Rbi's April 2026 Banking Rules, a Compliance Checklist for Banks & Fintechs in India

The April 2026 package of RBI banking rules India’s financial institutions must now comply with represents the most significant overhaul of digital-payment and consumer-protection obligations in over a decade. Effective 1 April 2026, the Reserve Bank of India has mandated two-factor authentication (AFA) for all digital payments, introduced a digital fraud compensation framework that shifts liability timelines sharply in favour of customers, and issued the Digital Banking Channels Authorisation Directions requiring real-time transaction alerts and enhanced monitoring. Separately, the Banking Laws (Amendment) Act, 2025 has expanded the RBI’s supervisory toolkit, while digital lending platforms face an operational compliance demonstration deadline of 30 June 2026.

This article provides a prioritised, lawyer-authored compliance checklist, with sample contract clauses, entity-specific action plans and key deadlines, for in-house counsel, compliance officers and senior product leaders at banks, fintechs and NBFCs.

If you are responsible for compliance at a regulated entity, start with these eight immediate RBI compliance steps before reading the detailed guidance below:

• Conduct an AFA gap analysis across every digital-payment channel (cards, UPI, net-banking, wallets) to identify flows that lack a dynamic second factor.
• Draft or update your fraud compensation policy to align with the new digital fraud compensation framework, including provisional-credit timelines.
• Issue a board-level governance memo summarising the April 2026 changes, ownership assignments and target remediation dates.
• Audit all vendor and PSP contracts for indemnity gaps, SLA shortfalls and missing audit-rights clauses.
• Update customer-facing terms and conditions to reflect AFA consent requirements, liability allocation and dispute-resolution procedures.
• Refresh KYC and account-freeze SOPs to ensure notice and re-activation procedures comply with current RBI guidance.
• Establish or revise incident-response workflows with investigation SLAs, customer-notification templates and Ombudsman escalation paths.
• Prepare a regulator-ready evidence package, test reports, attestation records and transaction logs, for RBI or statutory auditor review.

What Changed: The RBI New Rules 2026 and Digital Banking Guidelines India

The April 2026 regulatory package is not a single circular but a coordinated set of RBI notifications, directions and legislative amendments. Together, they reshape how banks and fintechs authenticate payments, handle fraud losses, monitor digital channels and register new lending entities. Below is a concise legal overview of each pillar.

Mandatory Two-Factor Authentication (AFA) for All Digital Payments

The RBI’s Additional Factor of Authentication (AFA) directions now apply to every category of digital payment transaction processed in India, including card-not-present transactions, UPI payments, net-banking transfers and wallet-based transactions. The key technical requirement is that at least two independent authentication factors must be used, and at least one must be dynamic, generated uniquely for each transaction. Acceptable factor combinations include knowledge-based (PIN, password), possession-based (device binding, hardware token) and inherence-based (biometric) elements. All domestic card payments must pass through two independent verification steps; cardholders may authenticate using a PIN combined with an OTP or biometric confirmation.

The RBI has explicitly stated that the entity initiating the payment, whether a bank, PSP or fintech, bears primary responsibility for ensuring AFA is in place before processing the transaction.

Digital Fraud Compensation Framework

A new framework governs how customers are compensated when digital-payment fraud occurs. The framework establishes tiered liability depending on whether the fraud resulted from a bank/PSP system breach, third-party negligence or customer negligence. Where the loss arises from a bank or PSP-side failure, the institution must compensate the customer in full. Customers are required to report unauthorised transactions within a prescribed window to remain eligible for full compensation. Institutions must issue provisional credits while investigations are underway.

Digital Banking Channels Authorisation Directions

These directions mandate that banks deliver real-time transaction alerts to customers as a condition of operating digital-banking channels. They also require enhanced transaction-monitoring capabilities, including anomaly detection and velocity checks, and impose minimum standards for session management, encryption and channel-level access controls.

Digital Lending and NBFC Registration Changes

The RBI has introduced a new registration category for certain NBFCs engaged in digital lending. All digital lending platforms must functionally demonstrate compliance by 30 June 2026, meaning systems, disclosures and grievance-redressal mechanisms must be operationally live, not merely documented.

