FlexiLoans Under the Scanner: 5,658 CIBIL Complaints, Criminal-Case Challenges, Recovery-Related Allegations and Uncomfortable Questions About Its Lending Practices

A loan application can be processed digitally. A marketing message can arrive within seconds. A borrower can be persuaded by the promise of quick credit, minimal paperwork and frictionless disbursal. But when disputes arise, when credit information becomes the subject of complaints, when repayment disagreements enter criminal courts, or when questions are raised about the handling of personal data, the promise of frictionless finance suddenly becomes a much more complicated proposition.

That is precisely the scrutiny facing FlexiLoans, the lending platform operated by Epimoney Private Limited.

The public record examined for this investigation contains a substantial trail of material that deserves attention: thousands of complaints recorded in TransUnion CIBIL’s regulatory disclosures; hundreds of customer complaints disclosed in the company’s own annual report; multiple criminal proceedings initiated by Epimoney that borrowers subsequently challenged before constitutional courts; a police-protection petition in which a FlexiLoans recovery representative was named among several respondents; historical FIU-IND compliance concerns; disclosed financial-covenant issues; credit-rating reports recording deterioration in asset quality; an IFC-identified environmental and social management gap; and questions arising from the company’s own privacy disclosures and the Google Play data-safety declaration for its app.

None of these matters, considered individually or collectively, automatically proves fraud. Nor do interim court orders amount to final findings against the company. But the documented record raises a question that a lender of this scale should not be allowed to brush aside:

Is FlexiLoans’s commitment to borrower convenience matched by an equally serious commitment to borrower protection, transparent recovery practices, responsible data handling and accountability?

A financial technology company cannot demand trust as a marketing proposition and treat accountability as an inconvenient afterthought.

The issue is not whether a borrower must repay a genuine loan. A borrower must honour lawful contractual obligations. The issue is whether lenders, their employees, their collection agents and their business partners are held to equally rigorous standards when loans are marketed, information is collected, credit records are updated, repayment is pursued and disputes are escalated.

The record warrants a much closer examination.

1. The CIBIL complaint trail: 5,658 complaints in FY 2025–26

One of the most striking parts of the record comes not from an anonymous social-media post or an unverified consumer forum. It comes from the regulatory disclosures published by TransUnion CIBIL.

CIBIL’s disclosures identify Epimoney Private Limited and provide annual figures for the number of credit-information records submitted by the company, complaints registered against it and complaints that remained unresolved beyond the prescribed turnaround time.

The figures are as follows:

The reported complaint ratios were approximately 0.07% in FY 2023–24, 0.443% in FY 2024–25 and 0.431% in FY 2025–26.

The increase is difficult to ignore.

Epimoney’s recorded CIBIL complaints rose from 201 in FY 2023–24 to 4,320 in FY 2024–25. In FY 2025–26, the figure increased further to 5,658.

That is more than a 28-fold increase in the annual complaint count between FY 2023–24 and FY 2025–26.

The number of records submitted also increased significantly, meaning the raw complaint counts must be read alongside the changing volume of reported records. Even after accounting for that increase, however, the reported complaint ratio moved from approximately 0.07% to around 0.43%.

A lender cannot dismiss the question merely by pointing to a larger loan book or a larger number of credit-information submissions. The obvious question is what caused the complaint ratio to rise so sharply and what corrective steps were taken.

Were borrowers disputing incorrect repayment histories? Were there questions about loan-account closures? Were EMI payments not being reflected in credit information? Were accounts reported incorrectly? Were personal details disputed? Were borrowers challenging enquiries or other credit-information entries?

The publicly reported totals do not answer those questions. They do, however, make it reasonable to demand a category-wise explanation.

There is an important qualification. These figures are complaints registered against the credit-information provider in relation to the reporting entity. They do not establish that every complaint was upheld, that every complaint represented a separate borrower, or that Epimoney deliberately damaged anyone’s credit score. CIBIL also explains that a single personal-information complaint can be referred to multiple institutions.

The latest figure also contains a fact that must not be concealed: CIBIL recorded zero complaints unresolved beyond the prescribed turnaround time for Epimoney at the FY 2025–26 reference date.

That is relevant and should be acknowledged. It is a positive closure indicator.

But it does not erase the central question. How did an entity move from 201 recorded complaints to 4,320 and then 5,658? A zero-pending figure at a reporting date is not an answer to the underlying causes of the complaints.

The distinction is simple: resolving complaints within a stipulated period is one part of responsible lending. Preventing avoidable complaints in the first place is another.

A lender should be judged on both.

2. The company’s own annual report records hundreds of customer complaints

The CIBIL data is not the only complaint-related disclosure.

Epimoney’s FY 2023–24 annual report also records customer complaints received and redressed by the company.

