THE APPROVAL THAT VANISHES AFTER THE CLICK: FLEXILOANS FACES UNCOMFORTABLE QUESTIONS OVER “READY FOR DISBURSAL” MESSAGES, CUSTOMER DATA AND CREDIT ENQUIRIES

There is something deeply troubling about telling a prospective borrower that a loan of ₹22,90,737 has been “pre-approved” and is “ready for disbursal”, only to tell the same person moments later that the application is still under review and pending details must be submitted before verification can proceed.

That is not merely a question of poor communication. It is a question of what the customer was actually being told, what stage the lending process had reached, what the customer was being persuaded to do next, and whether the language used in the communication accurately represented the lender’s internal position.

The controversy surrounding FlexiLoans, the digital lending brand operated by Epimoney Private Limited, deserves considerably more scrutiny than a routine customer-service complaint. A financial institution asking people to trust it with their business finances, identity documents, banking information and credit profiles should be held to a standard considerably higher than the marketing department’s definition of an attractive click-through message.

The central question is straightforward: when FlexiLoans tells someone that a loan is ready for disbursal, is the loan actually ready for disbursal, or is the customer merely being persuaded to enter a process in which the real assessment has yet to begin?

Six published investigative reports by Inventiva have examined this controversy from different angles. Taken together, they raise serious questions about loan-approval language, unsolicited communications, customer acquisition, KYC documentation, credit-bureau enquiries and grievance redressal.

The purpose of this investigation is not to pronounce guilt before evidence has been tested. It is to put the available material under scrutiny, examine the company’s own disclosures against the allegations, identify what the regulatory framework actually requires, and demand answers that should not be difficult for a properly governed NBFC to provide.

The ₹22.90-lakh loan that was allegedly ready to be disbursed—but still needed verification

One of the most striking incidents described in the Inventiva reporting concerns a WhatsApp communication attributed to FlexiLoans.

The message read:

“Dear Customer, This is an update regarding your FlexiLoans CGTMSE business loan of Rs. 2290737. Your loan has been pre-approved at 1% Interest and is ready for disbursal. Please review and complete your application using the link below. Team FlexiLoans.”

The customer then reportedly received another communication:

“Dear Customer, Your Rs. 2290737 business loan application is being reviewed. Ref ID: 352104. Kindly submit the pending details to move ahead with verification process. Team FlexiLoans.”

These two messages, reproduced in the Inventiva investigation, raise an obvious and uncomfortable contradiction.

The first communication creates an impression that the loan is already at the disbursal stage. The second says the application is still being reviewed and that pending information is necessary before verification can proceed.

The distinction matters.

A preliminary eligibility indication is not the same as a credit approval. A conditional or pre-approved offer is not necessarily a final sanction. A loan sanction is not the same as disbursal. And a loan cannot reasonably be described as being ready for disbursal if material underwriting or verification conditions remain outstanding.

It is possible that the first message was intended to communicate a conditional or indicative offer, while the second described the subsequent verification stage. That explanation, however, makes the wording even more important. Why was the customer told that the amount was “ready for disbursal” rather than being clearly informed that the offer was indicative and subject to verification?

The problem is not that an NBFC performs verification. It is supposed to perform verification. The problem arises when the message appears to communicate a level of certainty that the next communication immediately qualifies.

A lender cannot have it both ways. It cannot use the language of near-certain disbursement to create urgency and then retreat into the language of preliminary processing when the customer starts asking questions.

If the amount was genuinely approved, the company should disclose the approval record, the conditions attached to it and the precise stage at which the loan stood. If it was only an indicative offer, then the customer deserves to know why the communication used the expression “ready for disbursal”.

The word “ready” should mean something in financial services. It should not be a marketing ornament.

A second controversy: the alleged ₹27-lakh approval that reportedly evaporated after the customer clicked

The second major incident examined in the Inventiva series concerns a customer who reportedly received a communication indicating that a loan of approximately ₹27 lakh had been approved.

According to the account published by Inventiva, the recipient had not submitted a fresh loan application at the relevant time. The individual reportedly had an earlier loan application from 2022 that had been rejected.

After receiving the new communication, the customer allegedly followed the link and submitted Aadhaar and PAN details. The application was subsequently rejected, reportedly following an internal threat-detection check and a creditworthiness assessment.

