Lending PAs And Wealthtech In A Converging RBI SEBI IRDAI Regulatory Landscape

India's fintech ecosystem is entering a phase in which the most successful business models no longer sit neatly within a single regulatory silo. A typical customer now uses one app to borrow, another to route payments, a third to invest, and a fourth to obtain insurance, but in practice these journeys blur into each other and implicate the mandates of the Reserve Bank of India (RBI), the Securities and Exchange Board of India (SEBI) and the Insurance Regulatory and Development Authority of India (IRDAI) simultaneously.

The regulatory developments of 2025 and early 2026 are therefore best understood not as isolated circulars but as steps towards an integrated supervisory architecture for digital financial services. For boards, general counsel and deal teams in fintech heavy groups, the question is no longer whether each product is compliant in isolation, but whether the group can withstand simultaneous scrutiny from all three regulators.

The shift is clearest across three pillars of regulation. The Digital Lending Directions 2025 have replaced the multiple circulars sent by the RBI with a single set of guidelines that apply to all lending services with respect to digital lenders, default loss guarantee structures and digital lending apps, and links compliance to granular reporting through the Centralised Information Management System (CIMS) portal. SEBI has tightened expectations around online investment and wealth platforms, signalling through enforcement that it will look at substance over form when deciding whether a fintech is in fact a broker, an investment adviser or a de-facto distributor. IRDAI has widened its regulatory sandbox framework and modernised its regulations to encourage Insurtech innovation while demanding more robust governance, data localisation and board level oversight.

The cumulative impact on fintech companies, which offer all-inclusive services through a single platform that combines payments and lending and investment and insurance products, results in their requirement to design products and legal frameworks for multiple regulatory assessments, which now serve as their fundamental operating standard.

A. RBI Digital Lending Directions 2025

1. Reframing digital intermediation and LSPs

The Digital Lending Directions 2025 mark a turning point in how RBI views digital credit intermediation. The Directions draw a clear line between regulated entities such as banks and non-banking financial companies and their outsourcing partners, but they also redefine the role of those partners by bringing the concept of the Lending Service Provider (LSP) to the centre of the framework. Any entity that sources customers, facilitates underwriting, services loans or assists in recovery using digital channels on behalf of a regulated lender is treated as part of the regulated value chain, even if it is not itself licensed as an NBFC.

It eliminates most ambiguous elements which used to permit platforms to claim they operated as neutral technology suppliers while they maintained power to affect credit assessments and user interactions. It also forces groups to re-examine their outsourcing and intra group services models, because many "backend" units now sit squarely inside the regulatory perimeter as LSPs rather than being treated as pure IT vendors.

2. Re-anchoring DLG structures and fund flows

The Directions also reorganise the economics of digital lending by tightening rules around default loss guarantees (DLGs). In the past, loose documentation was prevalent among first loss guarantee structures that transferred credit risk from regulated entities to fintech partners and many times those partners did not have appropriate capital or governance in place. The 2025 Directions require default loss guarantee providers to meet particular standards which include establishing specified coverage limits and implementing maximum exposure protection.

The calculation of Risk and Capital for lenders must treat these arrangements as transparent functions of their operations. In addition, a requirement for Fund Flow to occur only directly between the lender and borrower, with limited scope for Pass Through Accounts, effectively redirects the control of credit risk and the control of funds into a regulated financial institution from the LSP. In parallel, it is already changing how co lending and FLDG type structures are pitched to investors and partners, because models that relied heavily on off balance sheet risk parking no longer sit comfortably with the regime.

3. CIMS, customer UX and a generic lender case study

A further innovation is the use of the CIMS portal as an information spine. All digital lending apps used by regulated entities must be reported and associated with their principals, giving RBI a live view of which interfaces reach borrowers and under what branding. The Directions couple this with prescriptive requirements on key fact statements, cost disclosures, cooling off periods and grievance redress links that must be built into the user interface in a verifiable way.

Consider a generic app based lender that previously offered near instant credit with minimal upfront information and relied on a guarantee from an unregulated partner to comfort its balance sheet. Following the Directive, lenders must set up a new process for the disbursement of funds and repayments via banks, create new paperwork arrangements with the guarantee provider to comply with the new caps and eligibility rules, and update their app screens to include detailed breakdowns of total costs, annualised percentage rates (APRs), and standardised "cooling-off" rights.

This case is an example of how the RBI is utilising structural tools (to facilitate DLGs and fund flow) and experiential tools (to facilitate disclosure and consent) to prevent digital lending from being a method of transferring financial risk from lenders to borrowers. For multi-product fintechs, the message is that any credit linked offering in their stack will be judged against these expectations, regardless of how the front end is packaged, and that the same LSP and UX standards may be applied across different group entities using a shared app.

