Banking

1. Introduction

The Reserve Bank of India has introduced a revised regulatory framework governing customer protection in fraudulent electronic banking transactions through its Amendment Directions dated 24 June 2026.

The reform is significant because it moves beyond the earlier framework, which principally dealt with unauthorised electronic banking transactions, and expressly covers a broader range of fraudulent electronic banking transactions.

The revised framework seeks to balance three objectives:

• Protect genuine victims of electronic banking fraud.
• Establish accountability of banks for negligence and deficiencies in banking systems.
• Define the circumstances in which customers themselves must bear the loss arising from fraudulent transactions.

The directions have been issued under Section 35A of the Banking Regulation Act, 1949, and become effective for transactions undertaken on or after 1 January 2027. Track RBI +1

2. Regulatory instruments

The RBI issued seven separate amendment directions covering:

• Commercial Banks
• Small Finance Banks
• Payments Banks
• Local Area Banks
• Regional Rural Banks
• Urban Co-operative Banks
• Rural Co-operative Banks

For commercial banks, the principal instrument is:

The directions replace the earlier paragraphs 64–76 dealing with limitation of customer liability with a revised framework. Track RBI +1

3. Scope of the expression Electronic Banking Transaction (EBT)

The revised directions use the expression Electronic Banking Transaction and cover fraudulent transactions through electronic banking channels.

The practical areas include:

• Internet banking fraud.
• Mobile banking fraud.
• UPI transactions and fraudulent payment instructions.
• Debit and credit card fraud.
• Card-not-present transactions.
• ATM-related electronic fraud.
• Transactions arising from phishing, impersonation and compromise of electronic banking credentials.

The important distinction is that a fraudulent transaction is not necessarily confined to a transaction which the customer expressly denies authorising. The nature of the fraud, the transaction channel, the customer’s conduct and the responsibility of the bank or another participant must all be examined.

4. Bank’s obligation to formulate a customer protection policy – Paragraph 76A

Every bank must formulate a policy addressing:

• Channels for alerting customers about electronic banking transactions.
• Rights and obligations of customers.
• Risks arising from customer negligence, bank negligence, banking system fraud and third-party breaches.
• Time limits for complaint resolution.
• Disclosure of decisions to customers.
• Continuous customer awareness regarding emerging electronic payment frauds.

Legal significance: A bank’s internal policy is no longer merely an administrative document. Its compliance with the RBI directions becomes relevant when determining whether the bank has discharged its regulatory obligations.

A bank cannot rely upon an internal policy to dilute a mandatory protection granted by the RBI directions.

5. Mandatory transaction alerts – Paragraphs 76C to 76F

The RBI has prescribed additional safeguards concerning transaction alerts.

SMS and email alerts are additional to other notification methods such as mobile-app notifications and push alerts. Track RBI +1

Litigation implication: Where a customer alleges that no transaction alert was received, the bank should be able to produce the relevant notification logs, delivery records and registered contact details. Merely generating an SMS at the bank’s end may not conclusively establish that the customer received it.

6. Reporting of fraudulent transactions – Paragraph 76G

The bank must facilitate reporting of fraudulent EBTs through 24×7 channels, including:

• Phone banking.
• SMS.
• Instant messaging.
• Dedicated email.
• IVR.
• Dedicated toll-free helpline.
• Reporting to the home branch.

The transaction alert SMS must also contain a number to which the customer can immediately send an objection.

Customers should be advised to report the fraud to the bank and lodge a complaint through the National Cyber Crime Reporting Portal or Helpline 1930 at the earliest. Track RBI +1

Practical advice: A victim should not wait for a police FIR before informing the bank. The bank notification and cybercrime complaint should be made immediately, with acknowledgement numbers preserved.

7. Burden of proof – Paragraph 76K

Major legal development

The RBI expressly provides:

The burden of proving customer liability in complaints involving fraudulent EBTs shall lie on the bank.

