regulated entity of statutory or regulatory obligations, and the RE remains fully responsible and liable for the acts and omissions of the LSP.
This means the agreement must not say:
- “LSP alone is responsible for borrower disclosures.”
- “LSP may independently collect charges from borrowers.”
- “LSP controls repayment flow.”
- “NBFC has no responsibility for LSP’s recovery conduct.”
- “LSP may change app journey without NBFC approval.”
- “NBFC cannot audit LSP systems.”
Such drafting creates regulatory exposure.
Essential Clauses in an NBFC-LSP Agreement
1. Parties and Regulatory Status Clause
The agreement should clearly state:
- NBFC is a regulated entity.
- LSP is acting as service provider/agent.
- LSP is not the lender unless separately authorised as RE.
- Loan is sanctioned and booked by the NBFC.
- Borrower relationship remains with the NBFC.
- LSP acts only within contractual scope.
This clause prevents the LSP from appearing as an unauthorised lender.
2. Scope of Services Clause
The agreement must define exactly what the LSP will do.
Possible services may include:
- Digital lead generation.
- Borrower onboarding support.
- DLA operation.
- Application form capture.
- Document upload support.
- Credit-rule engine support.
- Fraud screening support.
- Customer communication support.
- Loan-servicing assistance.
- EMI reminder support.
- Recovery agency role, if specifically permitted.
- Customer grievance intake.
Avoid vague language like “LSP shall manage lending operations.” That may create regulatory ambiguity.
3. No Lending by LSP Clause
The agreement should state that:
- LSP shall not lend from its own balance sheet under this arrangement.
- LSP shall not represent itself as lender.
- LSP shall not issue sanction letters in its own name.
- LSP shall not promise loan approval.
- LSP shall not modify loan terms without NBFC approval.
- LSP shall not collect repayment except where expressly permitted by RBI rules and the NBFC’s written process.
This keeps the legal architecture clean.
4. Fund-Flow Compliance Clause
This is one of the most important clauses.
RBI requires that loan disbursal be made by the regulated entity directly into the borrower’s bank account, except for specified exceptions. RBI also provides that disbursal should not be made to a third-party account including the LSP account, and servicing/repayment should be executed by the borrower directly into the RE’s bank account without pass-through or pool account control by the LSP.
The agreement must therefore prohibit:
- Disbursement to LSP account.
- Repayment into LSP pool account.
- LSP-controlled escrow unless lawfully structured and permitted.
- LSP holding borrower funds.
- LSP deducting fees from disbursal.
- LSP collecting borrower charges separately.
The agreement should contain a direct fund-flow representation and an audit right over payment rails.
5. LSP Fees and Charges Clause
RBI states that fees, charges and reimbursements payable to LSP must be paid directly by the regulated entity and must not be separately charged to or collected from borrowers by the LSP.
The agreement should clearly provide:
- NBFC pays LSP service fee.
- LSP shall not charge borrower separately for lending services.
- Any fee payable by borrower must be disclosed in KFS and collected lawfully by the RE.
- No hidden processing fee.
- No convenience fee outside KFS.
- No recovery fee from borrower by LSP.
- No deduction from disbursal by LSP.
This clause is central for compliance and borrower protection.
6. KFS and Disclosure Clause
The agreement must require the NBFC and LSP to support delivery of proper borrower disclosures.
RBI requires the RE to provide a Key Fact Statement and ensure that digitally signed documents on the RE’s letterhead, including KFS, loan summary, sanction letter, terms and conditions, account statements, and privacy policies of the RE/LSP concerning storage and usage of borrower data, automatically flow to the borrower by registered and verified email/SMS upon execution of the loan contract or transaction.
The agreement should cover:
- KFS generation.
- KFS display before consent.
- APR disclosure.
- Penal charges disclosure.
- Cooling-off period disclosure.
- Sanction letter delivery.
- Loan agreement delivery.
- Privacy policy delivery.
- Document logs.
- Audit trail of borrower acceptance.
7. Digital Lending App Clause
Where the LSP operates a DLA, the agreement should define:
- Ownership/control of DLA.
- Approval rights of NBFC over user journey.
- No dark patterns.
- No misleading loan offers.
- No unauthorised access to phone data.
- No change in product without NBFC approval.
- Display of NBFC name.
- Display of grievance officer details.
- Display of privacy policy.
- Record of borrower consent.
If the LSP has arrangements with multiple REs, RBI requires a digital view of loan offers matching the borrower’s request and mandates that content displayed by the LSP must be unbiased and objective, without directly or indirectly pushing a particular RE’s product through deceptive patterns.
8. Multi-Lender Marketplace Clause
If the LSP works with more than one NBFC or lender, the agreement must regulate the marketplace logic.
