BNPL Industry On The Rise, But Lack of Regulations, Data Protection Measures A Challenge

The partnership between NBFCs and digital lenders has been the talk of the town as it opens a whole world of opportunities for them. Easier access to loans, faster credit disbursals and smoother regulatory compliance are at the centre of these partnerships. Many digital lenders, in fact, nurse an ambition to become new-age non-banking finance companies (NBFCs).

However, the public perception of digital lending has suffered at the hands of shady operators. Their unscrupulous recovery methods and high-interest rates have tarnished the image of digital lenders. On top of it, even bonafide companies are found wanting in governance matters. Their lapses in KYC compliance and slack data protection measures have caused resentment among customers.

Ghost Lending Brings Governance Issues To The Fore

Governance lapses in the digital lending space again came to the fore after a slew of identity theft cases were reported recently. In one such instance, imposters availed loans from Indiabull’s digital lending arm Dhani by furnishing stolen PAN and other personal data. Dozens of victims of the fraud vent their anger on Twitter on the issue. Impostors find it easy to cheat because digital lending companies ask customers to only upload PAN and address proof.

The Dhani episode was a failure on the part of the digital lender to comply with KYC guidelines. Digital lenders cannot be oblivious to the fact that leaked private data can be accessed in the dark web. 

Victims of impersonation are, therefore, right when they squarely blame the lenders for their failure to independently verify the KYC details before a loan is disbursed. The victims have reasons to be aggrieved because the loan, which they never availed of, reflects poorly on their credit records. 

“Identity theft is an issue as old as credit, and whenever there is a new paradigm for credit, identity thieves find new exploits. This happened with the rise of consumer credit in the US, and in India, it is happening now with schemes like BNPL (buy now pay later),” said Utkarsh Sinha, managing director of Bexley Advisors. Sinha was earlier the convenor of the fintech committee of the Internet and Mobile Association of India (IAMAI).

Lack of clarity on regulations is also a reason for random ghost lending and other governance issues in the digital lending space. Self-regulatory measures and code of conduct are ideal, Narendra M, former CMD of Indian Overseas Bank, said.

The criminal circumvention of the KYC guidelines by impostors came to light only after individuals reported it on social media. It is not known immediately how deep the rot is. Dhani has reportedly hired an external agency to investigate the matter, and hopefully, the extent of ghost lending there will be known soon.

The need of the hour, however, is that digital lenders strictly enforce internal audits and make the audit reports public. It would not only unravel ghost lending but also go a long way in restoring the customer confidence in bonafide digital lending business.

“A quick audit and closure of the holes will help plug most of the holes that are being used for exploits. Cleaning up the record of individuals who have been falsely impacted will take longer though,” said Sinha.

Controversies Are Constant Companion of Digital Lending

Digital lending was mired in controversies earlier also. Aggressive lending, usurious interest rates and uncouth recovery measures hogged headlines during the peak of Covid-19. The pandemic caused job losses on a massive scale and borrowing was the only option left for many for survival. There have been many tragic stories of borrowers, unable to bear the harassment and humiliation by dubious digital lenders, ending their lives.

It all got murkier when it was reported that these shady digital lenders were being managed by operators in China. The problem got further compounded as these Chinese apps were in some sort of partnership with NBFCs.

Studies have highlighted three factors responsible for bogus digital-lending practices:

1. While there are about 12,000 registered NBFCs in India, the central bank says only a few hundred are “systemically important”.
2. There are mainly two types of digital lenders:
   • Intermediaries who connect borrowers with lenders are the first category; a large number of illegal digital lending apps fall in this category.
   • The other category comprises lenders who lend themselves and have designed their own apps. They, in RBI parlance, are called balance sheet lenders. They are mostly NBFCs, though some banks also figure on the list.
3. According to an RBI study conducted in 2021, there were about 1,100 lending apps available for Indian Android users across 80 plus application stores and about 600 of them were illegal.

A simple analysis of these points tells us that it is not difficult for a shady operator to reach an understanding with an NBFC licence holder and enter the digital lending space.

A situation wherein every NBFC, no matter its credentials, can do digital lending is not a healthy proposition, Narendra M pointed.

Slack Data Protection Measures

New-age NBFC Navi, founded by Sachin Bansal of Flipkart fame, also attracted the ire of customers for revealing their full PAN details in its marketing communications. Aggrieved customers termed it as scant regard for data privacy. Typically, communications reveal only the last digits of PAN and the rest are masked. 

Experts said it should serve as a reminder to new-age companies to redesign their data collection and data-sharing models. It assumes extra significance as the joint committee of Parliament has submitted its report on Data Protection Bill 2019. 

It was feared that the original legislation, mooted five years ago, would increase the compliance burden on startups tremendously and cripple the startup ecosystem. Meanwhile, it is also reported that the government may bring in a new Bill on personal data protection that will be in sync with the latest developments in global technology.

While governance lapses at Dhani and Navi brought the marriage between fintech and legacy NBFC business under a shadow, data storage and data sharing by new-age tech startups have been under the scanner for some time now. Certain marketing practices at healthtech unicorn PharmEasy also invited the wrath of customers.

PharmEasy, which last year acquired Thyrocare, was accused of making excessive marketing calls to Thyrocare customers. The “reckless” practice also caused apprehensions in certain quarters about the safety of their health details available with the new-age healthtech unicorn now.

Sinha said regulators must place strict guidelines on the sharing and storage of data, with encryption and tokenisation norms that prevent unauthorised exposure.

Why BNPL Loans Need To Be Regulated

BNPL is seen as a game-changing fintech product as it has received a very enthusiastic response from youngsters. A credit product essentially, BNPL is being increasingly deployed by edtech, healthtech and ecommerce companies to induce customers into purchasing. An alternative to credit card, BNPL, according to some surveys, has the potential to phase out traditional credit cards in the long term.  

According to one estimate, the BNPL space is estimated to offer a $40 Bn market opportunity by 2025, growing at an 80% CAGR.

But the opaque ways of BNPL are already bringing a bad reputation to the fintech space. The clever coinage avoids the words debt, loan and credit, and lulls customers into imprudent purchases. Here, the borrower does not get to know who the lender is and in many instances, the terms and conditions are vaguely explained.

Not only NBFC-fintech arrangements but some private banks and foreign lenders are also offering BNPL loans. The Reserve Bank has said that even though the amount disbursed under BNPL loans is only 0.73% (SCBs) and 2.07% (NBFCs) of the total amount disbursed, the volumes are quite significant, indicating a large number of small-size loans.

Many a time, customers realise about the BNPL loan only when they go through their credit reports. Interest rates are usurious if one misses payment date. Even in mature markets like the US, customer grievances against BNPL are on the rise.

Customers have a right to know about the credit nature and how it will reflect in their records. Disclosures to customers are not adequate while extending the BNPL loans.

Stressing the importance of making the customer fully understand the consequence of his action, Narendra M said regulations and policies have a key role to play here. “Regulations should not, however, hurt innovation,” he noted.

Currently, BNPL products do not come under the RBI regulations, but the RBI working group has recommended bringing BNPL within the definition of credit. “The (BNPL) platforms do take creative steps once a loan turns NPA, including post-facto creation of a loan on the books of NBFC. RBI must clearly re-define what constitutes credit so as to classify BNPL as a loan and hence bring it under regulatory coverage,” it said. 

Commenting on the issue, Sinha said, “BNPL terms must be made clear upfront and perhaps a physical notification and consent via the individual’s Aadhaar-linked address and phone number every time a BNPL loan is availed of will help weed out cases of fraud in some cases we have seen so far.”