The study is devoted to the theoretical, legal, and applied analysis of the current status of microfinance organizations in Russia as a strictly regulated segment of the financial market, performing a social function of financial accessibility while maintaining increased risks for vulnerable borrowers. The purpose of the paper is to identify the key elements of the legal status of MFIs and to assess the effectiveness of existing supervisory mechanisms and consumer protection measures in the context of digitalization of services. The methodological basis includes formal legal and systemic approaches, comparative legal analysis of regulations governing microfinance and microcredit companies, as well as the study of judicial practice and acts of the mega-regulator. The results obtained clarify the structure of the MFI status: the critical importance of inclusion in the state register of the Bank of Russia, differentiation of the rights and obligations of MFCs and MCCs (including capital requirements and access to fundraising), compulsory membership in an SRO and compliance with basic standards, prudential sustainability norms, and a set of consumer restrictions (the total cost of credit limit, daily interest rate cap, restrictions on the total accrual of short-term loans). Typical violations and risky practices have been identified - misselling through imposed services, attempts to circumvent pricing limits via hidden fees, problems with collecting overdue debt and complying with debtor interaction requirements, as well as vulnerabilities in online identification and cyber fraud. The discussion demonstrates that the active supervisory and explanatory policy of the Bank of Russia and the judicial trend toward protecting the weaker party in contracts have significantly reduced the scale of abuses, yet regulatory arbitrage persists at the intersection of remote channels, debt collection, and information disclosure. The practical significance lies in the formation of a comprehensive model of the MFI status and a set of regulatory recommendations: strengthening disclosure requirements for the total cost of the loan, enhancing control over additional services and debt collection intermediaries, developing reliable remote identification and cyber resilience procedures, as well as expanding SRO tools for preventive control and compensation for damage.