Banking Laws (Amendment) Act, 2025 and the Finance Bill 2026

The Banking Laws (Amendment) Act, 2025, which received Presidential assent in late 2025, expanded the RBI’s powers to impose penalties, conduct special audits and direct supervised entities to take corrective action. Industry observers expect the Finance Bill 2026, if enacted in its current form, to introduce further changes to loan-recovery conduct obligations and prepayment clauses. As at 17 May 2026, the Finance Bill’s final passage status should be verified independently before reliance.

Scope and Applicability, Entities Covered

The RBI new rules 2026 apply to all scheduled commercial banks (including foreign banks operating in India), payments banks, small finance banks, payment system providers (PSPs) licensed under the Payment and Settlement Systems Act, 2007, NBFCs (including those in the new digital-lending registration category) and fintech companies operating as business correspondents, payment aggregators or lending service providers. Cooperative banks and regional rural banks are covered to the extent they offer digital-payment channels.

Legal Sources and Effective Dates

The principal legal instruments include RBI notifications published on the RBI Rules & Notifications portal, the PIB press release on the Banking Laws (Amendment) Act, 2025, and the Digital Banking Channels Authorisation Directions. The AFA mandate and fraud compensation framework took effect on 1 April 2026. The digital lending operational demonstration deadline is 30 June 2026.

Compliance Checklist for Banks: RBI Banking Rules India, Legal, Operational and Contractual Steps

The following bank compliance India checklist is organised by functional owner and recommended timeline. Each item should be treated as a discrete workstream with board-level visibility.

Governance and Board Reporting

The Chief Compliance Officer should prepare a concise board memo covering: (a) a summary of each April 2026 rule change, (b) the bank’s current compliance posture and identified gaps, (c) a proposed remediation plan with owners and deadlines, and (d) the financial and regulatory-risk implications of non-compliance. The board should formally approve the remediation plan and receive quarterly progress updates until all items are closed.

Product Flows and AFA Remediation

Every digital-payment channel, mobile banking, internet banking, card transactions, UPI and any white-label or co-branded products, must be mapped against the two-factor authentication requirement. Where a flow currently relies on a single static factor (e.g., a PIN alone without a dynamic OTP or biometric), the product team must design, test and deploy a compliant second factor. Authentication flows for recurring payments and e-mandates need particular attention, as industry observers expect the RBI to scrutinise these during its next cycle of thematic inspections.

Customer Communications and Terms

Account opening documentation, digital-channel terms and conditions, and product-specific agreements must be updated to disclose: the authentication methods in use, the customer’s obligation to report fraud within the prescribed window, the bank’s liability and compensation commitments, and the dispute-resolution and Ombudsman escalation path. Banks should obtain affirmative customer consent for dynamic authentication methods, particularly where biometric data is collected.

KYC and Account-Freeze Procedures

Banks may restrict account access where a customer fails to complete periodic KYC re-verification, but must follow prescribed notice periods and offer clear re-activation procedures. A bank cannot freeze an account for KYC non-compliance without first issuing written notice, providing a reasonable cure period and documenting the steps taken. Updated SOPs should specify the notice format, the minimum cure period, the escalation path for disputed freezes, and the process for immediate re-activation upon KYC completion.

Regulatory Filings and Reporting

Banks must maintain comprehensive transaction logs (including authentication method, timestamp, device identifiers and outcome) for a minimum retention period consistent with RBI directions. Fraud incidents must be reported to the RBI within mandated timelines, and periodic compliance filings, including AFA attestation certificates, should be prepared in a regulator-ready format.

Compliance Checklist for Fintechs and NBFCs: Practical Steps and Product Changes

Fintechs and NBFCs face a distinct set of challenges under the RBI new rules 2026 because they often depend on partner banks and PSPs for settlement, KYC infrastructure and payment-channel access. The fintech compliance checklist below addresses these dependencies directly.

