[The Outline By Inc42 Plus] Online Lending’s Regulatory Dilemma

Dear Reader,

When digital lenders approached Hyderabad-based techie P. Sunil in hordes, assuring him of easy cash, he installed as many as 35 apps on his smartphone to raise small-ticket loans totalling up to INR 2 lakh. He needed the money to service his EMIs after losing his job. But when he defaulted on these digital loans, recovery agents shamed him before friends and family as the apps had unfettered access to his contact list and call logs. Unable to face the humiliation, the techie put an end to his life as a police probe revealed.

And it is not a standalone incident.

Of late, people from all walks of life have fallen victim to digital loan traps as many of them badly needed the cash post the Covid-19 fallout. Google has recently taken down more than 500 lending apps from its Play Store in India (more on that later) that shows the scale of their presence in the country.

According to fintech startup founders and legal experts who track this space, unregulated and illegal lending apps can get away with such tactics as they source the money directly from their balance sheets instead of tying up with regulated channels such as banks and NBFCs, which are subject to fair lending practices.

Akshay Mehrotra, CEO of the online lending app EarlySalary highlighted that nearly 90% companies in the online lending segment choose to go through regulated channels and tie up with NBFCs or banks to source money for lending operations.

“Lending institutions usually apply for an NBFC license, so that they can directly carry out loan recovery operations when customers default. NBFCs are also allowed to work closely with credit bureaus to report defaulters and for conducting credit rating of potential borrowers. But an unorganised (unregulated) lending company cannot directly carry out loan recovery operations or work with credit bureaus. So, they employ third-party loan recovery agents,” Mehrotra adds.

The combination of smartphone apps, unregulated lending, exorbitant interest rates (plus, hidden charges) and methods undertaken for recovery makes things more bizarre and menacing for regulators and law enforcement. Security researcher and privacy activist Srikanth L., who runs an online collective (on digital payments) called Cashless Consumer, tracked down over 400 rogue apps on a public excel sheet.

Many of these rogue lending apps are now under the RBI scanner. And central bank’s clean-up act at this point may not be good news for players hoping to see rapid growth.

Can RBI Curb The Menace?

On Jan 13, the RBI announced the launch of a working group to scrutinise digital lending activities in the regulated financial sector and the unregulated space, look at the risks they pose to consumers and recommend a fair practice code for digital lending players.

The central bank has been cautioning online borrowers since June 2020 when it first took note of the fast-brewing digital lending crisis. But what measures can be recommended by the working group which will enable the underserved masses to avail credit online with adequate safeguards?

For starters, experts suggest bringing in several external members from the fintech ecosystem in the RBI working group. As of now, there are six RBI members in the group and only two from the outside. One of them is Vikram Mehta, a former associate of the P2P lender Monexo Fintech, and the other is Rahul Sasi, founder of the digital risk monitoring firm CloudSEK.

Beni Chugh, research manager at Dvara Research, a consultancy focussed on financial inclusion, told Inc42 that the RBI working group needs to note if these digital lending apps are pushing people into a cycle of predatory decision-making, providing loans to desperate borrowers to grow their own business.

“These apps tend to use deep user-profiling mechanisms which can tell rogue lenders the best time of the month to target a vulnerable borrower. It means user data is first misused to provide loans, and when borrowers default, it is again used to shame them. This will give a clear idea of how these predatory lenders function,” says Chugh.

Indian regulators need to draw the line, similar to the code of conduct followed by the Microfinance Institutions Network. But this time, it will be applicable to an entire digital ecosystem. “For example, no lender should be allowed to access the photo gallery of borrowers; there is no use case for it,” adds Chugh.

According to Anu Tiwari, partner at the law firm Cyril Amarchand Mangaldas, the RBI working group has two foreseeable options to better regulate online lenders. The first is to create a new category of NBFC licensing, tailored for online lenders, along with guidelines for responsible lending and recovery operations. Tiwari cites the existing parallel regulation, currently enforced in the digital insurance segment, where the IRDAI provides a separate licence for web-based insurance aggregators.

The other option that most founders also seem comfortable with is setting up a self-regulatory organisation (SRO) that can frame rules, guidelines and policies, and act as an enforcement agent of the RBI. This is more of a light-touch regulation without the RBI actively conducting audits and checks, says Tiwari.

While there is an imminent need to revisit the regulatory aspects, it is also essential to not impose regulatory restrictions which may hinder India’s digital lending sector, says Abhay Vohra, partner at Burgeon Law. “Either a regulating entity or stronger self-regulatory measures will be able to address some serious issues which are plaguing this sector,” he says.

The Debt Trap

India’s online lending segment has the potential to reach $350 Bn in value by 2023. The segment has at least 147 active digital lenders who have collectively raised $2.4 Bn since 2014, with B2B lending accounting for 44% of total funding deals.

An analysis by Inc42 reveals there were at least 120 Mn EPFO accounts in 2020 without any credit card seeded to them. Also, nearly 30% of the new borrowers in 2020 preferred to opt for fintech-based lenders to raise loans, indicating that online lending was the fastest-growing mode of credit for most users.

According to industry estimates, online lenders are disbursing around INR 5,000-6,000 Cr in loans every month. The Digital Lenders Association of India (DLAI), an industry group consisting of 85 online players, says that its members disbursed loans worth INR 50,000 Cr in 2020. However, all DLAI members have tie-ups with banks or NBFCs for lending. They also conduct stringent background checks and follow standard guidelines for loan underwriting. In contrast, ‘predatory’ lending apps simply choose to ignore these checks. Earlier, DLAI had specified that lending apps that do not carry out income verification are usually a red flag as this check helps judge the repayment capacity of borrowers.

