NBFC-P2P registration is the RBI authorisation required for a company that operates an online peer-to-peer lending marketplace in India. The applicant must be a company with at least ₹2 crore Net Owned Fund and must satisfy RBI on promoters, directors, business plan, technology, risk controls and public-interest considerations. The platform may facilitate unsecured loans and related services, but lender money must move through permitted escrow arrangements and the platform cannot promise principal protection, fixed/assured returns or liquidity.
What Is NBFC-P2P Registration?
An NBFC-P2P is a non-banking financial company that provides an online marketplace or platform for participants involved in peer-to-peer lending. A participant may include a person acting as lender or borrower on the platform, subject to the applicable RBI framework and the platform’s eligibility rules.
The platform may undertake participant due diligence, borrower credit assessment and risk profiling, obtain consent to access credit information, document loan agreements, assist in disbursement and repayment, and provide recovery support. It must remain within the activities permitted by the RBI Directions.
| NBFC-P2P Can Do | NBFC-P2P Cannot Do |
|---|---|
| Provide an online marketplace for lenders and borrowers | Lend from its own balance sheet |
| Undertake due diligence and borrower risk assessment | Accept public deposits |
| Facilitate loan agreements, disbursement and repayments | Guarantee principal, interest, returns or recovery |
| Assist with recovery in a fair and lawful manner | Facilitate secured lending linked to the platform |
| Use permitted escrow arrangements for participant funds | Hold participant lending/repayment funds on its own balance sheet |
| Cross-sell loan-specific insurance within RBI limits | Offer credit-enhancement or credit-guarantee insurance |
| Share credit information subject to consent and applicable law | Permit international flow of P2P lending funds |
How NBFC-P2P Registration and Lending Work in India
Peer-to-peer lending uses a digital platform to bring lenders and borrowers together. In India, the platform itself is a regulated non-banking financial company category known as an NBFC–Peer to Peer Lending Platform (NBFC-P2P). The legal framework is designed around one core idea, the platform is an intermediary, not the lender. It can assess borrowers, facilitate documentation and repayments, and assist with recovery, but the credit relationship remains between the lender and borrower.
For founders, this distinction affects the entire business model. Revenue cannot be built around using customer funds as treasury money, parking lender money for platform use, offering credit guarantees, or marketing P2P lending like a fixed-return deposit. RBI’s August 2024 review specifically reinforced these boundaries and clarified that P2P platforms must not promote assured minimum returns, liquidity features or replacement of one lender’s funds with another lender’s funds.
For a new applicant, the registration exercise is therefore more than incorporation plus an RBI form. RBI can assess the company’s financial strength, management quality, ownership, technological capability, risk management, participant-protection framework and whether the proposed model is in the public interest. A well-prepared application should make the operational flow, fund flow, platform logic and compliance controls easy to understand.
Who Needs NBFC-P2P Registration?
A company generally needs to evaluate NBFC-P2P registration where it proposes to operate a digital marketplace in which lenders other than banks, NBFCs or other regulated institutional lenders directly provide loans to borrowers through the platform. RBI’s FAQ clarifies that a platform acting only as a DSA or Business Correspondent for banks/NBFCs is not automatically a P2P platform; however, if retail lenders also use the platform to lend, separate NBFC-P2P registration may be required.
The classification depends on what the platform actually does, not merely what the website calls the business. A fintech marketplace label does not remove regulatory obligations if the underlying activity is peer-to-peer lending.
