Draft Reserve Bank of India (All India Financial Institutions - Responsible Business Conduct) Amendment Directions, 2026

DOR.MCS.REC.No. /01-01-040/2025-26 February 11, 2026 Draft Reserve Bank of India (All India Financial Institutions - Responsible Business Conduct) Amendment Directions, 2026 It has been decided to issue comprehensive instructions on advertising, marketing and sales of financial products / services to all the All India Financial Institutions (hereinafter referred to collectively as “AIFIs” and individually as an “AIFI”) under the Reserve Bank of India (All India Financial Institutions – Responsible Business Conduct) Directions, 2025. 2. In exercise of the powers conferred by Section 45L of the Reserve Bank of India Act,1934, the Reserve Bank, being satisfied that it is necessary and expedient in public interest so to do, hereby issues the Amendment Directions hereinafter specified. 3. Short Title and Commencement (1) These Directions shall be called the Reserve Bank of India (All India Financial Institutions - Responsible Business Conduct) Amendment Directions, 2026. (2) These Directions shall come into effect from July 1, 2026. 4. These Amendment Directions shall modify the Reserve Bank of India (All India Financial Institutions – Responsible Business Conduct) Directions, 2025 as under: (1) In Chapter I on ‘Preliminary’, the following section and paragraphs shall be inserted after paragraph 3, namely: “C. Definitions 3A. In these Directions, unless the context states otherwise, the terms herein shall bear the meaning assigned to them below: (1) Compulsory bundling shall mean the practice by an AIFI of making availment of one product / service by a customer conditional upon availment of another product / service, whether own or third-party, offered by the AIFI. However, offering of multiple products / services as a package based on voluntary consent from the customer and / or on complimentary basis (i.e.,without any additional direct or indirect cost to the customer) shall not be construed as compulsory bundling. (2) Dark pattern shall mean any practices or deceptive design pattern using user interface or user experience interactions on any platform that is designed to mislead or trick users to do something they originally did not intend or want to do, by subverting or impairing the consumer autonomy, decision making or choice, amounting to misleading advertisement or unfair trade practice or violation of consumer rights. (3) Direct Selling Agent (DSA) / Direct Marketing Agent (DMA) refers to an agent / agency engaged by an AIFI to sell / market its own or third-party product / service. (4) Explicit consent refers to a specific, informed and unambiguous indication of an individual’s choice / option, given through a statement or by a clear affirmative action, which indicates agreement to a specific action by or arrangement with an AIFI. The consent shall be duly recorded / documented by the AIFI. (5) Mis-selling refers to sale of a financial product / service, whether own or third party, by an AIFI, illustratively, in the following cases: (i) Sale of a product / service, which is neither suitable nor appropriate in view of the customer’s profile even if with his / her explicit consent; (ii) Sale of a product/ service without providing correct or complete information or by giving misleading information; (iii) Sale of a product / service without customer’s explicit consent; (iv) With the sale of a requested product / service compulsory bundling of another product / service; (v) Sale of a product / service involving any other element defined by the financial sector regulator concerned as mis-selling. (6) Third-party Financial Product or Service is a product or service offered by an AIFI to its customers on behalf of a third party after entering into an agency business / referral services or any other arrangement with the third party.” 2(2) After Chapter III on ‘Responsible Lending Conduct’, a new chapter shall be inserted as under: “Chapter IIIA - Advertising, Marketing and Sales of Financial Products / Services by AIFIs A. Policy 32X. An AIFI shall put in place a comprehensive policy for advertising, marketing and sales of its own as well as third-party financial products / services, which shall, amongst others, cover aspects related to criteria for determination of suitability and appropriateness of products / services offered to customers, feedback mechanism, customer compensation in cases of mis- selling, etc. 32Y. An AIFI, availing the services of DSAs / DMAs, shall also include in its policy, aspects related to their eligibility criteria, due diligence at the pre and post-engagement level, training, functions / activities that may be assigned, performance evaluation standards, inspection / audit, control mechanisms to ensure compliance with statutory requirements along with procedures to be followed and penal actions to be taken in case of non-compliant DSAs / DMAs. B. Engagement of DSAs / DMAs 32Z. An AIFI, availing the services of DSAs / DMAs, shall maintain an up-to- date list of DSAs / DMAs empanelled / engaged with it. Such list shall include the name and other details of the DSAs / DMAs, the period of engagement, etc. Further, an updated list of such DSAs / DMAs shall be displayed on the AIFI’s website for reference by the members of public. 