The report also describes an interaction in which a company representative allegedly indicated that there was no active approved application and characterised the earlier message as a proposal or offer communication.

These are customer-reported circumstances, and the underlying communication logs, application records and identity of the originating sender must be independently authenticated. Nevertheless, the questions are obvious.

Why was a specific loan amount communicated if the customer had not been through the relevant assessment? What information was used to generate that amount? Was the customer being presented with a genuine conditional offer, a marketing lead, a reactivation campaign or an automatically generated eligibility estimate?

And, most importantly, why should a prospective borrower have to discover the actual status of a purportedly approved loan only after clicking a link and supplying personal information?

There is nothing inherently improper about an NBFC contacting an existing or prospective customer with an eligible loan offer where the communication is lawful and appropriately qualified. Nor is rejection after an initial eligibility assessment necessarily evidence of misconduct.

But the distinction between an advertisement, an eligibility indication, a pre-approved offer and a sanctioned loan is not a technicality to be buried in the fine print. It is fundamental to an informed financial decision.

If a customer is told that a loan is approved, the company should be able to demonstrate precisely what was approved, by whom, on what date, subject to which conditions and on what documentary basis.

The 1% interest claim: attractive headline, incomplete explanation?

The ₹22.90-lakh communication also reportedly mentioned an interest rate of “1%”.

The first problem is that the message, as reproduced, does not specify whether this means 1% per month or per annum, whether the rate is fixed or reducing, what annual percentage rate applies, or what processing and other charges would be payable.

A customer reading “1% Interest” should not be expected to reverse-engineer the lender’s pricing model.

There is, however, an important fact that must be acknowledged. FlexiLoans’ own published business-loan interest-rate page advertises rates starting from 1% per month. The same page describes processing fees of 2–3%, loan tenures of up to 42 months, pre-closure charges of up to 5% on the outstanding amount, late-payment charges of ₹1,000 plus GST and bounce charges of ₹750.

The page also explains that FlexiLoans offers both fixed and reducing-balance rate structures. It expressly cautions that the advertised starting rate is not a guaranteed offer and that the final rate depends on the borrower’s profile and the lender’s assessment.

That disclosure is critical.

A rate of 1% per month is not the same as 1% per annum. And a fixed or flat rate is not economically identical to a reducing-balance rate. The customer needs to understand the actual annualised cost, the method of calculation, the tenure, the EMI, processing charges and other applicable fees.

The company’s own website says that the credit and business assessment is undertaken before the final loan offer is determined, and that disbursal follows acceptance of the offer and execution of the loan agreement.

That makes the language in the alleged WhatsApp communication deserving of a direct explanation.

The company cannot advertise transparency on its website and simultaneously leave a customer-facing loan message open to a material misunderstanding about the rate, approval stage or disbursal status.

There is another point concerning the reference to CGTMSE. The Credit Guarantee Fund Trust for Micro and Small Enterprises is a credit-guarantee mechanism supporting eligible lending institutions. It is not a substitute for borrower-level assessment, nor does the appearance of the CGTMSE name mean that the scheme itself has sanctioned or disbursed the customer’s loan.

If the communication invokes a government-backed credit-guarantee framework, the lender should state the actual lending entity, the applicable scheme, the guarantee-related conditions and the borrower’s own financial obligations with complete clarity.

Government-linked terminology should never become a marketing shortcut that makes an unfinalised loan appear more certain than it is.

The click, the KYC documents and the question of customer consent

The reported sequence in the ₹27-lakh incident raises another serious issue: the collection of sensitive personal information.

According to the published customer account, the recipient clicked the link and submitted Aadhaar and PAN documents before the application was rejected.

Aadhaar, PAN, banking records and credit information are not inconsequential pieces of data. They are fundamental components of a person’s financial identity. Their collection, storage, use and disclosure must be justified by a legitimate purpose and handled in accordance with applicable law and regulatory requirements.

It would be wrong to suggest that collecting KYC documents is inherently suspicious. A regulated lender is required to undertake identity and customer verification. The real issue is whether the customer was given a clear and accurate account of why the documents were being collected, which entity was collecting them, what application or financial product they related to, how the information would be used and whether the necessary consent had been obtained.