According to the company’s own disclosures:

The report also records 17 maintainable complaints before the Ombudsman in FY 2022–23 and 19 in FY 2023–24. The company reported that all these complaints were resolved in its favour and that no awards were passed against it in the relevant disclosures.

These are company-reported figures, not an independent audit of the merits of every customer grievance.

The annual report’s complaint categories include matters relating to account operations, staff behaviour, escrow payments and refunds, EMI-related issues and credit-information reporting.

That categorisation matters.

For a lender whose business depends on customer confidence, the quality of complaint handling should be central to its governance framework. A borrower disputing an EMI entry, an escrow payment or the treatment of a loan account is not merely raising an administrative inconvenience. Such matters can affect the borrower’s financial records, business operations and ability to obtain credit elsewhere.

The company deserves credit for reporting that its year-end complaint backlog stood at zero in FY 2023–24. It should also be required to disclose whether its complaint-resolution process independently verifies the borrower’s underlying grievance, whether disputed credit information is corrected promptly, and whether repeat complaints are analysed for systemic causes.

A complaint register is not a trophy cabinet. A low pending count is important, but it does not prove that the original customer experience was satisfactory.

The public deserves to know what was complained about, what the company investigated, what it corrected and what it changed to prevent recurrence.

3. Criminal proceedings over loan disputes: why the High Court and Supreme Court record deserves attention

The most legally sensitive part of the FlexiLoans record concerns criminal complaints filed by Epimoney against borrowers or persons connected with borrowing businesses, followed by petitions challenging those proceedings.

The concern raised by petitioners in several matters is that repayment disputes and alleged business defaults have been converted into criminal prosecutions involving allegations such as cheating and criminal breach of trust.

It is essential to be precise: the courts have not, in the orders discussed below, delivered a final judgment holding that Epimoney fabricated complaints or unlawfully criminalised ordinary loan defaults. In several matters, however, the courts found sufficient grounds for interim consideration and granted temporary relief.

That distinction does not make the proceedings irrelevant. It makes a careful examination of them necessary.

A. Lemon Futermal Jain v. Epimoney Private Limited — Supreme Court, 21 September 2022

In Lemon Futermal Jain v. Epimoney Private Limited, Transfer Petition (Criminal) No. 595 of 2022, the Supreme Court dealt with proceedings connected with Epimoney’s criminal complaint against Tarun Polymers.

The underlying complaint, CS/35490/2022, was pending before the 19th Metropolitan Magistrate at Calcutta.

On 21 September 2022, the Supreme Court issued notice and stayed further proceedings in that complaint.

The order did not determine that Epimoney had committed wrongdoing. Nor did it finally quash the complaint.

Nevertheless, the matter is part of the judicial record involving a borrower-side challenge to criminal proceedings brought by the lender.

B. Shalibhadra Traders v. Epimoney — seven complaints, two cities and a jurisdictional dispute

On 25 July 2025, the Supreme Court considered transfer petitions filed by Shalibhadra Traders in proceedings connected with Transfer Petition (Criminal) Nos. 452–453 of 2025 and 323–327 of 2025.

The petitioners challenged the territorial jurisdiction of courts handling seven criminal complaints instituted by Epimoney: two in Jaipur and five in Calcutta.

The petitioners sought transfer of the proceedings to Mumbai and raised objections concerning where the cases were being prosecuted.

The Supreme Court directed the petitioners to raise their jurisdictional objections before the respective trial courts.

The Court did not declare that the Jaipur or Calcutta courts lacked jurisdiction. It did not transfer the cases or quash the complaints. The order also recorded Epimoney’s non-appearance despite service.

The significance of the case lies in the existence of seven criminal complaints and the jurisdictional challenge raised by the accused parties.

A lender with nationwide digital operations cannot avoid questions about the legal basis and territorial propriety of its recovery litigation. Every criminal complaint must stand on its own facts, evidence and jurisdictional foundation.

The trial courts should decide those objections promptly rather than allowing jurisdictional disputes to become an endless prelude to a substantive hearing.

C. Reena Ravindra Khona and another v. Epimoney — three criminal complaints stayed temporarily

In December 2025, the Calcutta High Court dealt with three connected criminal revision petitions:

• CRR 5362 of 2025, arising from CS 81965 of 2022;
• CRR 5363 of 2025, arising from CS 40001 of 2023; and
• CRR 5364 of 2025, arising from CS 64136 of 2023.

The petitioners challenged the criminal proceedings initiated by Epimoney. Their case was that repayment-related difficulties had been presented as offences involving cheating and criminal breach of trust, and that criminal courts were being used as a mechanism for loan recovery.

On 17 December 2025, the High Court admitted the petitions and granted interim protection by staying the underlying complaints for 12 weeks or until further orders, whichever occurred earlier.

A subsequent correction order dated 5 January 2026 corrected the loan amount mentioned in the CRR 5364 matter from ₹35 lakh to ₹25 lakh.