32ZA. An AIFI shall ensure that its employees or DSAs / DMAs engaged in the sale of own or third-party products / services possess the requisite qualification / certification, if any, prescribed by the respective sectoral regulators. 32ZB. For the benefit of the customers, any agent of the AIFI or representative of a third-party, who is present within the AIFI’s premises for the sale of the AIFI’s own or third-party product / service, shall be distinguishable from the employees of the AIFI, including clear ‘on person’ identification. 332ZC. An AIFI, based on the instructions mentioned in these Directions, shall put in place a Code of Conduct for marketing and sales of financial products / services, which shall be applicable to the AIFI’s own employees as well as DSAs / DMAs. Prior to assigning any marketing / sales related activities on its behalf, the AIFI shall obtain an undertaking from DSAs / DMAs that they agree to abide by the Code of Conduct. The agreement entered between the AIFI and DSAs / DMAs shall cover the penal / disciplinary action to be taken in case the latter are found to be in violation of the AIFI’s Code of Conduct. C. Consent aspects 32ZD. An AIFI shall ensure that products / services, whether own or third-party, are offered / sold to the customers only with their explicit consent. While obtaining consent from the customer, consents for multiple products / services or purposes shall not be clubbed together but shall be obtained individually. 32ZE. The process flow for obtaining consent through any user interface shall be designed in such a way that consent cannot be granted by the user without going through the applicable terms and conditions, if any. D. Advertisement and Marketing D.1 Suitability and Appropriateness 32ZF. Before a financial product / service is marketed / sold to a particular customer, its suitability and appropriateness for the customer shall be determined by the AIFI based on an analysis of the features, risk-return attributes, time horizon, complexity, fee structure, etc. vis-à-vis the customer’s age, income, level of financial literacy, risk tolerance, etc. D.2 Promotional Materials / Communications 32ZG. An AIFI shall not advertise / market any third-party product / service as its own. While giving the details of the third-party financial product / service provider, the AIFI shall clarify its role in providing such financial product / service. 32ZH. An AIFI shall ensure that all its advertising / promotional materials such as pamphlets, brochures, etc. are clear and factual. Such materials shall disclose the interest rate and other fees / charges associated with the financial 4product / service being promoted. The updated terms and conditions pertaining to the product / service shall be prominently disclosed at all points of sale / digital channels such as website, mobile app, etc. 32ZI. An AIFI shall send commercial communication / alerts about promotional offers in respect of its own or third-party products / services to a customer only if he / she has given explicit consent to receive such communication / alerts. 32ZJ. An AIFI shall make unsubscribing from any kind of services or commercial communication as easy as subscribing to those services or commercial communication. 32ZK. A list of all the services / commercial communications subscribed by a customer shall be made available to him / her under a specific link in the customer’s login page accessible through digital channels like mobile app, etc. D.3 Conduct of AIFI’s employees and DSAs / DMAs 32ZL. An AIFI shall ensure that its employees or DSAs / DMAs: (i) make telephonic contacts and / or visits to customers normally between 09:00 hours and 18:00 hours. Calls / visits earlier or later than the prescribed time period shall be done only when the customer has expressly given a request or authorisation to do so; (ii) send any communication to the customer only in the mode and format approved by the AIFI; (iii) provide the name and telephone number of the supervisor / AIFI official, if asked by the customer; (iv) respect the customer’s privacy and discuss the matters of his / her interest with any other individual only if the customer has given an explicit request or consent for sharing of such information; (v) explain the terms and conditions to the customer, if he / she plans to buy the product / service and check whether any further explanation / details are required; (vi) provide the details of the customers, who have expressed their desire to be flagged as “Do Not Disturb”, to the AIFI. 5(vii) do not call or visit a customer at his / her residence / business / office without his / her explicit consent (viii) do not mislead or coerce the customer in purchase of any product / service offered by the AIFI; (ix) do not call a customer regarding products already sold to him / her and if a customer calls for any such product, advise him / her to contact the customer service staff of the AIFI and provide the contact details. 