The RBI’s NBFC (Credit Facilities) Directions, 2025, as amended and updated through July 2026, contain specific requirements for digital lending.

Among other things, the framework requires digital-lending data collection to be need-based and supported by the borrower’s prior and explicit consent, with an audit trail. It also requires the borrower to have appropriate options concerning consent, disclosure to third parties, retention and revocation of previously granted consent. The Directions restrict access to certain mobile-phone resources, including contact lists, call logs, files and media, subject to the specific provisions and exceptions applicable to onboarding and KYC.

The question is therefore not merely whether Aadhaar and PAN were uploaded. It is whether the collection was preceded by a clear, informed and properly recorded consent process, and whether the data was used only for the disclosed purpose.

The issue becomes particularly important where the customer allegedly did not understand that the process was still only preliminary.

A customer should not be led to believe that a loan is practically ready for payment and then discover that the supposed approval was only an invitation to supply further personal information.

FlexiLoans’ own privacy disclosures make the issue more important

The company’s published privacy disclosures deserve attention in this context.

FlexiLoans states that, where a user permits access to their Gmail account, its system can use a read-only Gmail API to retrieve bank statements for the previous six months for loan-eligibility assessment.

Its disclosures also state that the mobile application collects and monitors financial SMS messages from alphanumeric senders to help identify bank accounts, cash-flow patterns, transaction descriptions and amounts for credit-risk assessment.

These are significant data-processing activities.

The company may have legitimate business reasons to seek such information, and its policy describes the purposes for which it says the data is used. That is not proof that any data was misused in the incidents described by Inventiva.

But when a company operates a business model involving financial SMS analysis, digital KYC, banking information, credit assessment and multiple customer-acquisition channels, the importance of a transparent consent mechanism becomes even greater.

A customer must know what information is being accessed and why. Consent must not become an obscure checkbox that effectively turns a person’s financial data into the price of merely discovering whether a loan might be available.

The regulator should examine the actual consent journeys, application permissions, server logs, vendor access, data-retention practices and deletion records relevant to the complaints.

A privacy policy is a public promise. Its actual implementation is what matters.

The CIBIL controversy: the question is unauthorised access, not sensational point deductions

The Inventiva series also raises concerns about credit-bureau enquiries allegedly arising after customers responded to loan-related communications.

This issue requires precision because credit enquiries are routinely misunderstood and often sensationalised.

When a lender accesses a person’s credit report in connection with a loan or credit application, the enquiry can be recorded in the credit report. Whether it affects the person’s score, and by how much, depends on the circumstances.

One of the Inventiva articles refers to a possible 5–10 point reduction from a hard enquiry. That figure should not be repeated as a universal or guaranteed consequence. TransUnion CIBIL’s own consumer guidance describes the score impact of an enquiry as minimal. There is no sound basis for declaring that every enquiry automatically deducts a fixed number of points.

But this does not make the issue insignificant.

The serious question is whether a customer who merely responded to what appeared to be an approved offer was subjected to a credit enquiry without properly understanding that a formal application or credit assessment was being initiated.

A credit enquiry is not simply another marketing statistic. It is a record of access to a person’s credit information.

A proper investigation should establish:

• Whether a hard or soft enquiry was made.
• Which legal entity accessed the credit report.
• The date and time of the enquiry.
• The application or reference number associated with it.
• The specific consent or authorisation relied upon.
• Whether the customer was clearly informed that a credit assessment would take place.
• Whether the enquiry was made before or after the customer submitted an application.
• Whether the lender corrected any enquiry found to be unauthorised or erroneous.

The company should also provide a clear explanation of how it distinguishes a marketing lead, an eligibility check and a formal loan application within its systems.

If a customer has not proceeded with a loan, that customer should not be left guessing why a lender accessed their credit profile.

The right question is not how many points might disappear from a score. It is whether the lender can establish a legitimate and properly documented basis for the enquiry in the first place.

Unsolicited marketing and TRAI compliance: the DLT records should answer the question

Several of the Inventiva articles raise concerns about unsolicited loan-approval SMS messages, repeated marketing communications and alleged contact with individuals who did not want to proceed.

These allegations deserve examination under the applicable telecom-commercial-communication framework.

