Synergia Legal is bringing to you a fortnightly compilation of digestible summaries of key legal developments and case laws impacting the business, commercial and economic landscape in India:
Banking / Fintech Laws
1. The Reserve Bank of India (RBI) issues Reserve Bank of India (Credit Information Companies – Miscellaneous) Supervisory Directions, 2026 (July 31, 2026):
The RBI issued the Reserve Bank of India (Credit Information Companies – Miscellaneous) Supervisory Directions, 2026, on July 31, 2026, with immediate effect, requiring all credit information companies (“CICs”) to implement comprehensive, integrated, enterprise-wide and workflow-based technological solutions for effective compliance monitoring. The prescribed solutions must facilitate coordination among business, compliance and information technology functions and senior management; enable the identification, assessment, monitoring and management of compliance requirements; provide for the escalation of non-compliances; record approvals of the competent authority for deviations from or delays in regulatory submissions; and furnish senior management with a consolidated dashboard reflecting the CIC’s overall compliance position. CICs may adopt appropriate tools and mechanisms having regard to the size and complexity of their operations. The Directions also repeal the earlier instructions governing the subject, without affecting any rights, obligations, liabilities, approvals, penalties or proceedings arising thereunder, and shall operate in addition to other applicable laws.
(The Reserve Bank of India (Credit Information Companies – Miscellaneous) Supervisory Directions, 2026 issued by the RBI is accessible here.)
2. The RBI issued the Reserve Bank of India (Credit Information Companies – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026 (July 31, 2026):
The RBI issued the Reserve Bank of India (Credit Information Companies – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, on July 31, 2026, with immediate effect, establishing a comprehensive cybersecurity and technology-risk framework for all credit information companies (“CICs”). The Directions place primary responsibility on the board of directors for approving and annually reviewing information technology, information security, cybersecurity, business continuity and incident-management policies, and require CICs to establish appropriate governance structures, including a board-level IT Strategy Committee, an IT Steering Committee, an Information Security Committee and a suitably qualified Chief Information Security Officer. CICs must implement enterprise-wide IT and information-security risk-management frameworks and baseline controls covering information assets, data protection, network and application security, access management, third-party arrangements, vulnerability testing, audit trails, business continuity, disaster recovery and cyber-incident response. The Directions further require CICs to establish a continuously monitored Cyber Security Operations Centre, report cyber incidents to the RBI through the DAKSH platform within six hours of detection, proactively notify CERT-In and undertake risk-based information systems audits under the oversight of the Audit Committee of the Board. The Directions repeal the earlier cybersecurity and IT-governance instructions applicable to CICs, while preserving actions, liabilities, penalties and proceedings arising thereunder, and operate in addition to other applicable laws.
(The Reserve Bank of India (Credit Information Companies – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026 issued by the RBI is accessible here.)
3. The RBI issued the Reserve Bank of India (All India Financial Institutions – Fraud Risk Management) Directions, 2026 (July 21, 2026):
The RBI issued the Reserve Bank of India (All India Financial Institutions – Fraud Risk Management) Directions, 2026, on July 31, 2026, with immediate effect, establishing a comprehensive framework for the prevention, early detection, investigation and timely reporting of frauds by EXIM Bank, NABARD, NHB, SIDBI and NaBFID. The Directions require each All India Financial Institution (“AIFI”) to adopt a board-approved fraud-risk-management policy, constitute a Special Committee of the Board for monitoring fraud cases and implement robust Early Warning Signal and Red Flagging of Accounts frameworks supported by data analytics and market intelligence. Before classifying any person, entity or account as fraudulent, an AIFI must comply with the principles of natural justice by issuing a detailed show-cause notice, allowing at least 21 days for a response and communicating its decision through a reasoned order. Accounts having an aggregate exposure of ₹3 crore or more must be reported on the CRILC platform within seven days of being red-flagged, while the classification process should ordinarily be completed within 180 days. The Directions further prescribe investigation and staff-accountability requirements, immediate reporting of frauds to the appropriate law-enforcement agencies and submission of Fraud Monitoring Returns to the RBI within 14 days of classification, irrespective of the amount involved. Persons and entities classified as fraudulent are prohibited from raising funds or obtaining additional credit facilities from RBI-regulated financial entities for five years following full repayment or settlement of the defrauded amount. The Directions also mandate periodic legal audits of title documents relating to credit facilities of ₹5 crore or more and repeal the earlier fraud-risk-management instructions applicable to AIFIs, subject to customary saving provisions.
(The Reserve Bank of India (All India Financial Institutions – Fraud Risk Management) Directions, 2026 issued by the RBI is accessible here.)