RBI requires that where an LSP has agreements with multiple REs, the LSP must provide a digital view of matching loan offers. The display should include lender name, loan amount, tenor, APR, monthly repayment obligation, penal charges where applicable, and a KFS link for each RE.
The agreement should therefore include:
- Loan-offer ranking methodology.
- Pre-disclosed ranking metric.
- No biased display.
- No hidden paid preference.
- No dark patterns.
- KFS link for each offer.
- Uniform treatment of similarly placed borrowers.
- Audit trail of offer display.
This clause is critical for fintech marketplaces.
9. Data Privacy and Consent Clause
Digital lending is data-heavy. The agreement must regulate:
- What data is collected.
- Purpose of collection.
- Borrower consent.
- Data minimisation.
- Storage location.
- Access controls.
- Data-sharing limits.
- Retention period.
- Deletion/return on termination.
- Breach notification.
- Audit logs.
- Privacy policy alignment.
RBI expects RE due diligence to consider the LSP’s technical capabilities, data privacy policies and storage systems. It also requires privacy policies relating to storage and usage of borrower data to be provided to borrowers in the digital lending journey.
10. Customer Grievance Redressal Clause
RBI requires the RE and borrower-facing LSP to designate nodal grievance redressal officers for digital-lending complaints, display their contact details on websites and DLA, and make complaint lodging available on the DLA and website. Responsibility for grievance redressal continues to remain with the RE.
The agreement should specify:
- LSP grievance officer details.
- NBFC grievance officer details.
- Complaint acknowledgement timeline.
- Escalation matrix.
- Data-sharing for complaint handling.
- CMS/RBI Ombudsman escalation.
- Record preservation.
- Monthly complaint MIS.
- Root-cause review.
- Penalty for unresolved complaints caused by LSP.
11. Recovery Conduct Clause
If the LSP performs recovery support, the agreement must be very strict.
It should provide:
- Recovery only after NBFC authorisation.
- Recovery scripts approved by NBFC.
- No threats or harassment.
- No public humiliation.
- No calls at prohibited hours.
- No false legal threats.
- No contacting unrelated third parties unlawfully.
- No access to borrower contacts except legally permitted data.
- Full call logs and visit records.
- Training and certification of recovery staff.
- Immediate removal of violating agents.
- Indemnity for misconduct.
RBI’s Digital Lending Directions require the RE to guide LSPs acting as recovery agents and ensure compliance with applicable recovery-agent instructions.
12. Audit and Inspection Rights Clause
The NBFC must be able to monitor the LSP.
The agreement should give the NBFC:
- Right to audit systems.
- Right to inspect records.
- Right to access borrower communications.
- Right to review consent logs.
- Right to check data storage.
- Right to verify fund-flow compliance.
- Right to review grievance records.
- Right to inspect recovery conduct.
- Right to conduct external audit.
- Right to remedial directions.
RBI outsourcing requirements for NBFCs require written agreements to clearly define outsourced activities, allow NBFC access to books and records, provide for continuous monitoring, permit audits, preserve confidentiality and allow RBI access/inspection where required.
13. Regulatory Inspection Clause
The agreement should expressly state that RBI or persons authorised by RBI may access documents, records, transaction data and other information held by the LSP in relation to the outsourced activity.
This is important because an LSP cannot block regulatory inspection by saying that data belongs to the LSP or is stored in its systems.
14. DLG / FLDG Clause
If the arrangement includes Default Loss Guarantee or FLDG, it must be separately and carefully drafted.
RBI defines DLG as a contractual arrangement where another entity guarantees to compensate the RE for loss due to default up to a specified percentage of a loan portfolio. RBI FAQs state that the DLG cover must not exceed 5% of the amount of the relevant loan portfolio and that the portfolio must be identifiable and measurable.
A DLG clause must cover:
- Whether DLG is applicable.
- Whether LSP is eligible to provide DLG.
- Upfront identified portfolio.
- Maximum 5% cap.
- Form of guarantee.
- Invocation event.
- Invocation timeline.
- Auditor-certified declaration.
- Portfolio monitoring.
- No substitution for underwriting.
- Accounting and provisioning responsibility.
- Disclosure and regulatory compliance.
RBI Directions also state that REs may enter DLG arrangements only with an LSP/other RE engaged as an LSP, and the LSP providing DLG must be incorporated as a company under the Companies Act, 2013. The RE must have a board-approved DLG policy and must not treat DLG as a substitute for robust credit appraisal and underwriting.
15. Underwriting Boundary Clause
The agreement should clearly define what the LSP can and cannot do.
The NBFC should retain:
- Credit policy ownership.
- Loan approval discretion.
- Sanction authority.
- Final underwriting decision.
- Pricing approval.
- Credit-risk ownership.
- Loan-book ownership.