TRAI’s Telecom Commercial Communications Customer Preference Regulations, 2018 and related directions establish requirements for commercial communications through telecom networks. Its published guidance requires principal entities sending bulk communications to register as senders, use registered headers, register content templates and follow the applicable consent requirements.

TRAI’s guidance also distinguishes promotional communications from service communications. A message’s classification matters. Calling a promotional communication a service message does not make it one merely because a financial-services company sent it.

The question that needs to be answered is whether the relevant message was promotional, transactional or genuinely service-related, and whether the sender complied with the applicable registration, template, preference and consent requirements.

There is an important technical correction worth making in the wider public discussion.

The 140xx and 1600xx number-series requirements referred to in some public commentary concern promotional and service/transactional voice calls. They should not be inaccurately presented as the numbering system for promotional and transactional SMS. Bulk SMS compliance is principally examined through the applicable registered sender identity, header, content template and consent records.

Similarly, the rules governing bulk SMS should not simply be assumed to apply identically to WhatsApp messages. A WhatsApp communication requires examination of its own originating business account, customer opt-in and opt-out records, provider logs and applicable legal framework.

The regulator should therefore demand the actual records, not rely on screenshots alone.

For every disputed SMS, the relevant records include the principal entity ID, registered header, content-template ID, consent-template information, telecom-service-provider logs, delivery timestamps and the identity of any telemarketer or aggregator involved.

For WhatsApp communications, the relevant records should include the registered business account, source of the phone number, relevant customer opt-in, message template and delivery logs.

DND registration is important, but it does not by itself settle every case where a customer may have given valid, specific consent. Equally, a company should not claim consent merely because a person’s contact details existed in its database or because the person once visited a website.

The answer lies in verifiable records.

The NBFC cannot outsource accountability and then outsource the explanation

FlexiLoans is the trade name of Epimoney Private Limited. The company’s own website identifies Epimoney as the RBI-registered NBFC that owns and operates the platform. CRISIL’s rating rationale also identifies Epimoney as the lending entity and Flexiloans Technologies Private Limited as its subsidiary, with both entities considered together as the Epimoney group for rating purposes.

The distinction is important because customers should know which legal entity is actually responsible for the loan, the application, the collection of data and the grievance.

The RBI’s current NBFC Credit Facilities framework places specific obligations on NBFCs in relation to their digital-lending arrangements, lending-service providers, customer disclosures, consent and grievance redressal.

The responsibility for addressing digital-lending grievances remains with the NBFC. A lender cannot escape its regulatory responsibility by saying that a third-party vendor, an agent, a technology platform or an outsourced marketing partner handled the customer interaction.

If an external agency generated the messages, the NBFC should be able to identify that agency and produce the agreement governing its work.

If the messages originated from an internal system, the company should produce the relevant campaign rules, approval-status logic, content templates and audit logs.

If an affiliated technology company or another entity generated the communication, the relationship and responsibility should be made clear.

The customer should not be forced to solve a corporate-structure puzzle before finding out who told them that their loan was ready for disbursal.

A sizeable regulated lender cannot claim that its systems are too small to audit

The scale of the Epimoney group makes the issue more, not less, important.

CRISIL’s rating rationale dated 17 February 2026 reaffirmed the group’s bank-facility rating at CRISIL BBB/Stable and reported that its total bank facilities rated were increased to ₹200 crore.

The same rating rationale reported group assets under management of approximately ₹2,467 crore as of 31 December 2025. It stated that about 89% of the portfolio consisted of business term loans, with the remaining 11% consisting of supply-chain financing.

The report also recorded a group net worth of approximately ₹783 crore and a capital adequacy ratio of 56.2% as of 31 December 2025.

But the same rating rationale did not present an entirely risk-free picture. It reported a 90-days-past-due ratio of approximately 4.8% as of 31 December 2025, rising to approximately 8.8% when adjusted for the preceding 12 months’ write-offs. CRISIL identified asset-quality vulnerability arising from the unsecured nature of the group’s lending portfolio and noted that the improvement of asset quality and earnings remained important monitorable factors.

These figures do not prove the marketing and customer-data allegations. Nor do they mean that a lender with a growing loan book is engaged in wrongdoing.

They establish something different: Epimoney is a sizeable lending group, operating at a scale where customer communications, loan origination, underwriting and data processing should leave detailed digital records.