The bank must examine and classify each complaint under the relevant categories of electronic banking transactions. Track RBI +1

This provision has considerable significance in consumer disputes and other proceedings against banks.

Practical consequences:

• The bank must establish the circumstances supporting its allegation of customer negligence.
• The bank should preserve authentication and transaction records.
• The mere fact that a transaction was authenticated using OTP, PIN or another security credential should not, by itself, be treated as conclusive proof of customer negligence.
• The bank’s decision should be based on evidence and the applicable regulatory classification.

The burden of proof provision does not mean that every fraudulent transaction must automatically be reimbursed. It requires the bank to establish customer liability where it seeks to attribute the loss to the customer.

8. Three principal categories of liability – Paragraphs 76L to 76O

THE NEW LIABILITY FRAMEWORK

Category I – Bank negligence

Zero liability

Where fraud occurs due to negligence or deficiency on the part of the bank, the customer is entitled to zero liability and reversal of the transaction, irrespective of when it is reported.

Paragraph 76L

Category II – Third-party breach

Zero liability if timely reported

Where the breach lies with a third party, neither the bank nor the customer, reporting to the bank within five calendar days from occurrence gives the customer zero liability and reversal.

Paragraph 76M

Category III – Customer negligence

Limited protection

Where fraud occurs due to customer negligence, the customer bears the loss not eligible for compensation under paragraph 76T, until reporting the fraud to the bank.

Paragraph 76N

Subsequent transactions – Paragraph 76O

Any unauthorised transaction occurring after the customer reports the fraudulent EBT to the bank must be borne by the bank.

An important distinction is that reporting within five days under paragraph 76M gives zero liability in a third-party breach case, whereas the compensation mechanism under paragraph 76T is a separate, limited benefit subject to its own eligibility requirements.

9. Comparative liability table

The distinction between customer negligence and third-party breach is likely to be one of the most contested issues under the new framework. Track RBI +1

10. Compensation for small-value fraudulent transactions – Paragraph 76T

This is a particularly important innovation.

85% Compensation of net loss, subject to ₹25,000 maximum

Maximum gross loss ₹50,000

Maximum compensation ₹25,000

Claim frequency

Once in lifetime

Reporting deadline

5 calendar days

Eligibility requirements

The final commercial-bank directions provide for compensation to a bona fide individual victim, including a sole proprietor, where:

• Gross loss is up to ₹50,000.
• The fraudulent transaction falls within paragraph 76N, concerning customer negligence.
• The loss is established as bona fide under the bank’s internal policy.
• The customer reports the fraud both to the bank and through the National Cyber Crime Reporting Portal or Helpline 1930 within five calendar days of occurrence.
• The customer has not previously availed this lifetime benefit.

In joint accounts, only one account holder can claim the compensation. A person who claims as a joint account holder cannot subsequently claim the benefit in an individual capacity, and vice versa. Track RBI +1

Important legal clarification: This compensation is not a general guarantee of 85% reimbursement for every digital fraud. It is a limited benefit under the specified eligibility conditions. In particular, it should not be confused with the zero-liability protection for bank negligence and timely reported third-party breaches.

11. Compensation illustrations

The following examples assume that no recovery has been made.

The formula is:

\text{Compensation}=\min(85\%\times\text{Net Loss}, ₹25,000)

Net loss is calculated after deducting recoveries made before or after compensation.

Example: A customer loses ₹40,000. The bank recovers ₹10,000 before compensation.

Net loss = ₹30,000.

Compensation = 85% of ₹30,000, subject to ₹25,000 cap.

Therefore, compensation = ₹25,000.

12. Sharing of compensation between RBI and banks

The compensation-sharing arrangement is intended to distribute the financial burden.

These percentages apply to the compensation contribution mechanism for the relevant lower-loss cases; for losses of ₹29,412 or more, the prescribed fixed contributions apply where compensation reaches ₹25,000.