32ZM. Further, an AIFI shall ensure that its DSAs / DMAs: (i) make upfront disclosure to the customer regarding the difference in fees / charges, interest rate, etc., in case the purchase of a product / service is made through the DSA / DMA vis- à-vis the same is made from the AIFI directly; (ii) do not mislead the customer about their business or organization’s name or falsely represent themselves as the AIFI’s employees; (iii) do not make any false / unauthorized commitment on behalf of the AIFI for any product / service. E. Sales of Financial Products / Services E.1 Application Forms and Other Documents 32ZN. An AIFI shall use separate application form for the sale of a particular product / service and prominently indicate the nature (e.g., insurance, mutual fund, pension fund, hybrid product (insurance + investment), etc.), and features of the product / service in the respective application form. 32ZO. An AIFI shall ensure that all documents related to the product / service, including the terms and conditions, are also available in the language of the region or in a language understood by the customer. 32ZP. Subsequent to receipt of an application from the customer for a third- party product / service, the AIFI, through an SMS / email or any other secure medium made available by it, shall seek confirmation from the customer about having applied for the specific product / service. 632ZQ. On completion of a sale, copy of the terms and conditions / agreement signed by the customer and the employee of the AIFI shall be provided to the customer, either physically or through email as per his / her preference. The AIFI shall also ensure that the documents are delivered in a secure manner to maintain confidentiality of the customer information. E.2 Measures for prevention of mis-selling 32ZR. An AIFI shall ensure that its policies and practices (e.g., organizing competitions among business units for sale of products / services, earmarking specific days of the week / month for targeted selling of particular products / services, etc.) neither create incentives for mis-selling nor encourage employees / DSAs to ‘push’ the sale of products / services. It shall be ensured specifically that no incentive is directly / indirectly received by the employees engaged in marketing / sales of third-party products / services from the third- party. 32ZS. An AIFI shall not bundle the sale of any third-party product / service with any of its own product / service. In circumstances where the sale of the AIFI’s own product / service is contingent on purchase of a third-party product / service, the customer shall be provided the option to purchase the same from any other company / agent and shall not be forced to purchase it through the third-party product / service provider with whom the AIFI has entered into an agreement. 32ZT. An AIFI shall not fund the purchase of a product / service by a customer, whether of its own or of a third-party, out of any loan facility sanctioned to the customer without his / her explicit consent. 32ZU. An AIFI shall ensure that its user interfaces do not deploy any dark pattern. User interfaces deployed by the AIFI shall be subject to user testing and periodic internal audit for identification of any unfair features, including dark patterns. An illustrative list of dark patterns, which may be relevant to AIFIs, is given in Annex I. Further, the AIFI shall ensure adherence to the ‘Guidelines for Prevention and Regulation of Dark Patterns, 2023’ issued by the Central Consumer Protection Authority (CCPA), as amended from time to time. F. Feedback and Compensation to Customers 732ZV. An AIFI shall establish a mechanism to seek feedback from customers, within a period of 30 days from the sale of any product / service to ensure that customers have understood the features of products / services and also the risks associated with such product / service. The mechanism may include selection of the customers on a random basis for such feedback through modes such as call-backs or surveys carried out by a department / vertical of the AIFI, which is not associated with sale of product / service. A half-yearly report on the findings of the feedback shall be prepared and utilized for review of existing policies and features of product / service. 