The Reserve Bank of India (RBI) has issued directions on borrowing through apps, paying online and recovering from fraud. This is a summary as at 20 September 2026.
1. Digital Lending Directions, 2025
Issued on 8 May 2025 (RBI/2025-26/36), these bind banks, NBFCs and certain other regulated lenders. Lending apps are covered through the lender they work for. Key features include:
- A Key Fact Statement, so you see the full cost of the loan before you accept.
- A cooling-off period in which you can exit the loan by repaying the principal and proportionate interest.
- Loan disbursal to your bank account, and repayment from it, directly with the regulated lender and not through the app.
- Reporting of digital lending apps by lenders, and a public directory of apps.
2. Authentication for digital payments
The Authentication Directions of 25 September 2025 (RBI/2025-26/79) apply to banks and non-banks in the payments system. From 1 April 2026, a payment needs two distinct factors, at least one of them generated dynamically, unless an exemption applies. Cross-border card payments without the card present were due later, on 1 October 2026. Issuers must compensate customers for losses caused by their own non-compliance.
3. Customer liability for fraud: the revised framework
The 2017 circular limits a customer’s liability for unauthorised electronic transactions. It gives zero liability for a third-party breach reported within three working days. RBI issued Amendment Directions on 25 June 2026. Reports say they apply from 1 January 2027 to banks, and include:
- Compensation of 85 per cent of the net loss, or ₹25,000 if lower, for small-value frauds up to ₹50,000, available once.
- Reporting to the bank and to helpline 1930 or the cybercrime portal within five days.
- SMS alerts for transactions above ₹500, and set complaint timelines.
We have read these terms through press reports. Check RBI’s own text. The 2017 rules apply until the new ones start.
4. A draft on suspected mule accounts
On 11 September 2026 RBI published a draft procedure for suspected mule accounts. It would allow temporary debit holds for up to 60 days. Comments close on 2 October 2026, and the proposed start is 1 April 2027. It is a draft and binds no one yet.
What to do now
- Before you borrow through an app, check that a regulated lender stands behind it. Read the Key Fact Statement.
- Report any unauthorised transaction at once. Call your bank and helpline 1930, and keep the reference numbers.
- Do not share OTPs, even if the caller seems to be from your bank.
Key takeaway
Speed of reporting decides your protection, now and under the revised framework. Report to your bank and to 1930 within days, not weeks.