RBI digital banking rules 2026: From 1 January 2026, the Reserve Bank of India’s Digital Banking Channels Authorisation Directions, 2025 are in force, reshaping how banks offer internet and mobile banking across the country. The framework tightens approvals for digital services, requires explicit customer consent, and pushes banks to strengthen cybersecurity and governance around online channels.
Key Highlights
- New framework in force: RBI’s Digital Banking Channels Authorisation Directions, 2025 apply from 1 January 2026 to banks offering internet and mobile banking in India.
- Consent is mandatory: Banks must take explicit, recorded consent before activating or deactivating digital banking for any customer.
- No forced app bundling: Customers cannot be forced to download a mobile app or bundle extra services just to get a debit card or basic account facilities.
- Unified rulebook: Directions bring internet and mobile banking under one authorisation framework, with tougher norms on technology, outsourcing and cyber risk.
- 2FA for all digital payments: Separate RBI directions on authentication for digital payment transactions are scheduled to make two-factor authentication (2FA) mandatory for all domestic digital payments from 1 April 2026, with limited exemptions.
Main Rules: What RBI Has Changed
RBI issued the final Digital Banking Channels Authorisation Directions, 2025 on 28 November 2025. They:
- Replace the earlier patchwork of circulars on internet and mobile banking.
- Cover commercial banks and specified co-operative banks that provide digital banking channels.
- Distinguish clearly between:
- View-only access (checking balances, mini statements, etc.), and
- Transactional access (fund transfers, bill payments, opening fixed deposits, etc.).
To offer full transactional digital banking, a bank must now demonstrate that it has:
- A robust core banking system and modern, IPv6-ready infrastructure.
- Strong track record on regulatory compliance and cybersecurity.
- Documented policies on IT systems, outsourcing, vendor risk, business continuity and incident response.
- Board-approved risk management and audit mechanisms dedicated to digital operations.
Only after RBI is satisfied with these conditions can a bank roll out or significantly expand digital channels.
Customer-Facing Changes
1. Consent-First Digital Banking
- Banks must obtain clear, documented consent when:
- Registering a customer for internet or mobile banking, or
- Deregistering / disabling these services.
- Terms and conditions must be presented in simple language and must clearly explain:
- What services are being activated;
- What charges may apply;
- Customer responsibilities and grievance redress options.
In short, a bank can no longer quietly “auto-activate” digital channels without properly informing you.
2. No Forced App Downloads or Bundled Services
- A customer cannot be compelled to:
- Download a bank’s mobile app, or
- Opt into internet banking,
just to: - Get a debit card, or
- Access basic account facilities.
- Digital channels must be offered as an option, not a condition for core banking services.
3. Controls on Third-Party Product Selling
- Inside internet or mobile banking, banks must treat third-party products (insurance, mutual funds, etc.) in line with RBI’s distribution norms.
- The framework tries to ensure that digital banking remains banking-first, not an uncontrolled marketplace for unrelated products.
4. Alerts, Transparency and Access
Banks are expected to:
- Send SMS/email alerts for both financial and key non-financial actions (password reset, profile changes, etc.).
- Provide multiple options for registration and de-registration (branch, online, call centre, etc.) so that customers are not forced into a single channel.
- Disclose security features, limits and liability clearly, including how to report fraud or unauthorised transactions.
Cybersecurity, Governance and 2FA
The Directions push banks to treat digital operations as core risk areas, not side channels. Key requirements include:
- Board-level oversight of digital banking strategy and risk.
- Regular independent IT and cybersecurity audits, including by CERT-In-empanelled auditors where prescribed.
- Use of transaction limits, anomaly detection, device-binding and other controls to reduce fraud.
Separately, RBI’s authentication directions for digital payment transactions (effective 1 April 2026) will:
- Require two-factor authentication (2FA) for all domestic digital payments (UPI, cards, net banking, wallets, etc.), subject to clearly defined exceptions (for example, some low-value or recurring transactions where RBI permits relaxed factors).
- Insist that at least one factor is dynamic and unique to each transaction (such as OTP, token, CVV equivalent).
- Hold issuers responsible for making customers whole where unauthorised transactions occur because the mandated authentication framework was not followed.
Together, these rules are meant to reduce phishing, app-hijack, and other cyber-fraud risks.
What This Means For Customers in J&K and Across India
For ordinary users—from metros to remote districts in Jammu & Kashmir—the new framework has practical implications:
- More choice on how you bank
- You can insist on using branch + ATM only, or internet banking without the app, if that suits your connectivity and comfort.
- Banks cannot deny you a basic account or a debit card just because you do not want their mobile app.
- Greater clarity and control
- You should see explicit consent screens or forms when activating or deactivating digital channels.
- Any unexpected activation or change can be challenged with reference to RBI’s consent requirements.
- Stronger fraud protection
- More transaction alerts mean you can quickly spot and report suspicious activity.
- From April 2026, mandatory 2FA on payments should reduce unauthorised debits if you keep your credentials and device secure.
- Better fit for low-connectivity regions
- In areas such as Kashmir, Chenab Valley or Pir Panjal, where mobile data is patchy, a more balanced approach between branch, ATM, internet and app channels can make banking more accessible.
- Customers can use digital channels where feasible, without being locked out of services when connectivity drops.
FAQs: RBI’s New Digital Banking Rules
The Digital Banking Channels Authorisation Directions, 2025 are effective from 1 January 2026. They govern how banks offer and expand internet and mobile banking channels.
No. Under the new framework, banks cannot force you to download a mobile app or bundle digital services as a precondition for issuing a debit card or giving basic account facilities.
They primarily apply to banks (commercial and specified co-operative banks). Wallets, fintech apps and NBFCs are covered by separate RBI norms, but banks must ensure that any third-party arrangements comply with the applicable regulations.
From 1 April 2026, RBI’s authentication directions are scheduled to make 2FA mandatory for all domestic digital payment transactions, with at least one dynamic factor unique to each transaction and clearly specified exceptions only where RBI permits.
Review the digital banking terms shared by your bank (email/SMS/website).
Ensure SMS/email alerts are enabled on your accounts.
Enable and use 2FA wherever it is offered.
If any digital service was activated without your clear consent, raise a complaint with the bank and, if needed, with the banking ombudsman or RBI’s complaint portal.
Disclaimer
This article summarises RBI’s new digital banking and authentication frameworks for general awareness. It is not financial, legal or investment advice.
Regulations may be updated, and implementation can vary by bank. Customers should:
- Refer to the latest RBI circulars and their own bank’s official communications, and
- Consult a qualified professional before making changes to their banking or digital payment behaviour.
http://www.kittonews.com does not accept responsibility for any loss or inconvenience arising from actions taken solely on the basis of this report.
