Menu

Rules, Regulations & Compliance

Curated by FACE for members and the wider ecosystem

From laws and regulatory directions to guidance, consultations, and compliance resources, this page brings together developments that shape the operating environment for the FinTech ecosystem. Organised across key regulatory and operational areas, it is intended to make relevant requirements and reference material easier to discover, navigate, and use.

AI, Technology & Digital Infrastructure

Master Direction – Unique Identifiers in Financial Markets

The consolidated instructions on the use of Legal Entity Identifier (LEI) and Unique Transaction Identifier (UTI) for financial market transactions, including OTC derivatives.

View on RBI Website

FinTech Sandbox Framework

The IFSCA issued its FinTech Sandbox Framework, expanding access to multiple sandbox mechanisms and introducing faster approvals, phased testing, and broader eligibility.

View on IFSCA Website

Aadhaar Face Authentication SDK and Sandbox

Enables ecosystem partners to integrate and test Aadhaar face authentication in mobile applications.

View on PIB Website

Measures to Enhance Customer Convenience through the Account Aggregator Framework

Announces interoperability among NBFC-account aggregators to enable customers to access and share information through an aggregator of their choice.

View on RBI Website

Payments Vision 2028

The RBI released Payments Vision 2028 outlining the strategic direction for the development of India’s payment and settlement systems.

View on RBI Website

Switching Fee Rebate for UPI URCS

The NPCI revised the implementation timeline for automated reversal of switching fee rebates for UPI transactions in the URCS back-office system to May 1, 2026.

View on RBI Website

Guidelines – Faster Cross-Border Inward Payments

The RBI mandated near real-time reconciliation of nostro accounts and same-day credit to beneficiary accounts (within FX hours) to significantly reduce delays in inward remittances.

View on RBI Website

Master Direction – Digital Payments E-mandate Framework

The RBI consolidated all e-mandate rules and increased limits for auto-debits (INR 15,000 general, INR 1 lakh for select categories) with mandatory pre-debit alerts and easy opt-out controls for users.

View on RBI Website

System Controls for Chargebacks

NPCI will implement automated validation controls in NRCS to reject invalid chargebacks under reason codes 3004 and 3005 (blacklisted vehicle/low balance).

View on NPCI Website

MCC Classification for Gift Cards/Vouchers

NPCI introduced a new MCC 7016 specifically for gift card/voucher purchases via UPI, separating them from MCC 6540 (used for PPI wallet loading).

View on NPCI Website

Introduction of ACH Debit Settlement on Realization under NACH

NPCI introduced settlement-on-realization for NACH ACH Debit transactions from 1 July 2026, discontinuing financial settlement at the presentation stage.

View on NPCI Website

Simplified Mandates- Extension of Limits

Expanded transaction limits under the e- mandate framework, allowing higher-value recurring payments with simplified authentication to improve convenience and support digital payment adoption.

View on NPCI Website

Master Directions - Authorisation to operate a Payment System

The RBI has issued a single, consolidated MD on authorisation to operate payment systems, simplifying and streamlining existing rules for payment system operators.

View on RBI Website

Addendum - Mandatory Brand Guidelines for BHIM UPI Merchant QR

NPCI updated the mandatory BHIM UPI Merchant QR branding guidelines to standardize the customer QR-scanning experience, requiring all new and replaced merchant QR codes from 1 Dec 2026 to comply with the revised design and obtain NPCI approval before implementation.

View on NPCI Website

Safeguarding User Information in UPI

NPCI directed all UPI member banks and apps to strengthen user privacy by masking UPI IDs, mobile numbers, and account numbers on customer-facing interfaces and enabling non-mobile-number-based UPI IDs by 4 Sept 2026.

View on NPCI Website

Enhancement of Transaction Limit for On-Device Biometric Authentication in UPI

NPCI increased the per-transaction limit for On-Device Biometric Authentication (e.g., fingerprint and face authentication) in UPI from INR 5,000 to INR 10,000, effective 7 August 2026.

View on NPCI Website

Revised Turnaround Time for UPI Fraud and Wrong Credit Chargebacks

NPCI reduced the response turnaround time (TAT) for Fraud and Wrong Credit chargebacks in the UPI URCS back-office system from 35 calendar days to 15 calendar days, effective 1 August 2026.

View on NPCI Website

Addendum on Numeric UPI ID Resolution

The circular requires banks, PSPs, and UPI applications to regularly update the Numeric UPI ID Mapper using the Mobile Number Revocation List (MNRL)/Digital Intelligence Platform (DIP), and clarifies that liability for disputes arising from failure to update the mapper rests with the PSP and UPI application.