A company with a multi-thousand-crore loan book cannot credibly suggest that it is impossible to determine who generated an approval message, what internal status existed at the time, which customer record was accessed or whether a credit enquiry was initiated.

The technology should be capable of answering those questions.

If it cannot, that itself would raise serious concerns about internal controls.

Customer complaints: a pattern worth examining, but not an audited verdict

The approval-message allegations do not exist in isolation from other customer grievances reported publicly.

Inventiva’s series refers to complaints and review posts concerning disputed repayments, EMI deductions, accounts allegedly remaining active after payments, poor grievance responses, repeated calls and recovery-related conduct.

Some examples described in the reporting include allegations that a customer had paid dues but continued to see an account as active, another customer’s claim of double EMI deductions, difficulties in updating bank-account details and customers reporting that their complaints remained unresolved despite repeated communications.

There are also older public complaints.

A complaint posted on Consumer Complaints Court on 27 February 2022 by a person identifying himself as Mohamed Yousuf alleged that a repayment made through net banking was not reflected in the application and that the complainant continued to receive WhatsApp messages from the app’s representatives. The complaint described a dispute about payment confirmation and the continued display of the loan as outstanding.

Another complaint, dated 26 October 2023 and posted by a person identifying himself as Mehul Mehta, alleged that after making a business-loan enquiry and declining to proceed because of the charges and interest rate, he continued receiving between 20 and 30 calls a day despite asking the company not to contact him.

These are user-submitted complaints, not adjudicated findings. Their existence does not prove that every allegation is correct, that every complaint was attributable to the same operational team or that every FlexiLoans customer experienced similar treatment.

Nevertheless, complaints concerning payment reconciliation, repeated calls, account status and grievance handling are precisely the kinds of issues that a regulator should be able to examine through complaint registers and internal audit records.

A responsible lender should not treat customer complaints as an online reputation problem to be managed through public-relations language. It should treat them as operational signals requiring investigation.

The important question is whether the company has measured the complaints, identified recurring failures and corrected them—or whether the same grievances continue to resurface in different forms.

What the court record actually shows—and what it does not show

A responsible investigation must examine court proceedings without twisting their meaning.

Two Calcutta High Court proceedings involving Epimoney deserve mention.

In Ankur Gupta v. Epimoney Private Limited, CRR/4064/2025, decided at the interim stage on 7 January 2026, the petitioner challenged proceedings arising from a complaint case concerning an alleged ₹15-lakh business loan to Aryan Impex, a sole proprietorship reportedly represented by his late father, Rabi Gupta.

The petitioner contended that he had no connection with the proprietorship, that substantial repayment had already been made and that he had been implicated because of his relationship with the deceased proprietor. The order recorded that the alleged outstanding amount in the complaint was approximately ₹12.09 lakh.

The Calcutta High Court admitted the petition and stayed further proceedings for 12 weeks or until further order, whichever was earlier, observing that the petitioner had raised an arguable case requiring adjudication on merits.

This was an interim procedural order. It was not a final finding that Epimoney had committed wrongdoing, nor was it a declaration that the borrower or petitioner was innocent of every allegation.

A second matter, Divya Srikar Venalakanti and Another v. Epimoney Private Limited, CRR/546/2026, was considered by the Calcutta High Court on 9 February 2026.

The underlying complaint alleged that the petitioners had availed financial assistance and failed to repay ₹11,56,884.16. The petitioners disputed the allegations, contending that a considerable amount had already been repaid and that the proceedings for cheating and criminal breach of trust were not legally sustainable on the facts.

The High Court admitted the petition and granted an interim stay of the underlying criminal proceedings for 12 weeks or until further order, whichever was earlier, after observing that the petitioners had made out an arguable case.

Again, this was not a final finding against Epimoney. Nor did it establish that the borrowers had committed the offences alleged in the complaint.

These cases show that lending-related disputes involving Epimoney have reached the criminal process and the High Court. They also underline why courts must distinguish genuine recovery disputes from criminal allegations and carefully examine the facts before allowing criminal proceedings to become a substitute for civil recovery.

It would be irresponsible to describe these proceedings as proof of fraud by the company. It would be equally irresponsible to ignore the issues raised in the judicial orders.

