Direction regarding conduct of Pilot Project for acquisition of fresh digital consent through the Consent Registration Function (CRF) Framework with RBI-regulated Banks

1Pgiici, wiftictui ç1t1I TELECOM RE ULA ORY AUTHORITY OF IN IA _iiu_t1_i ____ _______ IIcI *I'I I Government of India TRAI

Dated: 13 Jun, 2025 DIRECTION

Subject: Direction under section 13, read with sub-clauses (i) and (v) of clause (b) of sub-section (1) of section 11, of the Telecom Regulatory Authority of India Act, 1997 (24 of 1997), regarding conduct of Pilot Project for acquisition of fresh digital consent through the Consent Registration Function (CRF) Framework with RBI-regulated Banks F. No. RG-25/(7)/2022-QoS: Whereas the Telecom Regulatory Authority of India (hereinafter referred to as "the Authority"), established under sub-

section (1) of section 3 of the Telecom Regulatory Authority of India Act, 1997 (24 of 1997) (hereinafter referred to as "TRAI Act"), is entrusted with the discharge of certain functions, inter alia, to regulate the telecommunication services; ensure technical compatibility and effective interconnection between different service providers; lay down standards of quality of service to be

provided by service providers and conduct the periodical survey of such services provided by the service providers so as to protect interest of the consumers of telecommunication service;

2. And whereas the Authority, in exercise of powers conferred upon it under section 36, read with sub-clause (v) of clause (b) and clause (c) of sub-

section (1) of section 11, of the TRAI Act, made the Telecom Commercial Communications Customer Preference Regulations, 2018 (6 of 2018) dated the 19th July 2018 (hereinafter referred to as the "regulations") as amended from time to time to curb unsolicited commercial communications;

,

3. And whereas regulation 36 of the regulations provides that the Authority may set up or permit to set up a Regulatory Sandbox to test the implementation of regulatory checks using Distributed Ledger Technology

(DLT) networks and complementary technological solutions, and, by order or direction, specify the requisite processes to operationalise such regulatory sandbox;

4. And whereas the proviso to sub-item (2) of item 4 of Schedule-I to the regulations provides that the Authority may specify any other manner for consent registration or revocation from time to time;

1 -qr ( jjçigu 'w), '1 iw, 9 1Qv-110029 World Trade Center, Tower-F, (4th to 7th Floors), Nauroji Nagar, New Delhl-110029 Tel. : 011-20907752 / www.tral.gov.in5. And whereas the Authority has observed that, despite technical readiness by Access Providers, Senders/Principal Entities (PEs), including banks, have not onboarded the Consent Registration Function (CRF), which is leading to underutilization of infrastructure and proliferation of non- compliant commercial communications;

6. And whereas, to strengthen the Consent Registration Function, the Authority considers it essential to operationalize a simplified, scalable, and consumer-centric CRF framework through a controlled Pilot Project running within a Regulatory Sandbox to validate operational feasibility, technical performance and regulatory conformance;

7. And whereas the Authority has decided to establish a Regulatory Sandbox for onboarding entities belonging to Banking, Financial Services, and Insurance (BFSI) sectors starting with Banks regulated by the Reserve Bank of India (RBI);

8. And whereas the RBI has, during the 7th meeting of Joint Committee of Regulators (JCoR) held on 25th April, 2025, consented to assist in identifying suitable Banks for participation in the Pilot Project;

9. And whereas the objectives of the Pilot Project include establishing a reliable digital consent management mechanism; validating operational feasibility, technical performance and regulatory compliance of the CRF framework; facilitating smooth onboarding of RBI-regulated banks through simplified consent workflows; empowering consumers with uniform and simple consent revocation processes; and designing effective consumer awareness programmes;

10. And whereas the Authority will ensure regulatory oversight, framework refinement and monitoring of the Pilot Project; assign responsibility to any stakeholder as and when required during the Pilot Project; co-ordinate with RBI and other regulators/entities during the Pilot Project; publish post-Pilot Project guidelines and a programme indicating sector-wise roll-out in phases beginning with Banks and other critical sectors upon successful completion of the Pilot Project;

11. And whereas the Authority shall constitute working groups comprising of representatives from the Authority, Access Providers, RBI and Banks to ensure day to day monitoring and preparation of necessary reports during and post completion of Pilot Project;12. Now, therefore, the Authority, in exercise of powers conferred upon it under section 13, read with sub-clauses (i) and (v) of clause (b) of sub-section

(1) of section 11 of TRAI Act, 1997; regulation 36 of the regulations; and the proviso to sub-item (2) of item 4 of Schedule-I to the regulations, hereby directs all Access Providers to follow the Standard Operating Procedures contained in Annexure I, Annexure II and Annexure III to this Direction to conduct Pilot Project within a Regulatory Sandbox for acquisition of digital consent through Consent Registration Function Framework with RBI- regulated Banks.

