Reserve Bank of India (Commercial Banks - Responsible Business Conduct) Third Amendment Directions, 2026

The Reserve Bank of India issued the Third Amendment to the RBI (Commercial Banks — Responsible Business Conduct) Directions, 2025, on June 24, 2026, with pr...

What Happened

The Reserve Bank of India issued the Third Amendment to the RBI (Commercial Banks — Responsible Business Conduct) Directions, 2025, on June 24, 2026, with provisions effective from January 1, 2027.
The amendment introduces standardised definitions for electronic banking transactions (EBTs), including "Card Not Present," "Card Present," "Fraudulent EBT," and "Unauthorised EBT."
Banks are mandated to send SMS alerts for all transactions above ₹500 and email alerts for all EBTs where contact details are available, containing details such as account/card number, amount, date, time, and transaction channel.
A revised liability framework establishes zero-liability for customers when fraud stems from bank negligence or third-party breaches reported within five calendar days; customers bear liability only for their own negligence.
Compensation for eligible customers is capped at 85% of net loss (maximum ₹25,000 per lifetime claim) for verified losses up to ₹50,000, with the RBI covering 65–76% of compensation amounts and beneficiary banks contributing proportionally.
Banks must resolve domestic complaints within 45 days and cross-border complaints within 60 days, with the burden of proof resting on the institution.

Static Topic Bridges

RBI (Commercial Banks — Responsible Business Conduct) Directions, 2025

The Responsible Business Conduct (RBC) Directions were issued by the RBI under Section 35A of the Banking Regulation Act, 1949, which empowers the RBI to issue binding directions to any banking company in the public interest, to prevent affairs being conducted in a manner detrimental to depositors, or to secure proper management. The original RBC Directions, 2025, issued on November 28, 2025, consolidated and strengthened regulatory instructions relating to customer service and fair conduct across commercial banks. The Third Amendment builds on this framework specifically to address the growing volume and complexity of digital/electronic banking fraud.

Legal authority: Section 35A, Banking Regulation Act, 1949.
The Directions apply uniformly across all scheduled commercial banks (excluding Regional Rural Banks, Small Finance Banks, and Payments Banks, which have separate parallel directions).
RBC Directions consolidate earlier circulars on customer service, fair practices code, grievance redressal, and KYC/AML requirements under a single framework.
Similar Third Amendment Directions have been issued in parallel for Local Area Banks, Small Finance Banks, and Regional Rural Banks.

Connection to this news: The Third Amendment operationalises electronic transaction liability rules under the consolidated RBC framework, replacing earlier piecemeal circulars on limited liability in unauthorised EBTs.

Customer Liability in Unauthorised Electronic Banking Transactions

Customer liability norms for unauthorised digital transactions were first codified by the RBI in a 2017 circular and have since been progressively tightened. The principle is that when fraud is attributable to bank-side negligence or systemic vulnerability, the customer must be made whole. The 2026 amendment sharpens this by specifying a tiered framework: zero liability for bank-negligence or third-party breach (if reported within five days), and proportional liability for customer negligence.

Zero liability: triggered when the bank's own systems are compromised, or a third-party intermediary (payment gateway, telecom provider) is breached and the customer reports within five calendar days.
Customer negligence: if a customer shares credentials or fails to safeguard authentication factors, liability may rest with the customer until reporting.
Compensation ceiling: 85% of net loss up to a maximum of ₹25,000 per lifetime claim for losses up to ₹50,000.
Complaint resolution: 45 days (domestic), 60 days (cross-border).
Burden of proof is on the bank, not the customer.

Connection to this news: The Third Amendment introduces standardised definitions and a clear burden-of-proof allocation, closing interpretive gaps that previously allowed banks to delay or deny compensation.

Digital Payments Architecture and Fraud Typology

India's digital payments ecosystem is regulated by the RBI under the Payment and Settlement Systems Act, 2007, and the National Payments Corporation of India (NPCI) operates key retail payment systems including UPI, IMPS, NACH, and RuPay. "Card Not Present" (CNP) transactions — where the physical card is not used and only credentials are entered online — are disproportionately targeted in fraud because authentication relies on static data such as card numbers and CVVs. The amendment's definitional clarity on CNP vs. Card Present transactions directly strengthens the fraud-type classification that determines liability.

NPCI was established under the Payment and Settlement Systems Act, 2007, and functions as an umbrella organisation for retail payments.
UPI processed over 13 billion transactions per month in 2025 — the world's largest real-time retail payments system by volume.
CNP fraud is the dominant category in card-based digital fraud globally.
Mandatory SMS alerts above ₹500 aim to enable early detection and the five-day reporting window for zero-liability claims.

Connection to this news: The amendment's definitional framework aligns with the typology of fraud actually occurring in India's digital payments stack, enabling more consistent adjudication of customer complaints.

Key Facts & Data

Legal basis: Section 35A, Banking Regulation Act, 1949.
Notification date: June 24, 2026; effective date of new provisions: January 1, 2027.
SMS alert threshold: transactions above ₹500.
Zero-liability window for third-party breach reporting: five calendar days.
Compensation cap: 85% of net loss, maximum ₹25,000 per lifetime claim, for verified losses up to ₹50,000.
RBI contribution to compensation: 65–76% of the compensated amount.
Domestic complaint resolution deadline: 45 days; cross-border: 60 days.
Burden of proof: rests on the bank, not the customer.
Parallel amendments issued for Local Area Banks, Small Finance Banks, and Regional Rural Banks under equivalent Responsible Business Conduct Directions.