View on NPCI Website

Merchant Discount Rate on Select UPI (P2M) Transactions

Introduces differentiated MDR rates for specified UPI merchant transactions; implementation was subsequently deferred.

View on Ministry of Finance Website

Merchant Discount Rate on Select UPI (P2M) Transactions

Introduces differentiated MDR rates for specified UPI merchant transactions; implementation was subsequently deferred.

View on NPCI Website

Consumer Protection, Conduct & Grievance Redress

Amendment Directions - ‘Advertising, Marketing and Sale of Financial Products and Services by REs’

The RBI issued final rules to regulate how REs advertise, market, and sell financial products, aiming to curb mis-selling, misleading promotions, and unfair sales practices (effective January 1, 2027).

View on RBI Website

Amendment Directions - ‘Review of Framework of Limiting Customer Liability in Digital Transactions’

The RBI strengthened customer protection in digital banking by expanding liability coverage for electronic fraud, speeding up complaint resolution, and introducing compensation for small-value fraudulent transactions (effective 1 January 2027).

View on RBI Website

Amendment Directions on ‘Conduct of Regulated Entities in Recovery of Loans and Engagement of Recovery Agents’

The RBI issued final Amendment Directions prescribing requirements relating to fair treatment of borrowers, conduct and training of lenders’ employees and recovery agents, the use of technology-based mechanisms for recovery of loan dues through financed devices, etc.

View on RBI Website

Data Protection, Privacy & Cybersecurity

Advisory for Defending Against Frontier AI Driven Cyber Risks

CERT-In emphasised that organisations must adopt zero-trust architectures, enforce rapid patching cycles (within 24 hours), and deploy AI-enabled defence mechanisms to keep pace with accelerated, AI-driven threat environments.

View on CERT-IN Website

Quantum Secure and Adaptive Financial Ecosystem (Q-SAFE) – Setting up of an Expert Committee

The RBI constituted an expert committee on quantum-resilient cybersecurity frameworks.

View on RBI Website

Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure

CERT-In released an implementation-oriented blueprint for organisations to strengthen resilience against AI-enabled cyber threats.

View on CERT-IN Website

Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers in BFSI Entities

Advises on attacks targeting payment and disbursement APIs and theft of API credentials.

View on CERT-IN Website

AI Agents as Attack Vectors – Unauthorized Access by Agents under Evaluation and Misuse of Open-Source Agentic AI Tools Targeting Indian ICT Assets

Warns of AI agents exceeding authorisations and misuse of agentic AI tools in cyber intrusions.

View on CERT-IN Website

Remote Code Execution Vulnerabilities in PHP (PHP2Shell) – Advisory to MSMEs

Warns MSMEs of PHP vulnerabilities that could allow remote code execution and system compromise.

View on CERT-IN Website

Digital Lending

RBI (Housing Finance Companies) Directions, 2025

Provides a comprehensive regulatory framework for HFCs covering registration, capital adequacy, asset classification, governance, and deposit-taking norms.

View on RBI Website

RBI (NBFC – Asset Liability Management) Directions, 2025

Comprehensive framework for NBFCs to manage liquidity, interest rate, and currency risks.

View on RBI Website

RBI (NBFC – Classification, Valuation and Operation of Investment Portfolio) Directions, 2025

Includes accounting standards, valuation norms, and governance via Board-approved investment policies.

View on RBI Website

RBI (NBFC – Income Recognition, Asset Classification and Provisioning) Directions, 2025

Lays down prudential norms for NBFCs on income recognition, asset classification (standard/NPA), and provisioning to ensure accurate reflection of credit risk.

View on RBI Website

RBI (NBFC – Managing Risks in Outsourcing) Directions, 2025

Provides a comprehensive framework for outsourcing by NBFCs, covering governance, risk management, service provider selection, and ongoing monitoring.

View on RBI Website

RBI (NBFC – Resolution of Stressed Assets) Directions, 2025

Provides a structured framework for early stress identification, resolution plans, restructuring, and inter-creditor coordination.

View on RBI Website

RBI (NBFC – Responsible Business Conduct) Directions, 2025

Sets standards for fair, transparent, and borrower-centric lending practices, including disclosures, charges, interest resets, and customer protection norms.

View on RBI Website

RBI (NBFC – Securitisation Transactions) Directions, 2025

Comprehensive framework for NBFCs to securitise standard loan assets, ensuring risk transfer, liquidity, and investor access while restricting risky structures.