The interim orders do not amount to a final determination that the complaints were false or malicious. They do, however, establish that the petitioners’ challenges were considered substantial enough to warrant admission and temporary judicial protection.

The underlying questions must now be determined through proper judicial scrutiny: What was the nature of the borrowing arrangement? Who received the funds? Who was contractually liable? What was the evidence of any alleged deception? Was there an identifiable dishonest intention at the inception of the transaction? And did the available material support a criminal prosecution against each individual named?

Those are not questions that should remain unresolved indefinitely.

D. Ankur Gupta v. Epimoney — criminal liability challenged over a deceased father’s borrowing business

In Ankur Gupta v. Epimoney, CRR 4064 of 2025, the Calcutta High Court passed an interim order on 7 January 2026.

The petitioner alleged that the borrowing business belonged to his deceased father and that he had no relevant connection with the business or entrustment of funds. He challenged the proceedings in complaint case CS 184106 of 2024, including the cognizance taken and an arrest warrant issued against him.

The petitioner’s position was that he should not face criminal proceedings merely because of his relationship with the borrower or the deceased proprietor.

The High Court found an arguable case and stayed further proceedings for 12 weeks or until further orders, whichever occurred earlier.

This was interim relief, not a final finding that the petitioner was innocent or that Epimoney had acted unlawfully.

Nevertheless, the matter raises an important question about the identification of the actual borrower, the person who received the loan, the individuals legally responsible for repayment and the evidence relied upon before criminal proceedings are initiated.

A family relationship is not a substitute for proof of criminal liability. Each accused person’s role must be established through evidence, not assumption.

E. Divya Srikar Venalakanti and another v. Epimoney — ₹11.56 lakh dispute

On 9 February 2026, the Calcutta High Court considered CRR 546 of 2026, concerning complaint case CS 166885 of 2025.

The dispute involved an alleged unpaid amount of ₹11,56,884.16.

The petitioners argued that substantial repayments had already been made and that the repayment history contradicted the allegation of dishonest intention at the inception of the loan transaction.

The High Court admitted the petition and granted an interim stay for 12 weeks or until further orders, whichever occurred earlier.

A subsequent order dated 17 April 2026 recorded that the matter had been part-heard.

Again, the Court did not finally quash the complaint or pronounce a finding that Epimoney had fabricated the allegations.

But the questions are obvious. How were payments adjusted? What was the balance calculation? Were payments correctly credited? What material established the alleged dishonest intention? Were the individuals named in the complaint directly responsible for the borrowing and the alleged conduct?

The public record does not permit an allegation of fraud against the lender to be stated as a proven fact. It does justify demanding that these questions be decided through a reasoned judicial process.

Why these cases deserve a serious institutional review

A lender has every legal right to recover genuine dues through lawful means. It may pursue civil remedies, arbitration where contractually and legally applicable, insolvency remedies where available, and criminal proceedings where the evidence genuinely establishes a criminal offence.

But criminal law cannot be treated as a convenient substitute for civil recovery.

The difference between a loan default and a criminal offence is not academic. A criminal complaint can expose individuals to summons, warrants, reputational damage, legal expenses and the anxiety of prosecution. The process itself can become a serious burden even before a court decides the merits.

That is why the allegations raised in these proceedings require careful and timely adjudication.

It is equally important that borrowers do not use criminal-law challenges merely to evade legitimate contractual obligations. Courts must examine both sides, examine the evidence and decide the cases without unnecessary delay.

The principle should be uncompromising: no borrower should face criminal prosecution without legally sufficient evidence, and no lender should be deprived of legitimate recovery merely because a borrower disputes the proceedings.

4. Recovery-agent conduct: a police-protection petition in the Madras High Court

A separate proceeding in the Madras High Court adds another issue to the list of questions concerning lender conduct and recovery-agent supervision.

In V. Chandran and C. Uma v. Superintendent of Police, CRL OP(MD) No. 9323 of 2026, decided on 7 May 2026, the petitioners sought police protection for their life and limb.

Several lenders and recovery representatives appeared in the matter, including Epimoney/FlexiLoans and a named recovery representative associated with its Madurai operations.

The High Court directed the police authorities to consider the petitioners’ representations and pass appropriate orders within four weeks.

Crucially, the Court expressly did so without deciding the merits of the allegations.

It would therefore be wrong to report that the High Court found FlexiLoans or its representative guilty of threats, intimidation or unlawful recovery practices. The published order does not make such a finding.

But the case cannot simply be ignored.

When a lender operates through a network of recovery representatives, it must have an effective system to monitor how those representatives behave. The company should be able to identify who contacted the borrower, what instructions were given, which telephone numbers were used, what communications were recorded and whether any complaint was made against the representative.

A lender cannot outsource recovery activity and then outsource accountability along with it.