4. The RBI issued the Reserve Bank of India (All India Financial Institutions – Supervisory Returns) Directions, 2026 (July 31, 2026):
The RBI issued the Reserve Bank of India (All India Financial Institutions – Supervisory Returns) Directions, 2026, on July 31, 2026, with immediate effect, prescribing a consolidated framework for the submission of supervisory returns by EXIM Bank, NABARD, SIDBI, NHB and NaBFID. The Directions require the board and senior management of each All India Financial Institution (“AIFI”) to incorporate data-quality risks into its overall risk-management framework and ensure that its risk-data aggregation and reporting practices are adequately documented, independently validated and supported by appropriate resources. AIFIs must maintain robust data architecture and information-technology infrastructure capable of generating complete, accurate and timely reports, including during periods of stress, integrate reporting processes into their business-continuity arrangements, reconcile supervisory returns with internal and accounting records and establish escalation mechanisms for addressing data-quality deficiencies. Applicable returns must ordinarily be filed through the RBI’s designated online portals and cover domestic and overseas operations, including information relating to assets and liabilities, capital adequacy, operating results, asset quality, large exposures, ownership and control, connected lending, red-flagged accounts, frauds and vigilance matters, within the prescribed timelines. Non-compliance, including the submission of inaccurate information or delayed returns, may attract regulatory action and monetary penalties. The Directions also repeal the earlier instructions governing supervisory returns for AIFIs, while preserving accrued rights, liabilities, penalties and pending proceedings.
(The Reserve Bank of India (All India Financial Institutions – Supervisory Returns) Directions, 2026 issued by the RBI is accessible here.)
5. The RBI issued the Reserve Bank of India (Non-Banking Financial Companies – Responsible Business Conduct) Third Amendment Directions, 2026 (August 06, 2026):
The RBI issued the Reserve Bank of India (Non-Banking Financial Companies – Responsible Business Conduct) Third Amendment Directions, 2026, on August 6, 2026, effective January 1, 2027, introducing comprehensive conduct requirements for the recovery of loan dues and the engagement of recovery agencies by NBFCs, excluding specified categories such as Mortgage Guarantee Companies, Core Investment Companies, NBFC-Account Aggregators and NBFCs without customer interface. The Directions require applicable NBFCs to adopt detailed collection and recovery policies covering escalation procedures, treatment of borrowers facing financial distress, due diligence and monitoring of recovery agencies, codes of conduct and compensation for losses caused by non-compliant recovery action. Recovery agents must undergo prescribed training and obtain certification from the Indian Institute of Banking and Finance, while NBFCs must disclose empanelled recovery agencies on their websites, notify borrowers before in-person recovery visits, restrict information sharing to what is necessary and record recovery-related calls for the prescribed period. The Directions also prohibit coercive, abusive, threatening, intrusive or misleading recovery practices, generally restrict contact with borrowers or guarantors to between 8:00 a.m. and 7:00 p.m. and mandate dedicated grievance-redressal mechanisms. Technology-based restriction of a borrower’s mobile device is permitted only where the NBFC financed that device, subject to express contractual authorisation, prior notice and graduated restrictions commencing only after the loan becomes 30 days past due, with full restrictions permissible only after 60 days; essential functions, including incoming calls, SMS and emergency services, must remain accessible. Such restrictions must be reversed within one hour of realisation of dues, failing which compensation of ₹250 per hour may become payable, subject to the prescribed cap, and neither the NBFC nor its service provider may access personal data stored on the device.
(The Reserve Bank of India (Non-Banking Financial Companies – Responsible Business Conduct) Third Amendment Directions, 2026 issued by the RBI is accessible here.)
6. The RBI issued a press release inviting public comments on Draft Guidelines for ‘on tap’ Licensing of Urban Co-operative Banks (August 06, 2026):
The RBI issued the Draft Guidelines for ‘on tap’ Licensing of Urban Co-operative Banks on August 5, 2026, for stakeholder consultation, proposing a framework under which eligible credit co-operative societies may apply for conversion into Urban Co-operative Banks (“UCBs”). Under the proposed framework, an applicant must have been in existence for at least ten years, maintain deposits of at least ₹10,000 crore and a minimum net worth of ₹300 crore and, during the initial phase, be registered under the Multi-State Co-operative Societies Act, 2002. The applicant must also demonstrate a positive and progressive operating and financial track record during the preceding five years, maintain a capital-to-risk-weighted assets ratio of at least 12% and a net non-performing asset ratio not exceeding 3%, ensure that no member holds more than 5% of its share capital and satisfy the RBI’s fit-and-proper assessment of its board, whose directors cannot discharge executive functions. Applications may be submitted on an ongoing basis through the PRAVAAH portal, together with Form IIIA, a no-objection certificate from the Central Registrar of Co-operative Societies, a conversion resolution approved by the prescribed two-thirds shareholder majority and a detailed and viable business plan addressing, among other matters, financial inclusion, technology, risk management, prudential compliance and the separation of non-banking activities. Applications will undergo preliminary scrutiny, due diligence, inspection and evaluation by the RBI’s Internal Screening Committee before a final decision by the Committee of the Central Board, with an appeal permitted within one month; rejected applicants cannot reapply for three years. An in-principle approval will remain valid for 18 months, during which the applicant must establish the prescribed information-technology, cybersecurity, core-banking and governance infrastructure, following which it must commence banking operations within six months of receiving the final licence. Public and stakeholder comments on the draft have been invited until September 5, 2026.