View on RBI Website

RBI (NBFC – Transfer and Distribution of Credit Risk) Directions, 2025

Creates a unified framework for loan transfers, stressed asset sales, and co-lending models to improve liquidity and risk distribution.

View on RBI Website

RBI (NBFC – Treatment of Wilful Defaulters and Large Defaulters) Directions, 2025

Defines frameworks for identifying, classifying, preventing, and reporting wilful and large defaulters.

View on RBI Website

RBI (NBFCs – Acceptance of Public Deposits) Directions, 2025

Provides regulatory framework for NBFCs accepting public deposits; covers eligibility and restrictions on deposit acceptance, maintenance of liquid assets, etc.

View on RBI Website

RBI (NBFCs – Account Aggregator) Directions, 2025

Provides a framework for registration, governance, and operations of NBFC-AAs.

View on RBI Website

RBI (NBFCs – Acquisition of Shareholding or Control) Directions, 2025

Regulates changes in ownership and control of NBFCs; mandates prior RBI approval for acquisition beyond specified thresholds.

View on RBI Website

RBI (NBFCs – Branch Authorisation) Directions, 2025

Governs branch expansion for NBFCs, introducing a deemed approval and notification model instead of case-by-case approvals for most branches.

View on RBI Website

RBI (NBFCs - Concentration Risk Management) Directions, 2025

Introduces layer-based regulation, and prevents over-concentration of exposure to a single borrower/group.

View on RBI Website

RBI (NBFCs – Credit Cards: Issuance and Conduct) Directions, 2025

Defines roles for NBFC and credit card-issuer, data sharing and customer information flows, and risk management.

View on RBI Website

RBI (NBFCs – Credit Facilities) Directions, 2025

Comprehensive framework for NBFC lending activities; covers NBFC–LSP arrangements, and detailed norms on specific lending verticals

View on RBI Website

RBI (NBFCs – Credit Information Reporting) Directions, 2025

Defines how credit data is collected, shared, managed, and governed between NBFCs and credit bureaus.

View on RBI Website

RBI (NBFCs – Credit Risk Management) Directions, 2025

Establishes comprehensive framework for managing credit risk in NBFCs; includes board-approved policies, independent credit appraisal norms, restrictions on lending, etc.

View on RBI Website

RBI (NBFCs – Governance) Directions, 2025

Establishes corporate governance framework for NBFCs based on scale-based regulation (BL, ML, UL).

View on RBI Website

RBI (NBFCs - Internal Ombudsman) Directions, 2026

Strengthens internal grievance redressal mechanism of NBFCs, mandates appointment for independent IO and fully traceable complaints workflow.

View on RBI Website

RBI (NBFCs – Miscellaneous) Directions, 2025

Covers residual and cross-cutting regulatory instructions for NBFCs across layers, including specific provisions for NBFC-Factors, IDF-NBFCs, and others.

View on RBI Website

RBI (NBFCs – Peer to Peer Lending Platform) Directions, 2025

Provides a regulatory framework for NBFC-P2Ps covering registration, permissible activities, prudential norms, and governance.

View on RBI Website

RBI (NBFCs – Prudential Norms on Capital Adequacy) Directions, 2025

Establishes capital adequacy framework for NBFCs, including composition of regulatory capital (CET1, Tier 1, Tier 2), leverage ratio, risk-weighted assets, and ICAAP requirements (for upper layers).

View on RBI Website

RBI (NBFCs – Registration, Exemptions and Framework for Scale Based Regulation) Directions, 2025

Covers registration, classification, and prudential layering of NBFCs.

View on RBI Website

RBI (NBFCs – Undertaking of Financial Services) Directions, 2025

Governs the scope and conditions under which NBFCs can undertake financial services beyond core lending.

View on RBI Website

RBI (NBFCs – Voluntary Amalgamation) Directions, 2025

Establishes the regulatory framework for mergers involving NBFCs.

View on RBI Website

RBI (Standalone Primary Dealers) Directions, 2025

Provides a regulatory framework for SPDs covering registration, capital adequacy, governance, and permitted activities in government securities markets.

View on RBI Website

KYC, AML & Financial Crime Compliance

CKYCRR 2.0 Go-live preparedness for REs

CKYCRR announced that CKYCRR 2.0 is tentatively scheduled to go live in August 2026, with the migration of REs to commence in a phased manner following completion of ongoing audits.

View on CKYCINDIA Website

Lending & Credit Regulation

Final directions - Trade Receivables Discounting System (TReDS)

The RBI announced the final regulatory framework for the Trade Receivables Discounting System (TReDS), an online platform where MSMEs can convert unpaid invoices into immediate cash.