The company should disclose its recovery-agent code of conduct, complaint escalation records, training standards and monitoring arrangements. It should also explain how allegations of intimidation or inappropriate contact are investigated, independently of the person or team against whom the complaint is made.

A recovery agent acts within a commercial ecosystem created by a lender. The quality of supervision is therefore a legitimate governance question.

5. The historical FIU-IND listing: a compliance issue, not proof of money laundering

An official historical Financial Intelligence Unit–India listing included Epimoney Private Limited among high-risk NBFCs.

The entry appeared at serial number 2317.

The relevant historical categorisation concerned the non-registration of a Principal Officer under the Prevention of Money Laundering Act and the associated rules.

This requires careful explanation.

A failure to register a Principal Officer is a compliance issue. It is a legitimate matter for regulatory scrutiny because the Principal Officer has an important role in the institution’s anti-money-laundering reporting and compliance framework.

But the historical high-risk listing is not proof that Epimoney laundered money, nor is it a conviction for a money-laundering offence.

This investigation does not claim otherwise.

The September 2026 non-compliant NBFC list reviewed for the research did not identify a matching Epimoney entry. The historical listing should therefore not be misrepresented as proof that the company remains on a current blacklist.

Nevertheless, the past record is relevant to a broader question: how has the company’s regulatory compliance architecture evolved as its lending operations have expanded?

A growing NBFC must be able to demonstrate that its compliance systems have kept pace with its business.

It is not sufficient to advertise a technology-driven lending model. The institution must also show that its financial crime controls, reporting arrangements, risk management and regulatory compliance functions are properly staffed and consistently maintained.

6. Financial stress signals: CRISIL’s record of rising delinquencies

The financial record also deserves examination, particularly because FlexiLoans operates in the unsecured MSME lending space.

CRISIL’s rating rationale dated 23 October 2025 recorded a deterioration in the company’s asset-quality indicators.

The proportion of loans overdue by more than 90 days increased as follows:

CRISIL also reported that the corresponding indicator after adjustment for loans written off increased from 4.9% in March 2024 to 8.0% in March 2025 and 8.7% in June 2025.

Credit costs increased from 3.8% in FY 2023–24 to 4.5% in FY 2024–25.

These figures warrant attention because unsecured lending leaves the lender with less collateral protection when borrowers fail to pay.

The deterioration does not establish fraud, misconduct or insolvency. It does, however, reveal meaningful credit-risk pressures in a business whose future performance depends on underwriting quality, collections, borrower selection and the ability to manage defaults.

CRISIL reaffirmed its BBB/Stable rating. That is a fact that must be reported alongside the adverse indicators. The agency cited the company’s capitalisation and liquidity position as factors supporting the rating.

The February 2026 CRISIL assessment recorded 90-plus-day delinquencies at 4.8% in December 2025. It also reported that the adjusted indicator, including loans written off, had reached 8.8%.

The same assessment recorded a capital adequacy ratio of 56.2%, a loan book of approximately ₹2,467 crore in December 2025, and collection efficiency of 101% for the first nine months of FY 2025–26. The reported bounce rate had improved to 11.4% from 13.4% in FY 2024–25.

CRISIL’s assessment therefore presents a mixed financial picture: substantial growth and capital support on one side, and unsecured-lending, asset-quality and profitability risks on the other.

The agency also noted modest return on managed assets, which remained around 0.2% across the three fiscal years through FY 2024–25.

That is not a declaration of a financial collapse. It is a warning that growth in loan disbursements is not the same thing as sustainable profitability or superior credit quality.

A lending institution cannot measure its success by disbursement volumes alone. The real test is whether the loans it originates are responsibly underwritten, serviced correctly and recovered lawfully.

7. The more recent Acuité assessment: improvement, but not a reason to stop asking questions

Acuité’s assessment dated 12 August 2026 provides a more recent picture of the company’s financial position.

It reported the following:

• Disbursements of approximately ₹3,788.79 crore in FY 2025–26.
• Assets under management of approximately ₹2,926.12 crore in FY 2025–26.
• Standalone gross NPA of 4.92% in FY 2025–26, compared with 5.91% in FY 2024–25.
• Improvement in standalone gross NPA to 4.17% in Q1 FY 2026–27.
• Standalone profit after tax of approximately ₹17.89 crore in FY 2025–26.

Acuité assigned A-/Stable ratings to specified bank facilities and non-convertible debentures, and A2+ to the commercial-paper programme covered by its assessment.

It also identified areas requiring continued monitoring, including moderate asset quality, modest profitability and concentration in the company’s resource profile.

These positive developments should not be concealed merely because the article is critical. The company’s asset-quality indicators improved in the more recent period reported by Acuité, and the agency assigned the stated ratings.

