How to verify regulated lenders: RBI registered NBFC lists and DLA directories

This page covers verification procedures for all mobile applications, web portals, and Buy Now Pay Later (BNPL) platforms offering credit products to Indian consumers and businesses.

It provides practical steps to audit the regulatory credentials of fintech platforms. It explains how to navigate the official RBI registered NBFC database, check bank website partner directories, utilize the central SACHET portal, and report unauthorized financial applications.

The legal requirement for institutional transparency in digital lending is established under the Reserve Bank of India Guidelines on Digital Lending (2 September 2022):

1. Mandatory disclosure of partner LSPs: Under paragraph 1.1 of the Digital Lending Guidelines, regulated entities (banks and NBFCs) must prominently display on their official corporate websites the list of all Digital Lending Apps (DLAs) and Lending Service Providers (LSPs) engaged by them to offer credit products.
2. Prominent app disclosures: The mobile app itself must prominently display on its landing page, in the app store description, and on its splash screen:
   • The exact legal corporate name and registered office address of the partner bank or NBFC;
   • The Corporate Identity Number (CIN) and RBI Certificate of Registration (CoR) number;
   • A direct hyperlink to the partner bank or NBFC's official website where the app's partnership is formally confirmed;
   • The name, email, and physical address of the designated Nodal Grievance Officer.
3. The SACHET platform: Established by the State Level Coordination Committee (SLCC) under the aegis of the Reserve Bank of India, the SACHET portal (sachet.rbi.org.in) serves as the central statutory registry for checking whether a non-banking entity is authorized to accept deposits or carry out financial business in India.

Before you install an app or submit your PAN card, follow this four-step verification process:

Step 1: Identify the underlying regulated lender

Open the app's listing page on Google Play or the Apple App Store. Scroll down to the "About this app" section and the developer's registered address.

• Look for an explicit declaration stating: "Loans are disbursed by our RBI-registered NBFC partner: [Company Name] (RBI CoR No. [XXXXX])"
• If the app makes vague claims such as "We connect you to top financial institutions" without naming a single specific, verifiable corporate bank or NBFC, the app is an unauthorized lead aggregator or an illegal operator.

Step 2: Verify the NBFC on the RBI Master Portal

1. Open your web browser and go to the official Reserve Bank of India website at rbi.org.in.
2. Navigate to the "Sitemap" or search for "List of NBFCs" (or visit rbi.org.in/Scripts/BS_NBFCList.aspx).
3. Download the official Excel/PDF list of active non-banking financial companies holding valid Certificates of Registration.
4. Search for the exact legal name of the NBFC claimed by the app. Confirm that:
   • The corporate name matches character-for-character;
   • The registered office address is genuine;
   • The registration status is marked as "Active" (not canceled, surrendered, or suspended).

Step 3: Check the bank or NBFC's official DLA partner directory

Even if an NBFC exists, rogue apps sometimes falsely claim affiliation with legitimate companies.

1. Open a new browser tab and navigate to the official website of the named NBFC (e.g., search the company's verified domain).
2. Look in the footer or menu bar for a section titled "Digital Lending Partners", "List of LSPs / DLAs", or "Our Sourcing Partners".
3. Under RBI rules, every licensed lender is legally required to maintain a publicly visible directory of all authorized mobile apps.
4. Search the list for the exact name of the app you downloaded. If the app is listed on the NBFC's official website, the app is legitimate. If the app is missing from the NBFC's published list, the app is an illegal clone impersonating the lender.

Step 4: Cross-check on the SACHET portal

If you are uncertain about the entity's status:

1. Visit sachet.rbi.org.in.
2. Click on "Help Your Regulator" or use the search registry to verify whether the entity is registered under any state or central financial regulatory framework.
3. If the entity does not appear or has been flagged for unapproved lending activities, do not proceed with the loan.

A frequent trap is "Name Spoofing". Fraudulent operators deliberately choose corporate names that closely resemble registered NBFCs. For example, if a legitimate registered company is named "ABC Financial Services Limited", a fraudulent app will name itself "ABC Finance & Credit Private Limited" or "ABC Quick Cash", tricking unsuspecting borrowers into believing they are borrowing from a regulated entity.

Another deceptive tactic involves "Dead or Canceled NBFC Fronts". Fraudulent apps frequently display RBI Certificate of Registration numbers belonging to old NBFCs whose licenses were canceled by the RBI years earlier. If you only look for a registration number on the app's splash screen without cross-checking the live RBI active list, you will fall victim to an unregulated operator.

Furthermore, rogue apps frequently insert dead or fake hyperlinks in their Google Play store descriptions, linking to broken domains or generic blog pages rather than genuine corporate websites.

To protect yourself and your family:

1. Always verify the lender across both the RBI active database and the lender's corporate DLA directory before uploading any identity proof or bank statements.
2. If an app claims to be partnered with a well-known commercial bank (e.g., State Bank of India, HDFC Bank, ICICI Bank), never apply through third-party apps unless that partnership is explicitly listed on the bank's official domain (sbi.co.in, hdfcbank.com, icicibank.com).
3. If you discover that an app is falsely claiming affiliation with an NBFC or is operating without a valid license, report the application immediately on the RBI SACHET portal at sachet.rbi.org.in.
4. Report the application to Google Play or Apple App Store using the "Flag as inappropriate" or "Report illegal app" button, attaching proof of missing RBI registration.
5. If the app has already harvested your data, consult our comprehensive guide on App harassment and where to report.

State High Courts exercising public interest jurisdiction have established that financial fraud involving fake regulatory credentials strikes at the heart of public confidence in the banking system, mandating that cyber police units treat the unauthorized use of RBI emblems or fake NBFC claims as serious criminal forgery and cheating under the penal code.

Where can I find the official list of RBI-approved loan apps? The RBI does not publish a single list of approved apps; instead, it publishes a master list of all licensed commercial banks and registered NBFCs at rbi.org.in. Each licensed bank or NBFC is legally required to publish its own list of approved digital lending apps (DLAs) on its official corporate website [1][2].

What is the SACHET portal? SACHET (sachet.rbi.org.in) is an official online platform established by the Reserve Bank of India and state regulatory coordination committees where citizens can verify financial entities and report unauthorized lenders, illegal loan apps, and fraudulent deposit schemes [3].

How do I check if an NBFC's license is active or canceled? Visit rbi.org.in, navigate to the "Non-Banking Financial Companies" section, and download the latest list of active NBFCs holding a valid Certificate of Registration. The RBI also publishes a separate list of NBFCs whose licenses have been canceled.

What should I do if an app claims to be partnered with a bank, but the bank's website doesn't list it? Do not use the app. Under RBI rules, a lending app can operate only if it is formally listed on the partner bank's website. If the app is missing from the bank's published DLA directory, it is an unauthorized operator or an illegal clone [2].

Can an NBFC lend through multiple different mobile apps? Yes. A registered NBFC can partner with multiple technology companies (Lending Service Providers), but every single app must be explicitly disclosed on the NBFC's official corporate website and in the loan's Key Fact Statement [2].

• Legal vs illegal loan apps — identifying warning signs and operational red flags.
• Data permissions and privacy rules — legal boundaries on mobile data harvesting.
• App harassment and where to report — filing cybercrime and police complaints.
• Fees, cooling-off and disclosures — standardized KFS and APR requirements.