Eligibility Requirements for NBFC-P2P Registration
| Requirement | 2026–2027 Position / Practical Meaning |
|---|---|
| Legal form | The applicant must be a company. A partnership, LLP or proprietorship cannot directly carry on NBFC-P2P business. |
| RBI Certificate of Registration | The company must obtain a Certificate of Registration from RBI before commencing P2P platform business. |
| Minimum Net Owned Fund | At least ₹2 crore, or any higher amount RBI may prescribe. RBI’s 2025 handbook continues to show ₹2 crore for NBFC-P2P. |
| Promoters and directors | Management should be fit and proper, with appropriate integrity, capability and financial-sector understanding. |
| Business plan | The model should clearly show platform-only intermediation, revenue logic, credit assessment, participant safeguards, grievance handling and compliance. |
| Technology and data | The applicant should demonstrate a robust, secure and scalable technology environment; P2P activity and participant data must be stored and processed on hardware located in India. |
| Public interest | RBI should be satisfied that granting registration is in public interest and that the company has an adequate capital structure and earning prospects. |
| Operational readiness | Policies, agreements, fair practices, escrow mechanics, CIC reporting processes and risk controls should be designed before go-live. |
Minimum NOF for NBFC-P2P Registration: ₹2 Crore
The minimum Net Owned Fund requirement for an NBFC-P2P is ₹2 crore. This is different from the higher NOF requirement applicable to several general lending NBFC categories. The applicant should not assume that a ₹10 crore general NBFC threshold applies to NBFC-P2P.
RBI’s NBFC-P2P FAQ explains that the applicant should disclose promoters and the source of funds for the minimum capital. The capital must be infused before the Certificate of Registration is issued. The source and ownership of capital should therefore be clean, documented and consistent with the shareholding and beneficial ownership presented in the application.
NOF is a regulatory computation, not simply the amount appearing under share capital in the balance sheet. A Chartered Accountant should verify the computation and the supporting financial statements before the application is finalised.
Key P2P Prudential Limits
| Limit | RBI Framework |
|---|---|
| Lender aggregate exposure | Up to ₹50 lakh across all P2P platforms at any point, subject to consistency with the lender’s net worth. |
| Higher-exposure lender certificate | Where a lender lends more than ₹10 lakh across P2P platforms, a practising CA certificate showing minimum net worth of ₹50 lakh is required. |
| Borrower aggregate borrowing | Up to ₹10 lakh across all P2P platforms at any point. |
| Single lender to same borrower | Not more than ₹50,000 across all P2P platforms. |
| Maximum loan maturity | Not more than 36 months. |
| Leverage ratio of platform | Not exceeding 2, as prescribed by the NBFC-P2P Directions. |
| Loan security | P2P loans linked to the platform must be clean / unsecured loans. |
| International fund flow | Not permitted for P2P transactions under the Directions. |
Important 2024 RBI Changes That Still Matter in 2026–2027
RBI’s 16 August 2024 review was issued after observing practices that departed from the intended intermediary model. For a new applicant, these points should be built into the product design before submitting the registration proposal.
First, an NBFC-P2P must not assume credit risk directly or indirectly. Marketing that creates an impression of assured principal, assured interest, fixed minimum return or guaranteed recovery is inconsistent with the framework. Second, the platform must not use one lender’s funds to replace another lender’s funds. Third, lender money should not be treated as a pool available for deployment outside the specified P2P transaction. Fourth, the transfer of funds should follow the permitted escrow mechanism and prescribed timelines rather than remaining indefinitely in a platform-controlled structure.
The platform must also obtain an explicit lender declaration acknowledging the risk of loss, including the possibility of loss of the entire principal on borrower default. This risk disclosure should be prominent in onboarding and not hidden in generic website terms.
Escrow Account and Fund-Flow Architecture
Participant money cannot sit on the NBFC-P2P’s balance sheet. The Directions contemplate escrow arrangements operated by a trustee, with cash flows structured separately for funds received from lenders and repayments received from borrowers. The precise banking and trustee documentation should be aligned with the current RBI Direction and the platform’s operating model before launch.
This is a critical area in RBI review because a technically attractive platform can still fail the regulatory test if the money movement suggests deposit taking, balance-sheet lending, liquidity transformation or platform assumption of credit risk. The application should include a clear fund-flow diagram showing lender account, escrow, borrower account, repayment escrow and lender receipt.