The LSP may provide technology, data processing, scorecard support or fraud-screening support, but it should not become the de facto lender unless separately regulated.
16. Compliance With Borrower Creditworthiness Requirement
RBI requires the RE to obtain necessary information relating to the economic profile of the borrower for assessing creditworthiness, including at minimum age, occupation and income details, and keep the same on record for audit purposes. RBI also prohibits automatic increase in credit limit unless an explicit request is received, evaluated and kept on record.
The agreement should require the LSP to:
- Capture borrower data accurately.
- Prevent fabricated applications.
- Preserve income/occupation details.
- Maintain audit trail.
- Prevent auto top-up without borrower request.
- Route all credit decisions to NBFC.
17. Representations and Warranties
The LSP should represent that:
- It is duly incorporated and validly existing.
- It has authority to enter the agreement.
- It will comply with RBI directions.
- It will comply with data protection laws.
- It has adequate technology systems.
- It has not been blacklisted by a regulator.
- It will not misrepresent loan terms.
- It will not hold borrower funds.
- It will not charge borrowers unlawfully.
- It will not use borrower data for unauthorised purposes.
The NBFC should represent that:
- It is duly registered/authorised.
- It has power to lend.
- It owns credit policy.
- It will issue KFS and sanction documents.
- It will comply with lender-side obligations.
18. Indemnity Clause
The LSP should indemnify the NBFC for losses arising from:
- Mis-selling.
- Data breach.
- Unauthorised fee collection.
- Unauthorised fund handling.
- Recovery misconduct.
- Non-compliant DLA journey.
- Fake documents or application fraud caused by LSP systems.
- Employee or subcontractor misconduct.
- Regulatory penalty attributable to LSP breach.
- IP infringement.
The indemnity should survive termination.
19. Subcontracting Clause
LSP should not subcontract material services without NBFC’s prior written consent.
The clause should cover:
- Prior approval.
- Due diligence of subcontractor.
- Flow-down obligations.
- Data-access restrictions.
- Audit rights.
- Confidentiality.
- Termination rights.
- Continued responsibility of LSP.
RBI outsourcing expectations require NBFC consent for use of subcontractors in outsourced activity.
20. Business Continuity and Exit Clause
The agreement must provide a clean exit mechanism.
It should cover:
- Termination for regulatory breach.
- Termination for data breach.
- Termination for borrower complaints.
- Termination for RBI direction.
- Portfolio transition.
- Return/deletion of data.
- Continuity of borrower servicing.
- Handover of records.
- Survival of confidentiality.
- Assistance during audit/investigation.
RBI outsourcing expectations require contingency and business-continuity controls so that unexpected termination of the service provider does not break the NBFC’s operations.
NBFC-LSP Agreement Checklist
Commercial Clauses
- Scope of services.
- Service fee.
- Invoice and GST.
- SLA.
- Lead quality metrics.
- Portfolio-performance reporting.
- DLG fee, if applicable.
- No borrower-side LSP fee.
- Payment timeline.
- Taxes and withholding.
Regulatory Clauses
- RBI Digital Lending compliance.
- Outsourcing compliance.
- DLA compliance.
- KFS delivery.
- Borrower disclosure.
- Fund-flow restriction.
- Grievance redressal.
- Recovery conduct.
- Audit and inspection.
- Regulatory reporting support.
Data Clauses
- Consent.
- Privacy policy.
- Data minimisation.
- Data storage.
- Encryption.
- Access control.
- Retention.
- Deletion.
- Breach notification.
- Data-use limitation.
Risk Clauses
- Indemnity.
- Limitation of liability.
- Fraud reporting.
- Regulatory penalty allocation.
- Suspension rights.
- Step-in rights.
- Termination rights.
- Transition assistance.
- Business continuity.
- Dispute resolution.
Common Mistakes in NBFC-LSP Agreements
1. Treating LSP as Independent Lender
This is risky unless the LSP is itself regulated and legally lending.
2. Allowing LSP to Collect Borrower Fees
RBI requires LSP fees to be paid by the RE and not separately charged to or collected from borrowers by the LSP.
3. Using LSP Pool Account
Loan disbursal and repayment must generally happen directly between borrower and RE without LSP pass-through/pool-account control.
4. No Audit Rights
A fintech service provider handling borrower data and loan processes must be auditable.
5. Weak Data Clauses
Data misuse can destroy the model even if the commercial structure is otherwise strong.
6. No Grievance Matrix
Borrower complaints must not get lost between NBFC and LSP.
7. No DLG Compliance
A casually drafted FLDG clause can create regulatory breach.
8. No Exit Plan
Portfolio transition must be planned before things go wrong.
Practical Drafting Strategy
A strong NBFC-LSP Agreement should be drafted in layers:
Layer 1: Relationship Architecture
Define lender, agent, borrower relationship, ownership of loan, regulatory responsibility and product structure.