Besides, these rogue apps usually have a loan tenure under 30 days, and some even want their money back within 15 days. Worse still, most of them charge exorbitant interest rates – anywhere between 40% and 100% – with additional surcharges on the principal amount.

“These (predatory) lending apps, with tenures less than 30 days, usually lend small amounts, somewhere between INR 2K and 10K, with interest rates touching 60% and above. Such high-interest lenders usually target borrowers who are part-time workers, self-employed or students – basically anyone who earns less than INR 15,000 a month,” says Mehrotra of EarlySalary.

While the regulator and stakeholders in the online lending space gear up to debate on how to regulate the sector and weed out predatory practices, they should turn to the West where ‘payday’ loans have become a menace. Payday loans are notorious as their lending model is centred on high-interest rates, with payment cycles less than 30 days.

In the US, payday lending erodes $1 Bn in consumer spending wealth, according to a report from the Insight Center for Community Economic Development. There are no such studies to indicate the amount of wealth erosion that ‘predatory lenders’ have caused in India. But some experts who spoke to Inc42 suggested banning the ‘payday’ lending model as it can initiate a vicious cycle of borrowing more to keep paying.

Walking The Regulatory Tightrope

During Covid-19 lockdowns, payday loans did see heightened demand in India. However, most of the ‘predatory’ digital lenders did not comply with the moratorium period observed by other legitimate lenders and credit card issuers. Consequently, the RBI alerted borrowers after receiving several complaints about ‘predatory’ lending apps and directed online lenders to display their NBFC/bank partnerships upfront on websites and apps.

Nearly six months later, Google also intervened. Acting as a gatekeeper, it reportedly wrote to online lenders on the Play Store to share their NBFC/bank credentials and also delisted any app with a loan tenure below 60 days. But this decision was met with mixed reactions. Lending apps claim that these rules have been applied unevenly and several Chinese-origin apps fell foul of them. However, some stakeholders in the online lending space have appreciated Google’s self-regulation.

“The existence of these apps on Google Play Store shapes customers’ perception regarding their reliability to a great degree. Another significant step in this direction could be to ensure the legitimacy of the NBFC(s) backing these apps possess as the RBI regulates NBFC(s) and their associations,” says Madhusudan Ekambaram, cofounder and CEO of KreditBee, a personal loan app.

Tiwari of Cyril Amarchand Mangaldas also points out that app stores are purely technology platforms and do not have any financial activity. Hence, the central bank has no scope to regulate them yet. So, the best way forward for app stores is to self-regulate, at least for now.

Meanwhile, investigating authorities across Indian states have directed payment gateways such as Razorpay and Paytm to stop processing transactions routed through these apps. Many of them are Chinese-backed fintech entities like SnapIt Loan, Bubble Loan, Go Cash and Flip Cash. According to a report, about 95% of the money-lending apps use Razorpay as their payment gateway.

All said and done, both Google and the RBI seem to be missing out on the data privacy issue. In spite of talks that the Personal Data Protection Bill would be tabled in this year’s parliamentary proceedings, many rogue lending apps seem to have crossed the privacy threshold by collecting most of the sensitive data they could get their hands on.

According to an analysis conducted by Pew Research in 2015, most finance (or banking) apps request an average of six permissions. Some of the most common permissions requested include ‘full network access’ and the ‘view network connections’. While these permissions alone cannot provide access to user information, a combination of multiple permissions can enable these apps to gather tonnes of sensitive data.

In an attempt to understand the kind of permissions lending apps seek from users, Inc42 shortlisted the top 20 instant lending/quick cash apps (above 1 Mn downloads) listed on Google Play Store. Some of the phone permissions accessed are alarming. For example, instant lending app Credit (1 Mn downloads) can access a user’s web history and bookmarks, which most consumers would not notice until they manually browse the entire permission list. So, we sat down with security researcher and policy analyst Srikanth to map these permissions and the risks they pose for users.

According to Tiwari of Cyril Amarchand Mangaldas, rogue lending apps request extensive data permissions in the garb of trying to underwrite one’s loan application. Since predatory digital lenders do not have access to credit bureaus, they try to build alternative credit scores for potential borrowers. But this practice is also followed by legitimate lenders.

“Institutional lenders usually do not lend to individuals with no credit history or credit scores. So, online lenders use sensitive data for underwriting. In the case (of rogue lending apps), it is more about understanding whether a borrower has the intention to pay back or not rather than actually creating a credit score or measuring creditworthiness,” he adds.

A Balancing Act

An increasing number of fintech companies will be eyeing the online lending space for its evergreen popularity and the fact that monetisation opportunities across popular fintech solutions like payments remain limited. Hence, experts also suggest that beyond regulating licensed lenders like banks and NBFCs, regulatory bodies need to take a balanced approach towards all lending channels to enforce fair practices irrespective of where the credit is coming from.

As India’s fintech ecosystem comes of age, regulatory interventions will have to walk the thin line between encouraging innovation and protecting millions of new-to-internet and new-to-formal-finance consumers. Very often, these regulatory interventions will intersect sectors such as IT, telecom, banking and even national security. But the question is: Will the balance tip towards a regulatory chokehold or a transparent, secure and inclusive lending ecosystem?

Until Next Time,

Salman & Romita