MUMBAI: Reserve Bank of India has finalised its consumer protection framework under responsible business conduct guidelines, tightening rules on mis-selling, deceptive digital practices & unauthorised bundling, and shifting to a prescriptive regime.The directions impose a strict consent-capture and interface-design protocol, closing gaps left in the Feb 11 draft. According to the framework, banks must capture explicit consent via verifiable modes such as signed physical/electronic declarations, OTP approvals, recorded confirmations or clearly demarcated agreement clauses.RBI said interfaces must default to ‘No’ or ‘I do not agree’, forcing conscious opt-in. According to the rules, banks must disclose key product terms upfront. These include interest/fees/risks/lock-ins/exit penalties.
Consumer-first approach
The central bank has barred bundled consent. According to the directions, banks must present each product in a separate module, enabling selective choice. Banks must retain consent records for one year after contract end to aid dispute audits.The framework widens agent scope. According to the directions, direct selling and marketing agents now cover all sourcing entities, including business correspondents and loan service providers, and extend to sub-agents at the customer interface. Banks must publish and update empanelled-agent directories within seven days, listing identity, location and permitted products.The central bank eased rules on data access. Seeking device data such as location/camera/contacts will not count as a dark pattern if mandated for compliance and transparently disclosed. The rules also allow voluntary or zero-cost bundles.The directions reaffirm a ban on forced bundling and dark patterns such as basket sneaking, subscription traps, confirm shaming and drip pricing. These include messages such as, “Are you sure you want to miss out on exclusive offers and updates?” or “No, I prefer to stay uninformed about great deals,” implying opting out is unwise.According to the RBI, consent must be active, specific and separately captured, with interfaces built for informed choice. The framework takes effect on Jan 1, 2027, after RBI gave a six-month extension for system upgrades.The RBI said customers can file mis-selling complaints within regulator-set timelines or within 30 days of receiving signed agreements.
