The Reserve Bank of India has amended its Responsible Business Conduct Directions for rural co-operative banks, replacing the earlier framework on limiting customer liability in unauthorised electronic banking transactions with a broader customer protection regime for fraudulent electronic banking transactions. The revised rules apply to electronic banking transactions undertaken on or after January 1, 2027. Rural co-operative banks must now bear the burden of proving customer liability, give customers zero liability where fraud results from the bank’s negligence, and provide zero liability in third-party breach cases if the customer reports the transaction within five calendar days. The amendments introduce new definitions for electronic banking transactions, fraudulent and unauthorised electronic banking transactions, customer negligence, bank negligence, third-party breach and shadow reversal. Banks must verify customer mobile numbers and, where available, email addresses, send instant SMS alerts for all electronic banking transactions above INR 500, send email alerts where an email address is available, and maintain 24x7 channels for reporting fraudulent transactions or lost cards. Complaints must be registered immediately with an acknowledgement, and banks must act promptly to prevent further unauthorised transactions. Resolution timelines set in the bank’s policy cannot exceed 45 calendar days for domestic cases and 60 calendar days for cross-border cases. Where reversal is required, it must be value dated to the original transaction date, and in credit card cases a shadow reversal must be provided within five calendar days of notification. Customers remain liable for losses caused by their own negligence until they report the fraud, while any loss after reporting must be borne by the bank. The directions also create a compensation mechanism for small-value fraudulent electronic banking transactions. A bona fide individual, including a sole proprietor, can receive compensation once in a lifetime of 85 per cent of net loss or INR 25,000, whichever is lower, for gross losses up to INR 50,000 in eligible customer-negligence cases, provided the matter is reported both to the bank and to the National Cyber Crime Reporting Portal or helpline within five calendar days. The compensation cost is split between the Reserve Bank, the customer’s bank and, for domestic cases, the beneficiary bank under specified formulas. This mechanism applies to losses from fraudulent transactions occurring up to one year from the effective date of the directions. Banks must also report complaint data and outcomes to their board or a designated committee and may not charge customers for SMS sent to comply with regulations or for customer awareness purposes.
Reserve Bank of India2026-06-24
Reserve Bank of India revises rural co-operative bank customer protection rules for fraudulent electronic banking transactions
The Reserve Bank of India has overhauled customer protection rules for fraudulent electronic banking transactions at rural co-operative banks, effective for transactions from January 1, 2027. The new framework requires mandatory alerts and 24x7 reporting channels, places the burden of proving customer liability on the bank, and provides zero liability where the bank is at fault or where a third-party breach is reported within five days. It also introduces a once-in-a-lifetime compensation mechanism for eligible small-value fraud losses up to INR 50,000.