But a rating is not a certificate of ethical conduct. It does not decide whether a particular borrower’s complaint is genuine, whether a recovery representative behaved properly, whether a criminal complaint was warranted or whether an app’s data-handling practices meet every applicable legal requirement.

Credit ratings address credit risk. Borrower protection and legal compliance require their own scrutiny.

8. The debt-to-equity covenant issue disclosed by the company

Epimoney’s FY 2023–24 annual report also discusses a financial-covenant issue involving a maximum debt-to-equity ratio of 3:1.

The company explained that the transition from I-GAAP to Ind-AS altered the calculation of leverage and net worth. Under the changed accounting treatment, the company exceeded the agreed covenant even though it stated that it had remained within the limits under the earlier accounting framework.

The company said it informed lenders in March 2024 and sought relaxation or higher limits. Its annual report stated that the matter did not result in adverse lender action.

This disclosure should not be described as an accounting fraud, deliberate default or concealment. The company’s explanation is part of the public record and must be included.

However, covenant compliance is an essential part of financial governance. Investors and lenders should understand the exact calculation, the accounting adjustments involved, the affected facilities and whether any subsequent relaxation was formally documented.

When a company is growing rapidly and relying on multiple sources of funding, financial covenants are not mere paperwork. They are safeguards intended to identify changes in leverage and financial risk before those changes become larger problems.

9. IFC identified an environmental and social management gap

The International Finance Corporation’s investment disclosure concerning FlexiLoans also recorded an institutional gap at the time of its assessment.

IFC’s project documentation stated that FlexiLoans did not then have an environmental and social management system or designated responsibilities for that function.

Its action plan called for the appointment of an officer responsible for environmental and social matters, implementation of an appropriate management system, staff training and improvements to relevant HR policies.

The disclosure separately stated that IFC had not identified governance risks.

This is not evidence that the company committed an environmental offence or mistreated employees. Nor does the original gap prove that the prescribed measures were never implemented.

The issue is whether the action plan was completed, whether the systems were made operational and whether the company can demonstrate continuing compliance.

An institution that seeks investment from sophisticated financial institutions should be able to explain how its internal risk-management and social-responsibility systems have developed.

It is reasonable for the company and IFC to disclose the current status of the action plan, including the appointment of the responsible officer, implementation of the management system and completion of staff training.

10. Older customer complaints: a pattern of questions about communication, charges and recovery contact

Several older public consumer posts describe experiences that, although unverified, raise recurring questions about communication and customer handling.

These accounts must be treated as individual allegations, not proven findings.

September 2018: concerns after submission of PAN and Aadhaar documents

A complaint published on ConsumerComplaints.in on 21 September 2018 by a user identified as Vishirpr alleged that documents, including PAN and Aadhaar details, had been submitted after the applicant was given an expectation of quick loan processing.

The complainant said that there was no satisfactory response despite reminders and expressed concern about the handling of the submitted identity documents.

The post does not establish that the documents were misused. No verified misuse has been demonstrated through that complaint.

But the underlying issue is important: borrowers must know why their identity documents are collected, how they are stored, who can access them, how long they are retained and what happens when an application is abandoned or rejected.

January 2021: disputed ₹2,000 bounce-related charge

A complaint posted on 14 January 2021 by a user identified as CRML alleged that all 12 EMIs had been paid but that an additional ₹2,000 was demanded in connection with a purported bounce.

The complainant referred to payment evidence and disputed the additional demand.

The website subsequently marked the complaint as resolved on 20 January 2021.

That online resolution marker is not a court judgment or a regulatory finding. It does not, by itself, establish the correctness or otherwise of the disputed charge.

Nevertheless, it illustrates why a lender should provide a clear account statement, explain every bounce-related charge and maintain a traceable mechanism to correct erroneous payment or charge entries.

October 2023: allegation of repeated calls after declining to proceed

On 26 October 2023, a user identified as Mehul Mehta published a complaint on Consumer Complaints Court alleging that he received 20–30 calls daily after declining to proceed with a loan because the rates and charges were unsuitable.

The post alleged that requests to stop the calls were not respected.

This is an unverified consumer allegation and is not a judicial finding. It should not be presented as proof that FlexiLoans systematically harassed applicants.

Nevertheless, the claim raises a legitimate question about marketing consent, lead-management systems, suppression lists and the treatment of individuals who have expressly declined a loan offer.

A prospective borrower is not a permanent marketing asset. Declining a financial product should not require repeated calls, repeated explanations or an exhausting exercise in getting one’s telephone number removed from a campaign.

11. The 2026 pre-approved loan communication controversy: an issue that requires authentication

An Inventiva report published in August 2026 raised questions about inconsistent loan-related messages allegedly received by an applicant.

The report reproduced communications relating to a proposed business loan of approximately ₹22,90,737. One communication was represented as describing the loan as pre-approved and ready for disbursal at a stated interest rate. Another communication was represented as saying that the application was under review and that further information was required.