Documents Required for NBFC-P2P Registration
| Category | Indicative Documents |
|---|---|
| Company documents | Certificate of Incorporation, MOA, AOA, CIN, PAN, registered office proof and board resolutions. |
| Capital and financials | Audited financial statements, bank statements, NOF computation, CA certificate, source-of-funds evidence and capital infusion records. |
| Promoter / director KYC | PAN, identity and address proof, DIN details, educational/professional profile, declarations and fit-and-proper information. |
| Ownership structure | Shareholding pattern, beneficial ownership chart, group company details and related-party information. |
| Business plan | Three-to-five-year projections, revenue model, target segment, customer acquisition plan, lender/borrower strategy and break-even assumptions. |
| Technology pack | System architecture, information security controls, data localisation plan, cyber resilience, access controls, BCP/DR and vendor map. |
| Policy framework | Fair Practices Code, KYC/AML framework, grievance policy, participant due diligence, credit assessment, recovery policy, privacy/data protection, outsourcing and incident response. |
| Platform documentation | Lender agreement, borrower agreement, loan agreement flow, consent wording, risk declaration, terms of use and disclosure templates. |
| Escrow architecture | Proposed bank/trustee arrangement, fund-flow note and settlement process. |
| Regulatory declarations | Information and undertakings required by RBI in the prescribed application and during query handling. |
Step-by-Step NBFC-P2P Registration Process
| Stage | What Happens |
|---|---|
| 1. Regulatory model review | Confirm that the proposed activity is genuinely P2P and not an NBFC-ICC lending model, DSA/BC model, account aggregator model or payment activity. |
| 2. Incorporate / align the company | Use a company with objects and governance that support the proposed regulated activity. Clean up unrelated objects or legacy issues that could confuse the regulatory model. |
| 3. Structure promoters and capital | Document shareholding, beneficial ownership, source of funds and the plan to maintain at least ₹2 crore NOF. |
| 4. Prepare business and financial plan | Build realistic projections and explain how the platform earns revenue without assuming lender credit risk or promising liquidity. |
| 5. Create compliance architecture | Prepare board-approved or board-ready policies, lender/borrower disclosures, fair practices, KYC/AML controls, grievance handling and recovery standards. |
| 6. Design technology and fund flow | Map onboarding, credit assessment, consent, data storage in India, escrow movement, disbursement, repayment and exception handling. |
| 7. Submit RBI application | File the prescribed registration application with the required information and supporting documents through the applicable RBI process. |
| 8. Respond to RBI queries | RBI may seek clarifications on ownership, capital, technology, management, business logic, projections, governance or participant protection. |
| 9. Meet pre-CoR conditions | Complete capital infusion or other conditions communicated by RBI before issuance of the Certificate of Registration. |
| 10. Go live only after registration | Launch P2P business after CoR and operational readiness, with escrow, CIC, disclosures, agreements and compliance monitoring implemented. |
Technology, Cybersecurity and Data Controls
An NBFC-P2P is a technology-led regulated entity. The application should therefore demonstrate more than a consumer-facing app. RBI will expect the business to be capable of protecting participant data, maintaining audit trails, handling access securely and operating resiliently.
The NBFC-P2P Directions require data relating to activities and participants to be stored and processed on hardware located in India. In addition, the company should assess the RBI information-technology and outsourcing framework applicable to it, the Digital Personal Data Protection Act, 2023 and the DPDP Rules framework as brought into force, as well as cyber incident and contractual responsibilities relevant to its vendors.
Practical controls normally include maker-checker permissions, encryption, secure API management, logging, vulnerability testing, incident response, data-retention rules, backup, disaster recovery, business continuity, vendor due diligence and documented user-consent flows.
KYC, AML and Participant Due Diligence
P2P platforms must undertake due diligence on participants and comply with applicable KYC and anti-money-laundering requirements. The onboarding flow should identify the participant, validate required documents, screen relevant risk indicators and preserve evidence of consent and verification.
Borrower credit assessment and risk profiling should be meaningful, consistently applied and disclosed appropriately to prospective lenders. The platform should not present a risk score as a guarantee. A lender must remain responsible for the lending decision and must be informed that default can result in loss of principal and interest.
Credit Information Company Reporting
NBFC-P2P platforms are required to become members of credit information companies and report relevant credit information. RBI’s updated framework requires fortnightly submission to CICs within seven calendar days of the relevant reporting fortnight, with the enhanced timeline effective no later than 1 January 2025.
The platform should also have a process for correction and updating of credit information and customer complaints. Incorrect or delayed reporting can create both regulatory and consumer harm, so the operations team should treat CIC reporting as a controlled compliance process rather than a backend administrative task.