Map Partner Dependencies

Begin by documenting every partner relationship, sponsor banks, payment aggregators, card networks, UPI infrastructure providers and third-party KYC vendors. For each relationship, identify which party is contractually responsible for implementing AFA, maintaining transaction logs and compensating fraud losses. Where contracts are silent or ambiguous, flag them for immediate renegotiation.

Implement AFA in Fintech-Controlled Flows

Fintechs that control the customer-facing authentication experience (e.g., payments apps, wallets, digital-lending platforms) must implement two-factor authentication directly. Acceptable design options include:

• Device binding plus dynamic token: the user’s registered device acts as a possession factor, combined with a session-specific OTP or push notification.
• OTP plus device fingerprinting: a knowledge/possession combination where the OTP serves as the dynamic element.
• Biometric plus PIN: an inherence factor combined with a knowledge factor, suitable for high-value transactions.

Legal sign-off is required before any new authentication method goes live, particularly where biometric data processing triggers obligations under the Digital Personal Data Protection Act, 2023.

Customer Terms, Consent and Dispute Escalation

Fintech customer agreements must be updated to include: clear disclosure of authentication methods, the customer’s fraud-reporting obligations and timelines, the fintech’s liability and compensation commitments, data-processing purposes for authentication data, and the escalation path to the RBI Ombudsman. Consent must be affirmative, pre-ticked boxes or bundled consents are unlikely to satisfy RBI expectations.

Fraud Detection, Compensation and Incident Response

Fintechs must establish internal fraud-detection capabilities (or procure them from a vendor) that include transaction-velocity monitoring, anomaly detection and geo-location checks. When fraud occurs, the fintech must: notify the affected customer promptly, provide a provisional credit where the fraud was not caused by customer negligence, conduct an internal investigation within the prescribed SLA, and report findings to the partner bank and regulator. Maintaining technical proof of compromise, server logs, authentication records, IP and device data, is critical both for regulatory compliance and for any subsequent contractual indemnity claims against partners.

Vendor and Aggregator Contracts

Fintechs should audit every material vendor contract to ensure it includes: pass-through indemnities that mirror the fintech’s liability to customers, liability caps that reflect the digital fraud compensation framework, audit provisions granting the fintech (and the RBI) access to transaction logs and security records, and data-processing clauses consistent with the Digital Personal Data Protection Act. Where existing contracts lack these provisions, issue amendment requests immediately and escalate to senior management if vendors resist.

Operational Readiness and Regulatory Registration

Digital lending platforms must achieve operational compliance, not merely documented policies, but functioning systems, live disclosures and operational grievance-redressal mechanisms, by 30 June 2026. NBFCs applying for the new digital-lending registration category must file their applications and supporting documentation in advance of this deadline. Sandbox attestation reports, penetration-test results and compliance certificates should be prepared and kept regulator-ready.

Evidence Packages for Bank and PSP Audits

Partner banks and PSPs will increasingly require fintechs to produce compliance evidence, including AFA implementation certificates, fraud-response playbooks, transaction-log samples and data-security audit reports, as a condition of continued partnership. Fintechs should designate a compliance liaison and maintain a standing evidence package that can be updated and shared on short notice.

Contracts, Vendor Management and Sample Clauses Under the RBI Banking Rules India Framework

The April 2026 changes make vendor and PSP contract management a front-line compliance activity. Below are sample clause structures for key provisions. These are illustrative and should be adapted to the specific commercial relationship after independent legal review.