The customer’s entitlement is determined by paragraph 76T, not by the internal allocation of contributions between RBI and banks. Business News - The Indian Express +1

Part IV – Complaint investigation and bank obligations

13. Disposal of complaints – Paragraph 76Q

The bank must examine the complaint, determine liability and communicate its decision within the prescribed period.

Domestic fraud complaints

45 days

Cross-border fraud complaints

60 days

Maximum periods from receipt of complaint by the bank, not a target period.

The bank’s policy may prescribe a shorter period, but cannot exceed the applicable maximum.

Where zero liability applies, the bank’s response must include details of reversal. Where compensation is applicable, the response must include the relevant compensation details. Track RBI +1

14. Value-dated reversal and shadow reversal – Paragraph 76R

The revised directions contain two important safeguards.

A. Value-dated reversal

Where the bank is required to reverse a fraudulent transaction:

• Reversal must carry the original date of the transaction.
• The customer should not suffer loss of interest.
• No additional interest or charges should be imposed on the customer because of the fraudulent debit.

B. Credit card shadow reversal

In a credit card fraud complaint, the bank must provide a shadow reversal equivalent to the fraudulent amount within five calendar days of receiving notification from the customer.

This is a provisional reversal pending the complaint investigation. It should not be confused with the final determination of the dispute. Track RBI +1

15. Reasoned rejection of claims – Paragraph 76S

Where the bank rejects a complaint on the ground that customer liability has been established, it must disclose:

• Reasons for rejection.
• Supporting details, where applicable.
• The material relied upon in determining customer liability.

This provision is important in disputes where banks issue standard rejection letters stating only that the transaction was authenticated.

My legal interpretation: A reasoned decision should explain how the evidence establishes the particular category of liability. A generic statement that the transaction was processed using valid credentials may not adequately address the burden imposed by paragraph 76K.

16. Important evidence to be preserved by banks

For effective compliance and litigation defence, banks should maintain the following records:

A bank should also preserve records relating to the customer’s registered mobile number, email address and any changes made to those particulars.

Part V – Practical case studies

The following hypothetical cases illustrate how the revised provisions may operate.

Case Study 1 – UPI fraud through phishing

Facts

A customer receives a fraudulent link purporting to be from his bank. He enters his UPI PIN on a fake interface. ₹35,000 is transferred to an unknown beneficiary.

The customer immediately informs the bank and files a cybercrime complaint within five days.

Issues

• Whether the case involves customer negligence or third-party breach.
• Whether the customer knowingly authorised the payment.
• Whether the bank can establish the customer’s liability.
• Whether paragraph 76T compensation is available.

Legal analysis

The bank must investigate the circumstances and classify the transaction. The fact that the customer entered a PIN is relevant evidence, but the bank must establish customer liability under paragraph 76K.

If customer negligence is established and the other paragraph 76T conditions are fulfilled, the compensation may be ₹25,000 (85% of ₹35,000 is ₹29,750, subject to the cap).

If the facts instead establish a third-party breach without customer negligence, timely reporting under paragraph 76M may give the customer zero liability.

Case Study 2 – Fraud due to bank’s system deficiency

Facts

A customer’s account is debited by ₹1,20,000 through a fraudulent electronic transaction. The investigation reveals that the bank’s security controls were deficient and the customer did not contribute to the fraud.

Legal position

Paragraph 76L provides zero customer liability where fraud occurs due to negligence or deficiency on the part of the bank.

There is no requirement under this paragraph that the customer must report the transaction within five days to obtain zero liability.

The bank must reverse the fraudulent transaction and ensure that the customer does not suffer the associated interest or charges.

Case Study 3 – Customer reports fraud after six days

Facts

A customer discovers that ₹45,000 has been fraudulently transferred from his account. He reports the incident to the bank six calendar days after occurrence.

Legal position

If the case involves third-party breach, paragraph 76M provides that the customer’s liability will be determined according to the bank’s policy.

If customer negligence is established, paragraph 76N and the compensation mechanism must be examined separately. The five-day condition for paragraph 76T compensation must also be satisfied.

