RBI Issues Amendment Directions on ‘Review of Framework of Limiting Customer Liability in Digital Transactions’

What Happened

• The Reserve Bank of India issued final Amendment Directions to its existing customer liability framework for digital transactions, effective January 1, 2027.
• The amendment expands the scope of protection beyond "unauthorised" transactions (where the customer did not initiate the transaction) to also cover "fraudulent" transactions — including cases where customers were deceived into authorising transfers themselves through phishing, social engineering, or impersonation.
• A new compensation mechanism is introduced specifically for small-value fraudulent electronic banking transactions involving losses up to ₹50,000 — providing 85% of net loss or ₹25,000, whichever is lower, on a once-in-a-lifetime basis.
• Banks are required to dramatically compress complaint resolution timelines: complaints must now be resolved within 30 calendar days (down from 90 working days under the original 2017 framework) and compensation disbursed within 5 calendar days of application.
• The framework applies to all seven categories of regulated banking institutions: Commercial Banks, Small Finance Banks, Payments Banks, Local Area Banks, Regional Rural Banks (RRBs), Urban Co-operative Banks, and Rural Co-operative Banks.
• Draft directions were released for public comment from March 6, 2026 to June 24, 2026; the final directions reflect incorporated stakeholder feedback.

Static Topic Bridges

Original RBI Framework on Customer Liability (2017)

The foundational circular — "Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions" (RBI/2017-18/15, dated July 6, 2017) — established India's first structured framework for zero-liability and limited-liability protection in digital banking fraud. It introduced tiered liability caps (₹5,000 to ₹25,000 depending on account type and reporting speed) and required banks to resolve disputes within 90 working days. The 2017 framework covered only "unauthorised" transactions — those initiated without the customer's knowledge or consent. Social-engineering frauds where victims authorised transfers under false pretences fell outside its scope.

Scope of New Protection: Unauthorised vs. Fraudulent Transactions

A critical conceptual distinction in digital banking fraud law: an "unauthorised" transaction is one the customer did not initiate at all (card skimming, SIM swap, hacking). A "fraudulent" transaction is one the customer was deceived into authorising — paying a fake seller, responding to a phishing call, downloading malware. Previous Indian law largely left victims of the second category without structured redress. The 2027 framework closes this gap by explicitly covering fraudulent electronic banking transactions (EBTs) regardless of whether the customer technically "authorised" the transfer.

New Compensation Mechanism (Pilot: July 1, 2026–June 30, 2027)

For the first time, the RBI directly contributes to a consumer fraud compensation pool rather than leaving the full burden on banks. For small-value fraudulent EBTs (gross loss ≤ ₹50,000) reported by an individual to both the bank and the National Cyber Crime Reporting Portal within 5 calendar days: compensation equals 85% of net loss or ₹25,000, whichever is lower. The cost is shared: RBI bears 65%, the customer's bank 10%, the beneficiary bank 10%. The benefit applies once in a lifetime per individual. For losses below ₹29,412, this formula pays out the maximum ₹25,000 cap.

Seven Categories of Regulated Banking Institutions

The Reserve Bank of India, under the Reserve Bank of India Act, 1934 and the Banking Regulation Act, 1949, regulates multiple categories of banks. The 2027 framework applies uniformly to all of them.

Bank Obligations Under the New Framework

Banks must now provide: 24/7 multi-channel fraud reporting (phone, SMS, email, IVR, toll-free); instant SMS alerts for all electronic banking transactions exceeding ₹500; email alerts for all e-banking transactions; board-level transparent customer protection policies; immediate account or card freezing upon complaint; value-dated reversals (backdated to the original transaction date so customers do not lose interest); and detailed rejection notices with supporting logs (OTP records, SMS trails, transaction timestamps) when claims are denied.

Key Facts & Data

• Framework: Amendment to RBI's Customer Liability Directions for Digital/Electronic Banking Transactions
• Effective date: January 1, 2027
• Original framework date: July 6, 2017 (RBI/2017-18/15)
• Draft for public comment: March 6 – June 24, 2026
• Pilot compensation scheme period: July 1, 2026 – June 30, 2027
• Banks covered: 7 categories — Commercial, Small Finance, Payments, Local Area, RRBs, Urban Co-operative, Rural Co-operative
• Key expansion: Now covers fraudulent EBTs (social engineering, phishing) — not just unauthorised transactions
• Compensation for losses up to ₹50,000: 85% of net loss or ₹25,000 (whichever is lower)
• Cost-sharing: RBI 65% + Customer's bank 10% + Beneficiary bank 10%
• Reporting deadline for compensation eligibility: 5 calendar days to both bank and National Cyber Crime Reporting Portal
• Burden of proof: Shifted to bank (must prove customer negligence)
• Complaint resolution deadline: 30 calendar days (was 90 working days)
• Compensation disbursement: Within 5 calendar days of application
• Once-in-a-lifetime benefit: Per individual; corporate entities excluded
• SMS alert mandate: Mandatory for all EBTs above ₹500
• Gap addressed: Frauds above ₹50,000 remain outside structured compensation — key limitation