B. SEBI Online Investment And Wealth Platforms

1. Substance over form in platform characterisation

On the capital markets side, SEBI's evolving approach to online intermediaries has important implications for wealthtech and investment platforms that monetise user interfaces and data rather than traditional brokerage alone. In a series of enforcement actions and explanatory notes, SEBI has made it clear that platforms will be judged by what they actually do, not by what they call themselves. An app that facilitates execution, curates lists of recommended securities, presents model portfolios or pushes influencer style content may well be performing advisory or distribution functions even if it's terms of use disclaim responsibility.

In practice, SEBI is increasingly sorting platforms into three functional buckets of broker, investment adviser and research analyst/distributor and expects hybrid apps to make deliberate choices about which bucket they sit in rather than oscillating between all three depending on the feature of the week. This in turn drives different suitability, disclosure and conflict management obligations, and makes it harder to hide advisory type functionality behind a "pure execution" label.

2. Enforcement themes and a platform case study

Recently, financial authorities have issued fines to several online companies for their inability to comply with KYC regulations, for giving investment guidance to customers who were not registered as investment advisors, or for creating advertising material that misled customers into believing there were no conflicts of interest when in fact there was. A popular example was in this case when SEBI imposed a financial penalty and directed correction against an app that combined execution with advisory function through offering curated listings of stocks and portfolios without fulfilling the pre-requisites for an investment advisor license.

The lesson for fintechs is that regulatory identity is no longer a mere box ticking exercise. A platform that combines zero brokerage execution, thematic baskets, algorithm driven nudges and influencer partnerships must decide whether it wishes to operate purely as a broker, to take on investment adviser obligations with all the attendant duties of suitability and conflict management, or to strip out those features that cross into advisory territory.

This logic extends to communication and community features. SEBI has signalled through circulars and speeches that finfluencer campaigns, social media content, chat rooms and "educational" webinars will be viewed as part of the regulated perimeter when they are used to drive investment decisions on a platform. A generic case study makes this concrete. Imagine an investing app that markets itself as a community for young investors, with chat rooms, influencer led streams and push notifications about trending stocks, and that derives revenue from order flow, distribution fees or referral arrangements. Even if the app does not charge explicit advisory fees, SEBI may consider whether its business model and content make it an investment adviser or research analyst in substance and therefore subject to those codes of conduct. In that scenario, archives of chat discussions, campaign briefs and influencer scripts become discoverable material in an enforcement action, making record keeping around "community" content a live compliance issue rather than a soft marketing concern.

The practical outcome is that product design, marketing strategy and compliance must now be developed together rather than in separate silos if platforms are to withstand closer supervisory scrutiny. For full stack fintechs, this means that investment and wealth features cannot be treated as low touch add ons. They sit at the centre of the regulatory conversation and must be aligned with the group's overall risk appetite and licensing strategy.

C. IRDAI Insuretech And Sandbox

1. Innovation under data and governance guardrails

IRDAI's regulatory reforms over the last year complement these trends by recognising the need for experimentation while setting clearer expectations on data and governance. The Regulatory Sandbox Regulations 2025 and their associated master circulars permit insurers and intermediaries to test their innovative products and pricing models and distribution channels which use advanced data processing and automated systems. At the same time, the framework demands board approved policies on record keeping, information security and data sharing, and reiterates that records must be maintained in data centres located in India.

For many Insurtech propositions, the core innovation lies in data driven underwriting, automated claims and AI based risk scoring rather than the insurance cover itself. By insisting on governance, localisation and auditability of data even within sandbox pilots, IRDAI is effectively signalling that experimentation is welcome, but only if the algorithms, training data and deployment pipelines can be supervised, explained and, where necessary, halted.

2. From narrow pilots to inter regulatory experiments

The sandbox is no longer conceived as a narrow space for isolated pilots. It is explicitly linked to an inter regulatory sandbox approach under which products that sit at the junction of banking, securities and insurance can be tested with input from more than one regulator. This situation applies specifically to parametric insurance products and bundled offerings which depend on payment and investment system data to determine when coverage begins and to modify their pricing.

A hypothetical Insurtech proposition illustrates how the new framework operates. Suppose an insurer and a fintech partner wish to launch a travel or health product that uses payment data from a bank and location or health data from a mobile app to determine when cover attaches and when claims are paid. Under the 2025 regulations they can apply for sandbox approval, but they must specify what categories of data will be processed, how consent will be obtained, how long data will be retained, how the experiment will be wound down or converted to a regular product and how customers will be informed that they are part of a pilot.

The regulatory sandbox process requires all applicants to present detailed proposals which must follow specific time limits, volume restrictions and required disclosure requirements. The IRDAI requires applicants to establish fundamental governance systems and consumer protection mechanisms which they must use throughout their entire supervision process from the beginning of their experimental work.

