Digital banking cannot be made mandatory to access other services: RBI

RBI's new digital banking rules mandate explicit customer consent, prohibit banks from forcing digital channels for accessing other services and tighten risk controls

The Reserve Bank of India (RBI) on Friday issued its final instructions on digital banking channels, stating that banks must obtain explicit consent from customers before providing digital banking services. The central bank further said that the lenders cannot make it mandatory for customers to opt for any digital banking channel in order to avail other facilities, such as debit cards.

 

“While it may be more convenient for the customer to opt for some services together (for example, virtual access to card controls), the choice to apply for digital banking facilities shall lie solely with the customer,” the RBI said.

 

However, banks can continue to obtain and record customers’ mobile numbers to send transaction alerts and meet KYC (know your customer) requirements at the time of account opening.

 

Additionally, the central bank has allowed banks to put in place appropriate risk mitigation measures — such as transaction limits, transaction velocity limits, and fraud checks — in line with their internal policies based on their risk perception.

 

The RBI has also mandated that banks implement risk-based transaction monitoring and surveillance mechanisms. “Study of customer transaction behaviour patterns and monitoring unusual transactions or obtaining prior confirmation from customers for outlier transactions may be incorporated in the systems in accordance with the Fraud Risk Management Policy of the bank,” it said.

 

Digital banking channels refer to services offered by banks through websites (internet banking), mobile phones (mobile banking), or other electronic platforms that allow customers to carry out financial and banking transactions with a high level of automation and seamless service.

 

The central bank has further mandated that banks offering mobile-banking services ensure that customers across all mobile network operators can access the services.

 

“Third-party products and services, including those of promoter groups or bank group entities (subsidiaries/joint ventures/associates), shall not be displayed on banks’ digital banking channels except as specifically permitted by the Reserve Bank,” the RBI said.

 

According to the RBI, banks must put in place a comprehensive policy for digital banking channels, taking into account all statutory and regulatory requirements, including those relating to the management of liquidity and operational risks in a digital banking environment. The responsibility for overseeing the management of risks arising from these facilities will remain with the senior management of the lender.

 

The RBI has said that banks will need to obtain its prior approval before launching transaction banking facilities, subject to the fulfilment of prescribed criteria. Transaction banking is a feature of digital banking channels through which all fund-based or non-fund-based banking services can be provided. 

New guidelines 

• Explicit consent: Banks must obtain customers’ clear consent before activating any digital banking channel
• Mobile numbers allowed: Banks may collect customers’ mobile numbers for alerts and KYC
• Risk controls: Banks may set transaction caps, velocity limits, and fraud-check measures based on internal policies
• Mandatory monitoring: Risk-based transaction surveillance required; banks must flag unusual behaviour and seek prior confirmation for outlier transactions
• Network-independent access: Mobile banking must work across all mobile networks
• No third-party product displays: Banks cannot show third-party 
• or group-company products on digital channels unless RBI permits