The bank cannot simply treat every delayed report as proof of customer negligence.

Case Study 4 – Multiple fraudulent transactions after notification

Facts

A customer reports a fraudulent transaction of ₹20,000 to the bank at 10 AM. A further ₹15,000 is debited at 11 AM through the same fraud mechanism.

Legal position

Under paragraph 76O, the loss arising from an unauthorised transaction occurring after reporting the fraud to the bank must be borne by the bank.

The bank should not attribute the subsequent transaction to the customer’s earlier negligence.

Case Study 5 – Fraudulent credit card transaction

Facts

A customer receives an alert for a fraudulent credit card transaction of ₹75,000 and immediately disputes it.

Legal position

Under paragraph 76R, the bank must provide a shadow reversal equivalent to the disputed amount within five calendar days of receiving notification.

The bank must investigate the complaint and determine liability within the applicable complaint-disposal period.

Part VI – Litigation strategy

17. Arguments on behalf of customers

The following grounds may be relevant in a consumer complaint or other appropriate proceeding:

Ground I – Failure to discharge the burden of proof

The bank has failed to establish customer negligence as required under paragraph 76K.

Ground II – Deficiency in banking security

The fraudulent transaction occurred due to negligence or deficiency in the bank’s electronic banking infrastructure, attracting paragraph 76L.

Ground III – Timely reporting

The customer reported the fraudulent transaction within five calendar days, and the circumstances constitute a third-party breach under paragraph 76M.

Ground IV – Failure to reverse the transaction

The bank has failed to restore the amount despite the customer being entitled to zero liability.

Ground V – Failure to provide a reasoned decision

The bank rejected the complaint without supplying adequate reasons and supporting evidence, contrary to paragraph 76S.

Ground VI – Failure to provide shadow reversal

In a credit card fraud complaint, the bank failed to provide shadow reversal within five calendar days, contrary to paragraph 76R.

Ground VII – Non-payment of eligible compensation

The bank failed to consider the customer’s eligibility under paragraph 76T despite fulfilment of its prescribed conditions.

18. Arguments on behalf of banks

Banks should also prepare to defend complaints through a properly documented investigation.

Potential grounds include:

• The evidence establishes customer negligence under paragraph 76N.
• The customer failed to protect confidential payment credentials.
• The customer did not report the incident within the stipulated period.
• The circumstances do not establish a third-party breach within paragraph 76M.
• The customer has failed to satisfy the conditions for compensation under paragraph 76T.
• The claimed amount has already been recovered, wholly or partly.
• The claim is not bona fide or does not meet the regulatory eligibility requirements.

However, banks must support these grounds with evidence and cannot rely exclusively on standardised rejection letters.

19. Forum and remedies available to customers

Depending on the nature of the grievance and the relief sought, a customer may consider the following remedies:

Important: A customer should ordinarily first lodge a complaint with the concerned bank. An eligible complaint may be taken to the RBI Ombudsman if the bank rejects it, gives an unsatisfactory response, or does not respond within 30 days, subject to the Scheme’s requirements. The RBI Ombudsman route and consumer proceedings should be considered in light of applicable maintainability and parallel-proceeding restrictions.

Part VII – Compliance checklist for banks

20. Action points before 1 January 2027

Every bank should undertake a compliance review before commencement.

Bank implementation tracker

0/14 completed

Obtain Board approval for revised customer protection policy

Revise customer liability and fraud classification procedures

Establish 24×7 fraud reporting facilities

Provide SMS objection facility in transaction alerts

Ensure mandatory SMS alerts for EBTs above ₹500

Verify registered mobile numbers and email addresses

Develop procedures for five-day reporting cases

Establish compensation processing under paragraph 76T

Implement 45-day and 60-day complaint monitoring

Implement five-day credit card shadow reversal

Preserve authentication, device and transaction logs

Train branch managers and customer-service personnel

Establish an internal appeal and escalation mechanism

Introduce periodic Board-level fraud complaint monitoring

Reset checklist

21. Special implications for Regional Rural Banks

The revised directions separately cover Regional Rural Banks.