Boards will therefore want to understand not only the upside of sandbox participation but also what happens to data, customers and reputational exposure if an experiment is not regularised. For fintechs that already navigate RBI and SEBI regimes, this is another indication that innovation in financial services is now inextricably tied to demonstrable control of data and processes across the group.

D. Designing A Unified Compliance Architecture

1. Mapping activities and data across regulators

Against this backdrop, the core challenge for multi-product fintechs is conceptual rather than purely technical. A firm that facilitates digital lending, routes payments through a PA stack, enables securities investments and offers insurance distribution on the same app can no longer treat each line of business as having its own self-contained compliance universe. The starting point must be an activity map that identifies which entity in the group is the regulated entity for each product, which functions are outsourced to group companies or third party service providers and which data sets are used at each stage.

In practice, the same KYC record or behavioural data may feed both lending and brokerage journeys, and the same device level information may be relevant for insurance underwriting, which is why this mapping must be done at a group level rather than business line by business line. For it to be useful, the activity map should be maintained as a live, board level artefact, for example as part of risk committee packs rather than as a one-time consulting exercise that quickly goes out of date as products and partners evolve.

2. Aligning policies and contracts to the strictest standard

Once this map is in place, internal policies on outsourcing, information security, grievance redress, incident reporting and conflicts need to be calibrated to the strictest applicable standard across RBI, SEBI and IRDAI rather than the most lenient. For instance, while RBI has specific guidelines regarding consent and disclosure as part of its digital lending framework, SEBI also imposes certain requirements regarding the suitability of advice and the disclosure of fees/commissions during the sale of the investment products.

So a product journey that combines credit and investment features must be designed to satisfy both sets of expectations. Similarly, if IRDAI's insistence on localised storage applies to insurance related data, group wide data architecture may need to reflect that constraint for interconnected databases rather than treating insurance as an isolated vertical.

These choices then need to filter down into actual documents and builds. Consent language and privacy notices across the app, for instance, will increasingly have to be harmonised to a common, highest standard template so that the same KYC record can legitimately be used across lending, investment and insurance journeys without creating regulatory gaps.

Contracts are the second leg of this architecture. Agreements between fintechs and partner banks or NBFCs, brokers, custodians and insurers must allocate regulatory functions and liabilities with a level of specificity that older technology services templates often lack. Parties must decide who is responsible for KYC, who owns the client relationship, who handles complaints and incident reporting and how changes in regulation will be handled economically and operationally.

These choices then need to be reflected in application programming interfaces and workflow logic, so that, for instance, a loan cannot be disbursed in a way that violates RBI fund flow rules, an investment recommendation cannot be pushed to a client outside her risk profile and insurance data cannot be exported in a way that contravenes localisation norms. For full stack fintechs, a unified compliance architecture is therefore as much an exercise in contract design and systems engineering as it is in regulatory interpretation.

E. Implications For Boards Investors And Deal Lawyers

1. Reframing board and investor diligence

For boards and investors, the converging regulatory landscape should change how fintech opportunities are evaluated. It is no longer sufficient to ask whether an entity holds the right licences and is growing quickly, it is equally important to understand whether its revenue model depends on regulatory arbitrage that may not survive full implementation of the Digital Lending Directions, SEBI's platform governance expectations and IRDAI's sandbox and data rules.

Boards may wish to see a clear regulatory map, a record of interactions with supervisors and a plan for engaging with emerging inter regulatory initiatives, rather than treating compliance as a cost centre to be managed reactively. Firms that can demonstrate resilient governance across all three regulatory pillars may be viewed differently by sophisticated investors than those whose models are heavily exposed to future tightening.

2. Structuring investments and partnerships under convergence

For transactional and in house counsel, structuring investments and partnerships in this environment demands closer alignment between commercial and regulatory analysis. Acquisition and investment documents should price in the cost of aligning a target's practices with converging standards and the risk that existing business lines may need to be redesigned or wound down. Distribution and co-branding agreements between fintechs and banks, NBFCs, brokers or insurers should contain detailed representations, covenants and indemnities concerning ongoing compliance with digital lending norms, intermediary obligations and insurance distribution rules, and should give counterparties sufficient audit and information rights to demonstrate oversight to their own regulators.

If approached correctly, this emerging convergence does not necessarily only need to be taken in a defensive position. Fintech firms that are able to establish a level of confidence among their regulators through resilient governance structures across each of the three regulatory pillars may also discover that they will increase their chances of being viewed by supervisors as credible partners for sandbox and policy experimentation projects, and also of attracting premium investments from sophisticated investors looking for sustainable business models.

In a landscape where the boundaries between payments, credit, investments and insurance are increasingly porous, the capacity to operate comfortably under the combined gaze of RBI, SEBI and IRDAI may become a key source of strategic advantage and, for investors, a due diligence premium as well as a valuation premium.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.