32ZW. Customers can lodge complaint regarding mis-selling of a product/ service with the AIFI within the timeline specified by the respective financial sector regulators. In cases where no such timeline has been specified, customers can lodge complaint within 30 days of receiving the signed copy of the terms and conditions / agreement. 32ZX. In cases where mis-sell of a product / service is established, the AIFI shall refund the entire amount paid by the customer for purchase of the product / service and intimate the customer about cancellation of the sale, wherever applicable. Further, the AIFI shall also compensate the customer for any loss arising due to mis-selling, as per its approved policy. G. Adherence to other regulations issued by the Reserve Bank / other authorities 32ZY. In addition to the Directions mentioned herein, an AIFI shall also ensure compliance with: (i) guidelines issued by the relevant authorities from time to time, including the guidelines issued by Department of Telecommunications (DoT), Government of India and Telecom Regulatory Authority of India (TRAI) on aspects related to commercial communication such as the Telecom Commercial Communications Customer Preference Regulations (TCCCPR), 2018, as amended from time to time; (ii) guidelines issued by the respective financial sector regulators, viz., Securities and Exchange Board of India (SEBI), Insurance Regulatory and Development Authority of India (IRDAI), and Pension Fund 8Regulatory and Development Authority (PFRDA) regarding products/ services falling under their respective domains; and (iii) any relevant guidelines issued by the Reserve Bank on related matters, as applicable to the AIFIs, such as undertaking agency business by AIFIs, outsourcing of financial services, mobilisation of deposits through agents, etc.” (3) In Annexures, the following Annexure shall be inserted, namely: “Annex I – Illustrative List of Dark Patterns Relevant to AIFIs (1) False Urgency: Falsely stating or implying the sense of urgency or scarcity so as to mislead a user into making an immediate purchase or taking an immediate action, which may lead to a purchase. Illustrations: (i) Advertising / notifying customers that charges / fees for certain products / services will increase after a specific date, thereby pushing customers to sign up quickly without comparing with other available options. (ii) Offering pre-approved loans at attractive interest rates and luring the customer that the interest rate of the loan is likely to rise if the offer is not availed. (iii) Displaying countdown timers on the AIFI's website or app for promotional offers / cash back / reward points, forcing users to act fast to benefit from the deal. (iv) Using phrases like ‘Act Now’, ‘Hurry’, ‘Limited Time Only’, or ‘Offer Ends Soon’ in communications, thereby, inducing a sense of urgency, leading customers to act faster than they might otherwise. (2) Basket Sneaking: Inclusion of additional items such as products / services, payments to charity or donation at the time of checkout from a platform, without the consent of the user, such that the total amount payable by the user is more than the amount payable for the product / service chosen by the user. 9Provided that addition of necessary fees disclosed at the time of purchase or providing complimentary services shall not be considered as basket sneaking. Illustration: Selecting additional products / services by default, on behalf of the customer, e.g., adding protection against online fraud / loan protection insurance by default during the loan application process. (3) Confirm Shaming: Using a phrase, video, audio or any other means to create a sense of fear or shame or ridicule or guilt in the mind of the user so as to nudge the user to act in a certain way that results in the user purchasing a product / service from the platform or continuing a subscription of a service, primarily for the purpose of making commercial gains by subverting consumer choice. Illustrations: (i) Displaying a message like, "Are you sure you want to miss out on exclusive offers and updates?" or "No, I prefer to stay uninformed about great deals," while customer attempts to unsubscribe from marketing emails, implying that opting out is unwise. (ii) If a customer decides against adding a service, such as protection against fraud, displaying a message like, "No, I don't want extra security for my account," making the customer feel irresponsible. (4) Forced Action: Forcing a user into taking an action that would require the user to buy an additional product or subscribe or sign up for an unrelated service or share personal information in order to buy or subscribe to the product / service originally intended by the user. Illustrations: (i) Displaying pop-up advertisements for own or third-party products / services in digital channels which cannot be closed without redirection