View on RBI Website

NBFC Regulation

Amendment Directions – Owned Fund / Tier 1 Capital Computation for NBFCs / ARCs

The RBI issued Amendment Directions clarifying the computation of Owned Fund / Tier 1 Capital for NBFCs and ARCs and its applicability to credit and investment concentration norms.

View on RBI Website

Amendment Directions – NBFC Branch Authorisation

The RBI relaxed branch opening norms for NBFCs to enable easier expansion and improve ease of doing business.

View on RBI Website

Amendment Directions - ‘Review of methodology for identification of NBFC-UL and inclusion of Government owned NBFCs in NBFC-UL’ and ‘Credit/Investment Concentration Norms – Government owned NBFCs’

The RBI amended NBFC regulations by revising the criteria for identifying upper-layer NBFCs, bringing eligible government-owned NBFCs under the framework, and updating concentration risk, governance, and disclosure norms.

View on RBI Website

Prudential Norms on Specified Non-Financial Assets (SNFA)

The RBI issued final Directions on prudential norms governing the acquisition and holding of SNFAs by REs.

View on RBI Website

RBI releases list of NBFCs in the Upper Layer (NBFC-UL) under Scale Based Regulation for NBFCs

The RBI released the list of NBFCs classified in the Upper Layer (NBFC-UL) based on financials as of 31 March 2026.

View on RBI Website

Other Regulatory Developments

Addendum to OC 208/208A/208B

NPCI introduced bulk upload/download of dispute evidence in URCS and enabled evidence submission across key dispute stages (chargeback, pre-arbitration, etc.), while mandating that all evidence must be submitted before the pre-arbitration stage Indian Computer Emergency Response Team (CERT-In)

View on NPCI Website

Launch of Common Landing Portal for Unclaimed Financial Assets

The DFS launched a unified online portal to help citizens search and trace unclaimed bank deposits, insurance claims, shares, dividends, and mutual funds through a single platform.

View on PIB Website

Omnibus Directions

The Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023

Establishes a legal framework for processing digital personal data based on consent, with rights for individuals and obligations on data fiduciaries.

View on RBI Website

RBI (NBFC – Know Your Customer) Directions, 2025

Establishes KYC, customer due diligence, and risk-based frameworks for NBFCs to prevent money laundering and ensure customer identity verification.

View on RBI Website

Payments

Framework for Outsourcing of Payment and Settlement-related Activities by Payment System Operators

Mandates that PSOs manage risks when outsourcing payment and settlement activities by adhering to minimum standards on governance, security, and oversight.

View on RBI Website

Master Direction – Reserve Bank of India (Bharat Bill Payment System) Directions, 2024

Streamlines bill payment ecosystem through a tiered structure (BBPCU, BBPOUs, agents), expands participation, standardises roles and settlement via escrow accounts, and strengthens consumer protection.

View on RBI Website

Master Direction on Regulation of Payment Aggregator (PA)

Comprehensive framework for regulation of Payment Aggregators (online, physical, and cross-border); covers authorisation, capital requirements, governance, merchant due diligence (KYC), escrow-based fund settlement, etc.

View on RBI Website

Master Directions on Access Criteria for Payment Systems

Establishes eligibility and access framework for banks and authorised PSPs to participate in payment systems (RTGS, NEFT, clearing houses).

View on RBI Website

Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators

Establishes comprehensive cyber security and resilience framework for non-bank payment system operators.

View on RBI Website

Master Directions on Prepaid Payment Instruments (PPIs)

Comprehensive framework for issuance and operation of PPIs (wallets/cards) by banks and non-banks.

View on RBI Website

RBI (Authentication mechanisms for digital payment transactions) Directions, 2025

Establishes principles for secure authentication in digital payments; mandates minimum two-factor authentication (with one dynamic factor), and enables alternative authentication methods beyond OTP.

View on RBI Website

Taxation & Legislative Developments

Taxation and Other Laws (Amendment) Bill, 2026

The Taxation and Other Laws (Amendment) Bill, 2026 was passed by both Lok Sabha and Rajya Sabha and has received Presidential assent.

View on PIB Website

Telecommunications & Customer Communications

TRAI initiates phase-wise implementation of 1601-series for service and transactional calls

TRAI introduced Phase I of the 1601-series for eligible entities in utilities, courier and logistics, with direct allocation following verification by telecom service providers.

View on TRAI Website

Telecom Commercial Communications Customer Preference (Third Amendment) Regulations, 2026

Introduces a framework for application-to-person calls and revises consent and customer relationship requirements.

View on TRAI Website