This is particularly relevant for rural banking customers who frequently use:

• Kisan Credit Card accounts.
• RuPay debit cards.
• UPI and mobile banking.
• Aadhaar-enabled payment systems.
• Business Correspondent banking facilities.

Regional Rural Banks should ensure that their customer protection policies cover fraud reporting through branches and accessible digital channels.

For Punjab Gramin Bank and other RRBs, the implementation should include specific instructions to branch managers concerning the preservation of transaction records, reporting acknowledgements and escalation of fraud complaints.

The separate RRB amendment should be consulted rather than mechanically applying the commercial-bank notification. Track RBI +1

Part VIII – Important interpretative questions

22. Issues likely to arise before courts and consumer commissions

23. My observations on the likely development of banking litigation

Five issues deserve particular attention.

1. Authentication versus authorisation

A successful authentication does not necessarily answer every question concerning the customer’s knowledge, consent or negligence. Courts may need to distinguish technical authentication from informed authorisation.

2. Evidentiary burden

Paragraph 76K provides a specific regulatory basis for requiring banks to establish customer liability. The quality of transaction logs and forensic investigation will therefore become increasingly important.

3. Responsibility of beneficiary banks

The compensation-sharing arrangement recognises the role of the beneficiary bank in domestic fraud cases. However, this should not be confused with a final determination of its civil or regulatory liability in every fraud.

4. Customer negligence

This may become the principal area of litigation. There is a difference between voluntarily sharing credentials, being deceived through impersonation and being induced to approve a transaction through coercion.

5. Bank’s internal policies

Banks will need to ensure that their Board-approved policies do not impose conditions inconsistent with the mandatory RBI directions.

These are prospective legal issues, not settled judicial propositions under the new framework.

Part IX – Important related RBI development

24. Fraud Risk Management Directions, 2026

The above customer protection directions should be read alongside the separate RBI Fraud Risk Management Directions, 2026, issued on 31 July 2026.

These deal with a broader institutional framework, including:

• Governance and oversight of fraud risk.
• Early Warning Signals (EWS).
• Red Flagged Accounts (RFA).
• Fraud detection and reporting.
• Independent confirmation from third-party service providers.
• Staff accountability and internal controls.

These are separate regulatory instruments. The customer protection directions address liability and compensation in fraudulent electronic transactions, whereas the Fraud Risk Management Directions address institutional fraud-risk management. LTNR +1

Part X – Concluding legal opinion

25. Conclusion

The RBI’s revised framework represents a significant development in the law governing the relationship between banks and customers in electronic banking transactions.

Its most important feature is the express placement of the burden of proving customer liability upon the bank. The framework also establishes zero-liability situations, a limited compensation mechanism for eligible small-value frauds, mandatory complaint-resolution timelines and a specific provisional reversal requirement for credit card fraud.

However, the directions do not create an unconditional right to reimbursement for every digital fraud. The outcome will depend upon the classification of the fraud, the conduct of the customer, the bank’s responsibility, the reporting period and compliance with the prescribed conditions.

For banking litigation practitioners, the real importance of this framework will lie in the evidence required to establish customer negligence, bank deficiency and third-party breach.

My recommendation: Every bank should revise its Board-approved customer protection policy before 1 January 2027, and every advocate handling banking disputes should familiarise themselves with paragraphs 76K to 76T.

Reference material and official sources

• RBI Press Release – 24 June 2026: Review of Framework of Limiting Customer Liability in Digital Transactions⁠.
• RBI Commercial Banks – Responsible Business Conduct Third Amendment Directions, 2026⁠.
• Text of paragraphs 76K–76T: Liability and compensation provisions⁠.
• RBI Local Area Banks Amendment Directions, 2026⁠.
• RBI Fraud Risk Management Directions, 2026⁠.