On 24 June 2026, the Reserve Bank of India issued the final version of a rule it had floated three months earlier. The Reserve Bank of India states in its press release that it has issued Amendment Directions which shall come into effect from January 1, 2027, rewriting who bears the loss when money moves out of a customer's account without their say-so. The Reserve Bank of India had first floated the overhaul in a draft released on 6 March 2026, inviting comments from banks and the public through 6 April 2026. Read on its own terms, this is straightforward consumer protection: a regulator closing a loophole where customers who lost money to a stolen password or a fraudulent transfer often had to prove their own innocence before a bank would pay them back.
The mechanism is a genuine reversal. RBI's Amendment Directions place the burden of proving customer negligence on the bank. A customer who reports a loss of up to ₹50,000 within five calendar days is compensated 85 percent of the net loss or ₹25,000, whichever is less. For losses under about ₹29,412, the Reserve Bank itself absorbs 65 percentage points of that payout, the customer's bank another 10, and the beneficiary's bank the last 10. That is a sharp departure from the regime it replaces. RBI's 2017 customer-liability notification capped a customer's own exposure at ₹5,000 to ₹25,000 depending on the account type, and granted zero liability only if the loss was reported within three working days. The new rule extends the reporting window, raises the loss threshold it covers, and flips who has to prove what.
It is worth slowing down on the timing of all this. Bank fraud reported to the RBI jumped 46 percent by value in FY26, to ₹48,021 crore, from ₹32,803 crore in FY25, even as the number of cases fell by more than half, from 23,722 to 10,114: fewer frauds, each one far larger. The category the new customer-liability rules are built to govern is not where that growth sits. Card, internet and digital-payment fraud, the exact channel the Amendment Directions address, collapsed to just 293 cases worth ₹29 crore in FY26, down from 13,332 cases worth ₹517 crore in FY25. Digital fraud's ₹29 crore is barely 0.06 percent of FY26's ₹48,021 crore reported total.
The type of fraud RBI just built new customer protections for makes up six paise of every ten thousand rupees banks reported losing.
The chart below sets the two categories side by side. Card and digital fraud is the sliver getting the toughest new rules; loans are the sliver getting none.
Where the money actually went
Loan and advances fraud, not digital payments, is now the overwhelming share of what banks report losing: ₹40,774 crore in FY26, about 85 percent of the total, more than four times FY24's ₹8,917 crore. That is the real driver of FY26's headline jump, and the Amendment Directions do not touch it. The new liability regime governs "fraudulent electronic banking transactions": money moved out of an account without a customer's authorisation. It has nothing to say about a loan approved on the strength of fabricated collateral or forged documents, which is a lending and underwriting failure, not a customer's carelessness with an OTP.
Loan fraud outgrew digital fraud so completely that the two are barely on the same scale (our calculation from those two rows: ₹40,774 crore against ₹29 crore works out to roughly 1,400 times over). A customer-protection rule sized for the shrinking category leaves the ballooning one entirely outside its scope.
Banks already won concessions once
The three months between the draft and the final rule were not a formality. Between the March draft and the June final rules, RBI stretched the complaint-resolution window from 30 to 45 calendar days for domestic cases, and to 60 for cross-border ones, and pushed the effective date back six months, to 1 January 2027. The core liability shift survived the consultation intact; the process around it did not.
Between draft and final, every resolution window got longer, never shorter.
That is a small tell about how the next eighteen months will go. Consultation periods are where a regulated industry pushes back on cost, not on principle, and banks got real room on timelines without RBI touching the compensation formula or the reversed burden of proof. If that pattern holds, banks facing a rule that leaves them holding 20 percentage points of most small claims, plus the administrative cost of a bank-side negligence inquiry within 45 to 60 days, will likely look for cost relief in the fine print rather than in a fight over the headline protection.
Here is what changed for the ordinary user, set against the rule it replaces:
| 2017 rules (in force through 2026) | 2026 Amendment Directions (from 1 Jan 2027) | |
|---|---|---|
| Who must prove negligence | Effectively the customer, absent a specific finding | The bank |
| Zero-liability window | Report within 3 working days | Compensation formula applies regardless, if reported within 5 calendar days |
| Maximum customer exposure (delayed report) | ₹5,000 to ₹25,000, depending on account type | Customer receives 85% of net loss or ₹25,000, whichever is less, for losses reported within 5 days |
| Who funds the payout | Entirely the customer's own loss, if liable | RBI (65%), customer's bank (10%), beneficiary bank (10%), for losses under about ₹29,412 |
Source: RBI's 2017 customer-liability notification and RBI's 2026 Amendment Directions.
The honest objection
The strongest case for the new rules does not deny any of this and still holds. The Reserve Bank itself, not banks alone, funds most of a small claim's payout: 65 of the 85 percentage points compensated for losses under roughly ₹29,412 come from RBI, not from the bank's balance sheet. That undercuts any reading of this as banks single-handedly being made to pay for someone else's loss. And a modern, reversed-burden liability regime is arguably the right design regardless of this year's fraud mix. Digital-payment fraud is small today partly because banks already tightened controls under pressure from the 2017 rules and years of enforcement, and a regime built to handle a bigger future digital-fraud wave is not wasted simply because the current tally is low. Loosening consumer protection because this year's number happens to be small would be exactly backwards.
That case is real, but it does not explain why the loan-fraud number, four times FY24's and now 85 percent of the total, generated no comparable new liability framework. If RBI's logic is that a growing loss category needs a stronger, faster, more customer-favouring rule, that logic points at loans, not cards. Instead the sharpest new protections landed on the smallest and shrinking piece of the fraud picture, while the biggest and fastest-growing piece got nothing new at all. That piece is one banks and borrowers largely negotiate through underwriting and internal audit, not a five-day compensation clock.
The Signal
The RBI's Amendment Directions are a real, well-designed answer to a question that has mostly stopped being urgent in rupee terms, while the ₹40,774 crore question sits untouched. Two things are worth watching once the rule takes effect on 1 January 2027. First, whether banks respond to a firmer digital-liability floor by tightening transaction limits, adding friction to onboarding, or raising fees, the classic way a regulated cost gets passed to everyone rather than absorbed by the party that caused it. Second, whether RBI eventually turns the same reversed-burden, fast-clock logic on loan and advances fraud, which is where the money problem actually is. Until then, India has one of the world's more customer-favourable digital-fraud liability regimes protecting against a threat that is nearly gone, and no equivalent regime for the one that quadrupled.
Reporting basis: the 24 June 2026 final Amendment Directions and the 6 March 2026 draft are per the Reserve Bank of India's own press releases and the Directions' text. The extension of the resolution window between draft and final is per Moneylife's comparison of the two documents, and rests on that single source. The 2017 liability caps are per RBI's own 2017 notification. FY24 to FY26 fraud counts and values, split between loans/advances and card/internet/digital-payment categories, are per The Hans India and Business Upturn, both citing RBI's Annual Report 2025-26. The share of digital fraud in FY26's total, and the ratio between loan fraud and digital fraud values, are The Signal's calculations from those figures.