(Deepak Sharma) Advisor (QoS-Il) Telecom Regulatory Authority of India To:

All Access ProvidersAnnexure I Steps for the Pilot Prolect

All Access Providers shall:-

(a) conduct a three (03)-month Pilot Project, limited to RBI-regulated banks as PEs, in accordance with the processes and safeguards outlined in Annexure-Il;

(b) conduct the Pilot Project in a Regulatory Sandbox as a controlled testbed for validating technical, operational, and consumer-centric dimensions of the CRF;

(c) integrate end-to-end DLT systems for consent recording and revocation;

(d) coordinate with the participating Principal Entities (PEs), i.e., RBI- regulated Banks, for system integration and consumer awareness campaigns;

(e) function as Originating Access Provider (OAP) while providing services to PEs, transfer consent data to respective Terminating Access Providers (TAPs) etc.;

(f) function as TAP as applicable, send notifications to customers, receive revocation requests, update CRF etc.;

(g) submit detailed reports to the Authority within ten (10) business days of completion of Pilot Project, as per Annexure-Ill;

(h) provide logistical support to the Pilot Project;

(i) participate in Working Groups;

U) conduct fortnightly progress review meetings and submit the report of such meetings to the Authority through Working Groups;

(k) submit final report to the Authority through Working Groups within ten

(10) business days post completion of Pilot Project. The report shall be prepared as per information contained in Annexure-Ill;

(1) launch media/digital campaigns within thirty (30) days from the date of this Direction to educate consumers about the Pilot Project and consent revocation mechanisms;

(m) waive off inter-operator charges during the Pilot Project period;

(n) implement processes outlined in Annexure-Il;

(o) adhere to the modifications in the terms, consent workflow, norms and reporting requirements of conducting the Pilot Project as directed by the Authority time to time based on stakeholder feedback and experience gained.Annexure-il Processes and safeguards for the Pilot Proiect

1. Banks shall upload the customers' consents (bulk or incremental), on the respective portals (or through any other mechanism) of the OAF. 'Bulk Consents" herein shall refer to those consents that were lawfully obtained by the respective entities prior to their onboarding onto the Consent Registration Facility (CRF). "Incremental Consents" herein shall mean the consents obtained by the entity subsequent to its onboarding on the CRF, which are to be mandatorily recorded on the CRF in accordance with the prescribed procedure and within the stipulated timeframe as notified under the regulatory framework.

2. Banks may submit customers' consents to the CRF either through API integration with OAPs or via any other secure mechanisms. For the consents being uploaded, the Banks! participating entities shall submit an online undertaking about the genuineness and correctness of the consents being uploaded. The format of this undertaking shall be specified by the Authority in consultation with the Access Providers during the Pilot Project.

3. OAFs shall forward these consent records to the concerned TAPs for registration of the consents on the DLT platform.

4. TAPs shall send notification SMS via the '127xxx' short code to the customers immediately after receiving the same from OAP for each successfully recorded consent (except at the time of bulk upload) informing the customers about their recorded consents. The message shall also contain a mechanism for the customer to opt-out of the consent. In case the customer decides to opt-out, the consent recorded shall be deleted from the DLI platform.

5. To ensure transparency, regulatory compliance, and operational efficiency in the implementation of the CRF; TAPs and OAPs shall establish a robust and secure mechanism to enable PEs to access updated information regarding recorded, valid, and revoked consents against end-user mobile! phone numbers. Specifically, the OAFs shall coordinate with the respective TAPs to design and operationalize an interoperable framework for secure and real-time sharing of consents & consent-related data. The information-sharing architecture shall incorporate appropriate access controls, audit logging, and performance safeguards to ensure data integrity, confidentiality, and accountability, thereby, empowering PEs to rely exclusively on legitimate and active consent records in the system for their commercialcommunications and to promptly discontinue outreach based on the revoked or expired consents.

6. TAPs should allow consumers to easily get details of all the consents recorded on CRF against their numbers, by simply sending an SMS to '127xxx' short code with keywords such as "My consents" or any other secure mechanism.

7. The consumer shall be informed fortnightly by the TAPs about the

following:

(a) consents recorded on CRF,

(b) the mechanism for consent revocation

(c) weblink to the TAP's portal where consumers can securely see the complete details of concerned PEs. The portal must always remain accessible.

8. TAPs should provide simple and easy-to-use interface for authenticated consent revocation by the consumers, both PE-wise as well as through selection of multiple PEs, and the same shall be through multiple modes i.e. web portal! Mobile App! SMS etc.

9. Access Providers should also create a page on their websites and mobile apps within thirty (30) days and sixty (60) days, respectively, reflecting the issuance of this Direction, with suitable content related to the Pilot Project and the available registration and revocation processes. The link to this webpage shall be placed in the Access Providers' Preference / UCC Complaint registration page.Annexure -III Reporting Requirements Each Access Provider, through working group, shall submit a detailed report post completion of Pilot Project within ten (10) business days to the Authority. The Pilot Project report or any feedback therein shall be supported by relevant data collected during the Pilot Project. The Pilot Project report shall include, but not be limited to, the following aspects:-

(a) Executive Summary: Brief description of the Pilot Project, its outcome and key findings.

(b) Technical Evaluation: API performance, integration logs, latency in updation of records on CRF, system uptime

(c) Consent Lifecycle Analysis: Total consent recorded, revoked,

notification success rate etc.

(d) User Interface Review: Screenshots, accessibility issues, revocation interface testing.

(e) Feedback from Banks: Qualitative feedback from nodal officers on Pilot Project.

(1) Consumer Feedback: Sample of complaints and action taken thereon, user survey data.

(g) Inter-Operator Coordination: SLA breaches, integration errors, reconciliation needs.

(h) Feedback may be provided:

(1) for scaling, commercial roll-out, policy interventions;

(ii) to improve consent workflow, balancing customer protection and ease of onboarding by businesses;

(iii) to develop and deploy user interface for revocation of consents conveniently by the consumers;

(iv) on how to notifr consumers when consents are recorded and how to send periodic notifications;

(v) for carrying out consumer awareness about CRF;

(vi) on regulatory and policy interventions required to ensure an enabling and all-encompassing framework for CRF.