If the messages originated from the lender or from an authorised marketing or lending partner, the inconsistency deserves an explanation.

A prospective borrower should not be led to believe that a loan is approved and ready for disbursal when the application is, in fact, still subject to underwriting, verification or further documentation.

There is a material difference between:

• an advertisement inviting a person to apply;
• a preliminary eligibility indication;
• an in-principle or conditional approval;
• a final sanction; and
• an actual disbursal-ready loan.

These stages must not be blurred through promotional language.

At the same time, the reproduced communications have not, on the publicly available material examined here, been independently authenticated through the originating telephone number, message-routing records, registered templates, internal campaign logs or a verified company acknowledgement.

The report is therefore an investigative lead, not conclusive proof that Epimoney itself originated the messages or that a fraudulent sanction was issued.

The company should answer specific questions:

Who generated the messages? Was the sender Epimoney, an authorised lender service provider, a marketing agency or an unrelated third party? Was the displayed interest rate accurate? Was the loan actually sanctioned? Was the applicant’s credit report accessed? Was consent obtained for marketing and any credit enquiry? Were the communication templates appropriately registered and used?

The company should produce the relevant records to the competent regulator if the communication is found to have originated from its systems or authorised partners.

There is no virtue in advertising “pre-approved” loans if the actual approval status remains unclear. Financial marketing should be precise, not theatrical.

12. Data privacy and the Google Play disclosure: an inconsistency that needs a technical answer

Perhaps one of the most important areas for further examination concerns personal-data handling.

FlexiLoans’ published privacy policy describes the collection and processing of information that can include:

• Personal identification details, including PAN and Aadhaar information;
• Bank account and financial information;
• Bank-related SMS information;
• Contact information, where permission is granted;
• Information concerning references;
• Certain social-media information where accounts are linked;
• Gmail information through a read-only permission where the user allows it, including bank-statement-related information described in the policy.

The policy also describes security measures including SSL encryption and other safeguards.

But the Google Play data-safety declaration for the FlexiLoans app, identifying Epimoney Private Limited as its developer and updated on 28 September 2026, stated: “Data isn’t encrypted.”

That creates an apparent disclosure inconsistency requiring a clear technical explanation.

It is important to understand what this does and does not establish.

Google Play data-safety declarations are developer-provided disclosures. They are not, by themselves, an independent penetration test, a source-code audit or proof that an actual data breach has occurred.

Similarly, a privacy policy’s reference to SSL does not answer every question about how data is protected. Encryption in transit, encryption at rest, access controls, third-party access, retention practices and deletion mechanisms are separate issues.

It is therefore not appropriate to declare that customer information has been exposed or that the company has suffered a data breach on the basis of these disclosures alone.

But it is entirely reasonable to ask the company to reconcile them.

A lender that collects identity documents, bank-related information, financial SMS data and potentially contact information must be able to explain, in plain language:

1. What information is collected from an applicant at each stage?
2. Which permissions are genuinely necessary for underwriting and which are optional?
3. Is data encrypted in transit and at rest?
4. Which employees, service providers and lending partners can access the information?
5. What is the retention period for unsuccessful applications?
6. How can a customer withdraw consent and request deletion where legally permissible?
7. How are third-party service providers audited?
8. Has an independent security assessment been conducted for the current app version?

These are not unreasonable demands. They are basic questions for a financial institution that handles sensitive financial and identity information.

13. RBI’s digital-lending framework: compliance cannot be reduced to a privacy-policy link

The RBI’s digital-lending framework establishes important obligations for regulated entities and their lending service providers.

Among the issues it addresses are disclosure of the annual percentage rate and other loan terms, need-based collection of borrower data, prior explicit consent, privacy safeguards, appropriate restrictions on unnecessary data storage, disclosure of recovery-agent details and accountability of the regulated entity for activities carried out through its lending service providers.

These requirements provide an appropriate benchmark against which FlexiLoans’ actual business practices should be examined.

The existence of a published privacy policy or a grievance-redressal page is not, by itself, proof that every operational practice complies with the framework.

Nor does the existence of a complaint establish a regulatory violation.

The meaningful test is documentary and operational: what consent did the borrower give, what data was collected, how was the loan communicated, what was the APR, who was the actual regulated lender, who contacted the borrower during recovery and what records exist to establish compliance?

A regulator should not be satisfied by generic assurances when the question concerns the actual conduct of a particular transaction.

14. The grievance mechanism exists — but the quality of its operation needs scrutiny

FlexiLoans publishes a grievance-redressal mechanism identifying Epimoney as the operating entity and setting out escalation channels and response timelines.

The company’s published mechanism refers to an initial response within seven days and an escalation-stage response within 14 days. It also explains how a complainant may approach the RBI Ombudsman where the grievance remains unresolved in accordance with the applicable framework.