to the concerned products / services. For example, pop-up after logging in to mobile application which leads to the loan section even if the user clicks on the exit / closure button of the pop-up. 10(ii) Requesting for access to personal data like contact list, camera, data storage, location, etc. without which the registration for the AIFI’s services cannot be completed / the application cannot be used. (5) Subscription Trap: The process of - (i) making cancellation of a paid subscription impossible or a complex and lengthy process; or (ii) hiding the cancellation option of a subscription; or (iii) forcing a user to provide payment details or authorization for auto debits for availing a free subscription; or (iv) making the instructions related to cancellation of subscription ambiguous, latent, confusing, cumbersome. Illustration: Making it easy for customers to sign up for a product / service (e.g., insurance product, etc.) but making the procedure for cancelling the same significantly cumbersome like not providing a direct link for cancellation, keeping the cancellation option in complex navigation requiring multiple confirmation steps. (6) Interface Interference: A design element that manipulates the user interface in ways that (i) highlights certain specific information; and (ii) obscures other relevant information relative to the other information, to misdirect a user from taking an action as desired. Illustrations: (i) Displaying the preferable option for the AIFI in bright colours / bold fonts on website / mobile app. (ii) Default choice for consent being ‘Yes’ in various menu options on website / mobile app. (iii) Embedding information related to / options on how to close account, delete personal data, etc., deep in the user interface rather than being made easily accessible. (7) Bait and Switch: The practice of advertising a particular outcome based on the user’s action but deceptively serving an alternate outcome. 11Illustration: Advertising a lower interest rate initially and charging a higher interest rate at the time of actually applying for a loan, at times accompanied by non-disclosure of processing fees and other charges upfront. (8) Drip Pricing: A practice whereby – (i) elements of prices are not revealed upfront or are revealed surreptitiously within the user experience; or (ii) revealing the price post-confirmation of purchase i.e., charging an amount higher than the amount disclosed at the time of checkout; or (iii) a product or service is advertised as free without appropriate disclosure of the fact that the continuation of use requires in-app purchase; or (iv) a user is prevented from availing a service which is already paid for unless something additional is purchased. Illustration: Not revealing processing fees and other charges upfront (9) Disguised Advertisement: A practice of posing, masking advertisements as other types of content such as user generated content or new articles or false advertisements, which are designed to blend in with the rest of an interface in order to trick customers into clicking on them. Illustrations: (i) Sending push notifications through mobile application or emails that appear to be urgent account alerts or important updates but, in effect, are advertisements for new services or promotions, such as, "Important: Your account might benefit from this new feature!". (ii) When searching for specific features or services on website / mobile application, showing products or services beneficial to the AIFI at the top of the results. (10) Nagging: A dark pattern practice due to which a user is disrupted and annoyed by repeated and persistent interactions, in the form of requests, information, options, or interruptions, to effectuate a transaction and make some commercial gains, unless specifically permitted by the user. 12Illustrations: (i) Repeatedly asking the customer to enable non-essential cookies on website / mobile application despite the customer having refused earlier. (ii) Inserting multiple dialogue boxes (e.g., for seeking reviews) and asking the customer to mandatorily select an option before allowing him / her to leave the application / website. (11) Trick Wording: Deliberate use of confusing or vague language like confusing wording, double negatives, or other similar tricks, in order to misguide or misdirect a user from taking desired action or leading consumer to take a specific response or action. Illustrations: (i) Using confusing double negatives to trick users into opting for promotional emails or additional services, e.g., a checkbox that says, “Uncheck this box if you do not want to receive offers” (ii) When adjusting privacy settings, a question like, “Do you want to disable data sharing?” with options “Enable” and “Disable” can be confusing, leading users to inadvertently enable data sharing.” (Veena Srivastava) Chief General Manager 13