Layer 2: RBI Compliance
Build RBI Digital Lending Directions, outsourcing norms, KFS, DLA and fund-flow restrictions into the contract.
Layer 3: Operational SOPs
Attach annexures for borrower journey, data flow, complaint flow, recovery flow, reporting and audit.
Layer 4: Commercial Terms
Define service fee, SLA, invoicing, GST, DLG if applicable and performance metrics.
Layer 5: Risk Protection
Add indemnity, audit, breach, suspension, termination, transition and regulatory cooperation clauses.
People Also Ask
Is an LSP allowed to lend money?
An LSP generally acts as a service provider/agent for the regulated lender. If it wants to lend from its own balance sheet, it must independently satisfy applicable regulatory requirements.
Can an LSP collect processing fee from the borrower?
For digital lending LSP services, RBI requires fees, charges and reimbursements payable to LSP to be paid by the RE and not separately charged to or collected from borrowers by the LSP.
Can loan repayment go into an LSP account?
Generally no. RBI requires repayment to be executed directly into the RE’s bank account without pass-through/pool account of a third party including the LSP, subject to limited exceptions.
Does an LSP need a grievance officer?
A borrower-facing LSP must designate a nodal grievance redressal officer for digital-lending complaints, and the RE remains responsible for grievance redressal.
Can an LSP provide FLDG?
DLG/FLDG is permitted only within the RBI framework. RBI FAQs clarify the 5% cap and fixed identifiable portfolio requirement.
Frequently Asked Questions
1. What is an NBFC-LSP Agreement?
It is a contract between an NBFC and a Lending Service Provider for outsourced digital-lending functions such as acquisition, onboarding, servicing, monitoring or recovery.
2. Is an LSP the lender?
Usually no. The NBFC remains the lender, while the LSP acts as an agent/service provider unless the LSP is independently regulated and lending under a separate structure.
3. What is the most important clause in an NBFC-LSP Agreement?
The fund-flow clause is critical. Disbursement and repayment must generally flow directly between borrower and regulated entity, not through LSP-controlled accounts.
4. Can the LSP charge the borrower?
For LSP lending services, fees payable to LSP must be paid directly by the RE and not separately charged to or collected from the borrower by the LSP.
5. What disclosures must be given to borrowers?
KFS, sanction terms, loan summary, account statements, privacy policies and relevant loan documents must be provided digitally as required under RBI directions.
6. Can LSP operate the loan app?
Yes, but the DLA must comply with RBI Digital Lending Directions, borrower disclosure requirements, grievance obligations, data safeguards and NBFC oversight.
7. Is FLDG allowed in NBFC-LSP arrangements?
Yes, subject to RBI’s DLG framework, including eligibility, 5% cap, identified portfolio, auditor-certified declaration and board-approved policy.
8. Who is responsible if the LSP violates RBI rules?
The regulated entity remains responsible and liable for LSP acts and omissions, though the agreement may provide indemnity and remedies against the LSP.
9. Should data privacy be part of the agreement?
Yes. Data collection, consent, storage, usage, sharing, retention, deletion, security and breach reporting must be specifically covered.
10. What should an NBFC check before signing with an LSP?
Technical capability, data privacy systems, borrower conduct, complaints history, financial strength, compliance ability, recovery practices, data security and operational resilience.
Also Read Who is Advocate Govind Bali | Fastrack Legal Solutions LLP
Conclusion
An NBFC-LSP Agreement is not a routine vendor contract. It is a regulated financial-services outsourcing agreement. If drafted casually, it can expose both the NBFC and fintech partner to RBI scrutiny, borrower complaints, data disputes, fund-flow violations and commercial breakdown.
A legally strong agreement must clearly define the LSP’s role, prohibit unauthorised lending or fund handling, ensure direct borrower-to-RE fund flow, regulate fees, mandate KFS and borrower disclosures, provide grievance redressal, secure data, permit audit, control recovery conduct and structure DLG/FLDG only within RBI limits.
For fintech founders, the agreement must prove that the model is compliant and scalable. For NBFCs, it must prove that regulatory responsibility, borrower protection and operational control remain intact.
The practical rule is simple: build the compliance architecture before signing the commercial deal.
Also Read Lien on Bank Account in India | Meaning, Reasons, Legal Remedy & De-freezing Procedure
Disclaimer
This article is for general legal awareness and educational purposes only and may be published by Fastrack Legal Solutions LLP. It is not an advertisement, solicitation, invitation or inducement for professional engagement. NBFC-LSP arrangements depend on RBI directions, outsourcing framework, DLA structure, borrower journey, data flow, fund flow, DLG/FLDG model, commercial terms and case-specific regulatory requirements.