Fair Practices, Disclosures and Recovery
The Board should approve a Fair Practices Code and the platform should publish it on its website. Lenders must receive transparent information about borrower details, credit assessment, loan terms, fees and the risk of default. Borrowers should receive clear information about lenders and the applicable pricing and conditions in accordance with the Directions and agreements.
Recovery support is permitted, but harassment is not. Staff and service providers should be trained, communications should remain within lawful and reasonable boundaries, and collection practices should be documented and auditable. A grievance-redressal mechanism should be accessible to participants and escalation routes should be clear.
Ongoing Compliance After RBI Registration
| Compliance Area | Ongoing Expectation |
|---|---|
| NOF and leverage | Maintain the prescribed capital position and leverage ratio. |
| Exposure controls | Monitor lender, borrower, single-counterparty and tenure limits across the platform based on declarations and available data. |
| Escrow governance | Keep participant fund flows within the permitted escrow structure and prescribed settlement logic. |
| CIC reporting | Submit accurate credit information within the prescribed cycle and address corrections. |
| KYC / AML | Maintain customer due diligence, records, monitoring and applicable reporting. |
| Fair Practices Code | Keep disclosures, website language and participant communications aligned with the RBI framework. |
| Board governance | Place compliance, risk, audit, grievance and technology matters before the Board as applicable. |
| RBI returns | File returns and regulatory information applicable to NBFC-P2P through the prescribed RBI reporting systems. |
| Company law | Complete ROC, financial statement, annual return, auditor and board compliances under the Companies Act. |
| Tax and GST | Maintain tax registrations and filings according to the platform’s fee model and operations. |
| Technology | Maintain cyber security, data localisation, BCP/DR, vendor oversight and incident processes. |
| Regulatory change management | Track RBI circulars and amend product, agreements and operations when the framework changes. |
Estimated Timeline and Professional Fee Considerations
RBI does not guarantee a fixed approval timeline for a new NBFC-P2P application. The overall period depends on the readiness of the company, capital, promoter background, quality of documentation, RBI queries, technology preparedness and whether the application requires restructuring or clarification. A realistic project plan should therefore separate preparation time from regulatory processing time.
Professional fees also vary with the starting position. A newly incorporated clean company with documented capital and a clear platform architecture requires less remediation than an existing company with legacy transactions, complex shareholding or an incomplete technology/compliance setup. Government or third-party costs may also arise for incorporation changes, certifications, legal documents, audit, escrow/trustee arrangements, technology reviews and other workstreams.
Vakilkaro should quote the scope transparently after an initial regulatory-fit review rather than market an instant RBI licence or guaranteed approval. RBI approval remains a regulatory decision.
Common Mistakes to Avoid
- Building the platform around assured or fixed returns that make P2P lending look like a deposit or investment product.
- Using lender funds for temporary liquidity management, replacement of another lender, or any purpose outside the specified borrower transaction.
- Applying a general NBFC capital rule without recognising that NBFC-P2P has a separate ₹2 crore NOF requirement.
- Launching lending activity before the RBI Certificate of Registration is obtained.
- Treating escrow as a payment-gateway feature instead of a regulated fund-flow control.
- Using a weak borrower risk score without documented methodology, governance or disclosure.
- Ignoring cross-platform exposure limits because the platform only sees its own internal book.
- Keeping participant data or core processing outside India without assessing the RBI localisation requirement.
- Using aggressive recovery practices or outsourced agents without training, scripts, escalation controls and oversight.
- Copying another platform’s terms and policies instead of aligning documents with the actual technology and transaction flow.
Why Choose Vakilkaro for NBFC-P2P Registration?
NBFC-P2P registration is a regulatory design project, not only a form-filing exercise. A strong application connects the company documents, capital, promoter profile, technology, fund flow, policies, agreements and projections into one consistent operating model.
Vakilkaro can coordinate qualified CAs, Company Secretaries, advocates and compliance professionals for the workstreams relevant to the application. The focus is on transparent scope, practical documentation, regulator-ready presentation and post-registration compliance planning rather than approval guarantees. For founders, the key advantage is a single coordinated process—from initial classification and company readiness to application support and the compliance architecture needed before launch.