The existence of this mechanism is relevant and should be acknowledged.

But a grievance policy must be judged by its actual operation.

Are complaints assigned unique reference numbers? Are borrowers given written reasons when their disputes are rejected? Are disputed credit entries examined before being maintained? Are payments reconciled against bank records? Are complaints about recovery representatives investigated independently? Are repeat complaints examined for systemic causes?

Most importantly, can a borrower challenge an incorrect decision without being sent from one department to another?

A grievance mechanism should not become a procedural maze in which a complaint is technically acknowledged but practically unresolved.

15. What the public record does not establish

A serious investigative report must be as careful about what it cannot establish as it is about what it can.

As of 3 November 2026, the material examined for this article did not verify:

• An RBI monetary-penalty order against Epimoney for the alleged conduct discussed here;
• Cancellation of its NBFC registration;
• A verified ED or CBI enforcement action establishing fraud by Epimoney in these matters;
• A final court judgment establishing that the cited criminal complaints were fabricated;
• A final judicial finding that the company or its representatives committed the alleged harassment described in the consumer posts;
• A confirmed data breach involving FlexiLoans customer information;
• A conviction for fraud or money laundering arising from the matters discussed in this report.

The absence of such verified findings must be stated openly. It must not, however, be used as a reason to dismiss the documented complaint data, the published company disclosures, the judicial proceedings or the questions arising from the company’s financial and privacy records.

The public record supports an investigation into the company’s conduct and controls. It does not justify declaring the company guilty of a crime before the competent authorities or courts have established the facts.

That is precisely why a proper investigation is necessary.

16. Questions that Epimoney and FlexiLoans must answer

The company should provide specific, documentary responses to the following questions:

1. CIBIL complaints: What caused complaints recorded against Epimoney to rise from 201 in FY 2023–24 to 4,320 in FY 2024–25 and 5,658 in FY 2025–26? What were the principal complaint categories, and what corrective measures were implemented?

2. Credit reporting: How does the company verify that EMIs, closures, settlements, overdue amounts and other loan-account information are accurately reported to credit-information companies?

3. Criminal proceedings: What internal legal review is conducted before the company initiates criminal complaints against borrowers, business owners, directors or family members? How does the company distinguish a contractual repayment dispute from facts that may establish a criminal offence?

4. Territorial jurisdiction: What criteria are applied when complaints are filed in different cities, and what is the basis for the choice of jurisdiction in each case?

5. Recovery agents: What monitoring and complaint-investigation systems apply to third-party recovery representatives? Are call recordings, communication logs and agent identity records preserved?

6. Marketing communications: What controls prevent preliminary eligibility indications from being represented as final loan approvals? Can the company authenticate the messages reproduced in the August 2026 report?

7. Credit enquiries: What consent and authorisation records exist for credit-bureau enquiries arising from applications that never progress to disbursal?

8. Data collection: Why does the Google Play data-safety declaration state that data is not encrypted while the privacy policy describes SSL safeguards? Has an independent security audit reconciled the declarations?

9. Personal information: What information is collected from contacts, bank SMS, Gmail permissions, references and linked accounts? Which categories are essential, and how is unnecessary data minimised?

10. Historical FIU compliance: What corrective steps were taken after the historical listing concerning Principal Officer registration, and what compliance controls are currently in place?

11. IFC action plan: Has the environmental and social management system and the designated officer identified in IFC’s action plan been implemented? What is the current completion status?

12. Financial covenants: What were the precise covenant calculations following the transition to Ind-AS, and what formal relaxations or amendments were obtained from lenders?

A company confident in its compliance architecture should be able to answer such questions with records rather than generic statements about customer service and digital innovation.

17. Regulators must not allow digital lending to outrun accountability

The record warrants a closer, coordinated examination by the relevant authorities, within their respective statutory jurisdictions.

The RBI should examine the regulated entity’s customer-protection framework, digital-lending arrangements, complaint management, recovery-agent supervision and compliance with applicable outsourcing and digital-lending requirements.

Credit-information companies and the relevant authorities should examine the complaint categories and the accuracy of reported borrower information, particularly where borrowers allege incorrect repayment histories, account status or loan-related entries.

The competent data-protection and cyber-security authorities should examine the company’s data-collection disclosures and the apparent discrepancy between its privacy policy and its Google Play data-safety declaration, where the facts establish a regulatory basis to do so.

The authorities responsible for communications and commercial messaging should examine any substantiated allegations of unsolicited calls or misleading loan-related communications, including the identity of the sender, applicable consent and suppression records.

Police authorities and prosecutors should assess allegations concerning individual recovery conduct on the basis of evidence, not assumptions arising merely from the fact that a representative is associated with a lender.

Where evidence discloses a cognisable offence or a statutory violation, the competent enforcement agency should act promptly and independently. Where allegations are unsupported, that conclusion should also be recorded.