The wider public-interest point is that the company’s recovery practices, customer records and complaint handling deserve examination with the same seriousness that it expects from borrowers facing recovery proceedings.

A lending institution that invokes criminal law against borrowers must itself be prepared to have its records and conduct scrutinised with equal rigour.

The grievance mechanism exists on paper. What happens in practice?

FlexiLoans currently publishes a grievance-redressal mechanism identifying several channels through which customers can submit complaints.

Its published escalation matrix provides for an initial customer-service response within seven days, escalation to the customer-service head with a stated 14-day turnaround time, and further escalation to its named Grievance Redressal Officer, Ms. Pranaali Sawant.

The page also tells customers that, where a complaint remains unresolved after 30 days or the customer is dissatisfied with the outcome, a complaint may be lodged through the RBI Complaint Management System and the applicable Ombudsman framework.

The existence of a grievance channel is welcome. But the test of a grievance mechanism is not whether an email address is displayed on a website. It is whether complaints are independently examined, whether the customer receives a reasoned response, whether incorrect entries are corrected, whether unauthorised communications stop and whether systemic problems are fixed.

There is also a need for consistency in the company’s public disclosures. A separately published Epimoney grievance-policy page has described a different escalation sequence, including a 15-day route to the next level. The company should ensure that all its public policies are harmonised, current and understandable.

If the same customer can find different escalation instructions on different pages of the lender’s own websites, the company should not be surprised when customers struggle to navigate its grievance process.

It should publish periodic, meaningful data on complaints received, complaints resolved, average resolution time, unresolved complaints, complaints involving digital lending and complaints concerning credit-bureau reporting.

The public should not have to rely on scattered reviews to understand whether the grievance mechanism is working.

What the regulators should investigate now

The allegations published by Inventiva warrant a structured, evidence-led examination. A general advisory or a routine compliance certificate will not answer the specific questions raised by the customer accounts.

The Reserve Bank of India should consider a focused supervisory examination of Epimoney’s customer-acquisition and digital-lending practices, including the systems through which pre-approved and ready-for-disbursal messages are generated.

The examination should include the following:

First, authenticate the messages. Obtain original SMS and WhatsApp communications, message IDs, sender records, telecom-provider information, DLT principal-entity identifiers, registered headers and content-template IDs. Determine whether the communications originated from Epimoney, Flexiloans Technologies, an authorised lending-service provider or an unrelated party impersonating the brand.

Second, reconstruct the internal loan journey. Obtain the application history, eligibility assessment, approval-stage records, underwriting timestamps, reference IDs, internal reason codes and disbursal conditions for the identified customer accounts. Establish what the system actually knew when it generated the words “pre-approved” and “ready for disbursal”.

Third, examine consent and marketing sources. Identify where the customers’ telephone numbers came from, whether they had given valid consent, whether any consent was revoked and whether a third-party lead generator or telemarketer was involved. Compare the records with the applicable TRAI requirements.

Fourth, examine KYC and personal-data processing. Obtain the exact consent records and audit trails relating to Aadhaar, PAN, bank statements and financial SMS information. Identify which entities accessed the data, why it was collected, where it was stored, which parties received it and whether any data was retained after an application was rejected or withdrawn.

Fifth, independently verify credit-bureau enquiries. Obtain the relevant credit-information-company enquiry records and match each enquiry with the customer application, consent event, time stamp, reference number and entity that accessed the report. Require correction of any enquiry found to be unauthorised or inaccurate.

Sixth, audit outsourced and affiliated operations. Examine the agreements, performance records and compliance controls governing Flexiloans Technologies and any lending-service providers, marketing agencies, digital aggregators or recovery partners involved in the customer journey.

Seventh, examine complaint handling. Reconcile customer complaints with internal service tickets, call recordings, payment ledgers, collection records and credit-bureau correction requests. Establish whether the same kinds of grievances are recurring and whether the company’s internal audit function has identified them.

Eighth, examine the recovery and payment-reconciliation process. Verify allegations of disputed repayments, duplicate debits, incorrect overdue status and communications made after repayment. Reconcile payment-gateway and bank records with the lender’s loan-management system.

TRAI and the telecom service providers should investigate any substantiated allegations concerning unauthorised commercial SMS communications and misuse of headers or templates. Credit-information companies should examine disputed enquiries and correct inaccurate reporting in accordance with the applicable framework.