Sample Clause Snippets

• Indemnity, fraud losses. “The Service Provider shall indemnify and hold harmless the Bank against all losses, claims, damages, costs and expenses (including reasonable legal fees) arising from or related to any unauthorised transaction that results from a failure, defect or vulnerability in the Service Provider’s systems, including any failure to implement or maintain the Additional Factor of Authentication required by applicable RBI directions.”
• SLA amendment, AFA uptime and incident response. “The Service Provider shall ensure that the AFA authentication service maintains a minimum uptime of [99.9]% measured monthly. In the event of any AFA service degradation or failure, the Service Provider shall notify the Bank within [30] minutes of detection, restore service within [4] hours, and provide a root-cause analysis within [48] hours. False-positive authentication failures exceeding [0.5]% of total transactions in any calendar month shall constitute a material SLA breach.”
• Access and audit clause, log retention and encryption. “The Service Provider shall retain complete transaction and authentication logs for a minimum period of [8] years, encrypted at rest and in transit using [AES-256 or equivalent]. The Bank and its regulators (including the RBI) shall have the right to access, inspect and copy such logs upon [5] business days’ written notice, or immediately in the event of a regulatory investigation or fraud incident.”
• Data sharing and privacy clause. “All personal data processed by the Service Provider for the purpose of authentication, fraud detection or transaction monitoring shall be processed solely for those stated purposes, subject to data minimisation principles, and in compliance with the Digital Personal Data Protection Act, 2023 and applicable RBI directions. The Service Provider shall notify the Bank within [24] hours of any data breach affecting customer authentication or transaction data.”

Negotiation Tips

Banks should resist vendor attempts to cap indemnity obligations at a fixed monetary amount where the underlying exposure, fraud losses across the portfolio, is uncapped. Fintechs, conversely, should negotiate for proportional liability linked to fault, and insist on a right to conduct their own investigation before accepting indemnity claims. All parties should ensure that audit-rights clauses extend to sub-processors and fourth-party providers, as the RBI’s examination scope increasingly covers the full outsourcing chain.

Digital Fraud Compensation Framework: Incident Response and Consumer Redress

The digital fraud compensation framework establishes a structured process for handling unauthorised-transaction claims. Understanding its operational mechanics is essential for meeting the RBI banking rules India imposes on all regulated entities.

Customer Eligibility and Liability Tiers

Where the fraud results from a bank, PSP or system-level breach, the institution bears full liability regardless of whether the customer reported it promptly. Where the fraud involves third-party exploitation (phishing, social engineering) and the customer reports it within the prescribed window, the institution must issue a provisional credit while investigating. Where the customer’s own negligence (e.g., sharing OTPs) caused the loss, the customer bears liability, but the institution must still investigate and communicate its findings.

Incident Response Checklist and Compensation Timeline

• Day 0: Customer reports unauthorised transaction via any channel (app, branch, call centre, email).
• Within 48 hours: Institution acknowledges receipt, assigns an investigation reference number and initiates a freeze on the disputed amount where possible.
• Within 10 working days: Institution completes the investigation, determines the liability tier and communicates the outcome to the customer in writing.
• Within 10 working days of determination: If the institution is at fault, full compensation is credited. If the case falls in the third-party tier, provisional credit is confirmed or reversed with reasons.
• Escalation: Customers unsatisfied with the outcome may escalate to the RBI Ombudsman through the institution’s internal escalation process or directly via the RBI’s Complaint Management System.

Industry observers expect the RBI to treat delayed or non-compliant compensation as a serious supervisory concern, potentially triggering penalties under the enhanced enforcement powers granted by the Banking Laws (Amendment) Act, 2025.

Timeline, Reporting Obligations and Comparison: Who Does What Under the RBI New Rules 2026

Conclusion: Three Prioritised Next Steps for RBI Banking Rules India Compliance

The breadth of the April 2026 RBI banking rules demands a structured response. First, issue a governance memo to the board summarising all changes, assigning owners and setting deadlines. Second, prioritise the top three product fixes, AFA gap remediation, real-time alert implementation and fraud-compensation workflow deployment. Third, launch a legal contracts workstream to audit and amend all vendor, PSP and aggregator agreements using the sample clauses and negotiation principles outlined above. Early and decisive action will reduce regulatory risk, protect customers and position your institution favourably for the RBI’s anticipated supervisory reviews.

Sources

1. Reserve Bank of India, Rules & Notifications
2. Press Information Bureau, Banking Laws (Amendment) Act, 2025
3. Global Law Experts, RBI New Banking Rules 2026 India
4. Findoc, RBI Digital Lending Guidelines 2026
5. Pine Labs, RBI New UPI Rules 2026
6. India Fintech Foundation, Regulatory Announcements
7. ICLG, Fintech Laws and Regulations India 2025–2026