There is equally a need for speedier judicial scrutiny of the criminal proceedings that have been challenged by borrowers. Interim protection is not a final trial. A stay should not become a substitute for a decision on the merits. Trial courts should determine jurisdictional objections, the existence of the necessary ingredients of criminal offences and the responsibility of each accused without avoidable delay.

At the same time, legitimate lenders must retain the ability to recover genuine dues through lawful procedures. A borrower cannot escape a valid financial obligation simply by making an allegation against the lender.

The standard must be the same for both sides: evidence, due process and timely adjudication.

18. Digital lending cannot become a marketing business with accountability outsourced to the borrower

The FlexiLoans record illustrates a larger problem confronting India’s digital-lending market.

The industry frequently celebrates rapid disbursal, alternative credit assessment, automated underwriting and technology-driven financial inclusion. These developments can be valuable, particularly for small enterprises and borrowers underserved by conventional banking.

But financial inclusion is not achieved merely by making credit easier to obtain.

It also requires accurate credit reporting, transparent loan terms, properly documented consent, responsible recovery practices, effective grievance resolution and protection of sensitive personal information.

A borrower should not have to become a litigation expert to understand why an EMI has been reported incorrectly. A small business owner should not have to spend months challenging a criminal complaint before learning the legal basis of the accusation. A person declining a loan should not have to repeatedly request an end to marketing contact. And a customer providing bank-related information should not be left guessing about how that information is encrypted, stored or shared.

A lender’s digital interface may be sophisticated. Its customer-protection systems must be equally sophisticated.

The company cannot claim the advantages of technology while asking customers to accept uncertainty in matters as fundamental as loan approval, credit reporting, recovery conduct and data security.

Nor can an expanding lending business treat complaints as a statistical inconvenience.

The numbers may be manageable in percentage terms. But every complaint involves a transaction that somebody considered important enough to challenge. When complaint volumes rise sharply, the appropriate response is not merely to point to the number of complaints resolved. It is to investigate why they arose.

Conclusion: FlexiLoans must answer the questions, and regulators must examine the record

The documented record against Epimoney is neither a final criminal judgment nor a clean bill of ethical and operational conduct.

It contains facts that deserve attention: 5,658 credit-information complaints recorded by CIBIL in FY 2025–26; hundreds of customer complaints disclosed in the company’s annual report; several borrower-side challenges to criminal proceedings initiated by the lender; an order involving a police-protection request in which a FlexiLoans recovery representative was named; a historical FIU compliance listing; a disclosed financial-covenant issue; rating-agency concerns about asset quality; an IFC-identified environmental and social management gap; older customer allegations; and a data-safety disclosure that appears difficult to reconcile with the company’s privacy-policy language.

There are also facts in the company’s favour: the latest CIBIL disclosure recorded no complaints unresolved beyond the prescribed turnaround time; the FY 2023–24 annual report recorded no customer complaints pending at year-end; the company reported that maintainable Ombudsman complaints were decided in its favour; CRISIL maintained its BBB/Stable rating; and Acuité’s latest assessment recorded an improvement in gross NPA alongside improved profitability.

An honest investigation must report both sides.

But those positive indicators do not remove the need to answer the outstanding questions. A rating is not a customer-protection audit. A zero-pending complaint figure does not prove that every underlying grievance was unnecessary. A company’s privacy policy is not a technical security certificate. And a criminal complaint is not proof of guilt merely because a lender has filed it.

FlexiLoans should publish a detailed, evidence-backed explanation of its complaint trends, credit-reporting controls, criminal recovery practices, recovery-agent supervision, marketing permissions and data-security safeguards.

The RBI and other competent authorities should examine the matters falling within their jurisdiction and make reasoned findings within a defined timeframe. Where there is evidence of a violation, the response should be proportionate, firm and timely. Where evidence does not sustain an allegation, that too should be recorded clearly.

The courts should hear the pending challenges and decide them without unnecessary delay. Borrowers should not remain under the shadow of unresolved criminal proceedings indefinitely. Equally, genuine lenders should not be denied lawful recovery simply because a dispute has arisen.

The central question is not whether FlexiLoans can grow its loan book. Its reported growth demonstrates that it can expand its lending operations.

The more important question is whether its systems of compliance, customer protection and accountability are growing at the same pace.

A company that markets speed must not be slow when asked to explain itself. A company that collects sensitive financial information must be transparent about how it protects it. And a company that invokes the criminal justice system against borrowers must be prepared for equally rigorous scrutiny of the legal basis of its complaints.

In digital lending, trust is not created by an app, a slogan or a pre-approved-loan message. It is earned through conduct, transparency and accountability.

FlexiLoans now has some uncomfortable questions to answer. The public and the regulators should insist on answers supported by documents, not advertisements.