If the evidence indicates impersonation, forgery, unauthorised access to personal information or other cognisable offences, the appropriate police and cybercrime authorities should investigate the originating accounts, devices, service providers and intermediaries.

There is no justification for allowing a complaint involving identity information and credit-bureau access to remain buried in an endless exchange of customer-service emails.

The questions FlexiLoans should answer publicly

The company should not respond to this investigation with a generic statement about its commitment to transparency or customer satisfaction. The issues are specific and demand specific answers.

1. Were the ₹22,90,737 and approximately ₹27-lakh communications reproduced in the Inventiva reports generated by FlexiLoans, Epimoney or an authorised third party? If not, what evidence establishes that they were impersonations?
2. What did “pre-approved” and “ready for disbursal” mean in the internal loan-management system at the precise time the first communication was sent?
3. Why did a message describing a loan as ready for disbursal appear to be followed by a request for pending information and further verification?
4. What was the exact meaning of the quoted 1% interest rate? Was it per month, fixed or reducing, and what APR, processing fee, GST and other charges would have applied to the loan?
5. Was a formal application created when the customer clicked the link? If so, at what point, and what consent was obtained?
6. Were Aadhaar and PAN documents collected in the reported cases? Which entity processed them, who had access and what was the retention or deletion policy after rejection?
7. Were credit reports accessed for the customers discussed in the articles? If yes, which entity initiated the enquiry, what authorisation was obtained and what was the recorded purpose?
8. Which marketing agencies, lead generators, telemarketers, technology vendors or lending-service providers were involved in the relevant campaigns?
9. How many complaints has the company received over the past three financial years concerning unsolicited marketing, misleading loan offers, credit enquiries, disputed repayments, duplicate EMI deductions, account closure and recovery communications? How many were resolved, rejected or remained pending?
10. What action has the company taken against any employee, vendor or intermediary found to have used inaccurate approval language or failed to follow consent and data-protection procedures?

These are not unreasonable demands. They are the minimum questions that should be answerable by a regulated financial institution.

Speedy investigation, real accountability and a better standard for digital lending

The central lesson from this controversy is that consumer protection cannot begin only after a borrower has signed a loan agreement or defaulted on an EMI.

It must begin at the first interaction.

The distinction between a marketing message and a genuine loan offer matters. The distinction between eligibility and sanction matters. The distinction between a conditional approval and readiness for disbursal matters. And the distinction between a customer voluntarily submitting documents for a clear application and a customer doing so under a misleading impression matters.

The RBI should not wait for the accumulation of thousands of complaints before examining a digital lending process that can be reconstructed from electronic records. A focused supervisory audit, with defined timelines and a documented outcome, would be far more meaningful than generic compliance assurances.

TRAI should examine the telecom records where SMS campaigns are implicated. The credit-information companies should provide an effective route for customers to challenge unexplained enquiries. The company should disclose its complaint-handling statistics and provide specific, evidence-backed responses to the affected customers.

If an investigation establishes regulatory violations, the authorities should take proportionate and timely enforcement action. If evidence of criminal conduct emerges, the appropriate agencies should investigate and prosecute in accordance with law. Where proceedings are instituted, courts should ensure efficient case management and avoid unnecessary delays, without compromising the rights of either side.

Speedy justice is not a demand for predetermined convictions. It is a demand that genuine complaints are not allowed to disappear into procedural delay.

A regulated lender has a legitimate right to market loans, assess creditworthiness, reject applications and recover genuine dues. It does not have a licence to confuse a prospective borrower about the status of a loan, disregard consent or leave unexplained access to credit information.

FlexiLoans may ultimately be able to explain every disputed message through a documented and lawful process. If so, it should produce the records and settle the controversy with evidence rather than slogans.

But if the messages were generated by its own systems, and if they conveyed a materially misleading impression of loan approval, then the issue is much more serious than an unfortunate customer-service experience.

The question is not whether a digital lender can send a message in seconds. It is whether it can take responsibility for every word it sends, every document it collects and every credit enquiry it initiates.

A loan cannot be “ready for disbursal” in the advertisement and still be waiting for its real approval in the back office without a convincing explanation.

That is the question FlexiLoans must answer. And it is a question the regulator should not leave unanswered.