(The Draft Guidelines for ‘on tap’ Licensing of Urban Co-operative Banks is accessible here.)
Other Laws
7. The Ministry of Electronics and IT issued a press release on Framework to Counter AI-Generated Deepfakes through Legal Safeguards, Platform Accountability and Citizen Protection (July 30, 2026):
The Ministry of Electronics and Information Technology, through a Press Information Bureau release dated July 30, 2026, outlined the Government’s strengthened framework for addressing AI-generated deepfakes through existing statutory safeguards, enhanced intermediary accountability, technological interventions and public awareness initiatives. The framework relies on the Information Technology Act, 2000, which addresses identity theft, impersonation, privacy violations, unlawful content and blocking measures; the Bharatiya Nyaya Sanhita, 2023, which penalises false or misleading information capable of causing public mischief and organised cybercrime; and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, which impose due-diligence, user-notification, content-moderation and grievance-redressal obligations on intermediaries. Amendments to the IT Rules notified on February 10, 2026 require clear labelling and traceable metadata for permissible synthetically generated information, stronger user-awareness measures and deployment of appropriate technical tools to prevent the creation or dissemination of unlawful AI-generated content, including child sexual exploitation material, non-consensual intimate imagery and impersonation-based content. The amendments also reduce the timeframe for removing unlawful information pursuant to a valid government or court direction from 36 hours to three hours, shorten the general grievance-redressal period from 72 hours to 36 hours and require action on specified sensitive complaints within two hours instead of 24 hours. Failure to comply may result in the loss of statutory safe-harbour protection under Section 79 of the IT Act and consequential liability under applicable laws. The Government has also issued targeted advisories and a standard operating procedure concerning unlawful synthetic content and non-consensual intimate imagery, approved 13 responsible-AI projects—including indigenous deepfake-detection tools—and conducted 6,650 cybersecurity-awareness workshops benefiting more than 11.37 lakh participants.
(The Press Release on Framework to Counter AI-Generated Deepfakes through Legal Safeguards, Platform Accountability and Citizen Protection issued by the Ministry of Electronics and Information Technology is accessible here.)
8. The Ministry of Electronics and IT issued a press release on Multi-Pronged Roadmap to Build a Robust Semiconductor Talent Pipeline Across Design, Manufacturing and Advanced Packaging (July 30, 2026):
The Union Cabinet has approved the Mobile Phone Manufacturing Scheme (“MPMS”) with a budgetary outlay of ₹62,500 crore for a five-year period from FY 2026–27 to FY 2030–31. The scheme is intended to scale domestic mobile-phone production, deepen local value addition, strengthen supply-chain resilience, improve global competitiveness and support the development of Indian brands, technology and intellectual property. MPMS will provide differentiated incentives ranging from 2.25% to 5% of eligible sales for mobile phones manufactured in India, an additional incentive of up to 1.5% for domestic sourcing of specified components and sub-assemblies, and a further 3% incentive for product design and research and development by Indian brands. Over its tenure, the scheme is expected to facilitate cumulative mobile-phone production of approximately ₹39 lakh crore, significantly increase exports and generate around 60,000 direct jobs. MPMS follows the conclusion of the Production Linked Incentive Scheme for Large Scale Electronics Manufacturing on March 31, 2026.
(The Press Release on Multi-Pronged Roadmap to Build a Robust Semiconductor Talent Pipeline Across Design, Manufacturing and Advanced Packaging issued by the Ministry of Electronics and Information Technology is accessible here.)
Disclaimer: The compilation in the document is intended to provide general publicly available information. Nothing contained in this document shall be considered or be construed as a legal advice provided by Synergia Legal or any of its members.
Contact Us: For any further information, please send an email at admin@synergialegal.com