Reserve Bank of India (Local Area Banks – Miscellaneous) Supervisory Directions, 2026
RBI notification RBI/DoS/2026-27/450 · 31 Jul 2026
RBI notification RBI/DoS/2026-27/450 · 31 Jul 2026
Summary
Check the official recordThe Reserve Bank of India issued supervisory directions for Local Area Banks covering fair practices, inoperative accounts, fraud prevention, protected disclosures, vigilance, network management, and cyber security for ATM switch service providers. Banks must ensure fair interest charging, reduce inoperative accounts, and implement robust fraud prevention and vigilance systems. The directions mandate specific cyber security controls for third-party ATM switch application service providers, including access management, patch management, and incident response. Banks must monitor progress on inoperative accounts via the DAKSH portal and ensure compliance with these standards. These directions take effect immediately and repeal previous instructions on these subjects.
What you must do
Key dates
Who is affected
Exceptions
If you do not comply
RBI/DoS/2026-27/450 DoS.CO.PPG.44/11.01.005/2026-27 July 31, 2026
In exercise of the powers conferred by Section 35-A of the Banking Regulation Act, 1949, and all other provisions / laws enabling the Reserve Bank of India (‘RBI’) in this regard, RBI being satisfied that it is necessary and expedient in the public interest so to do, hereby, issues Directions hereinafter specified.
In Chapter VIII of these Directions, unless the context states otherwise, the terms therein shall bear the meanings assigned to them below, which are sourced from FSB Cyber Lexicon unless explicitly mentioned otherwise: (1) ‘Audit Trail’ - A chronological record that reconstructs and examines the sequence of activities surrounding or leading to a specific operation, procedure, or event in a security-relevant transaction from inception to result. (Source: NIST SP 800-53r5 on Security and Privacy Controls for Information Systems and Organizations) (2) ‘Cyber’ - Relating to, within, or through the medium of the interconnected information infrastructure of interactions among persons, processes, data, and information systems. (3) ‘Cybersecurity’ - Preservation of confidentiality, integrity, and availability of information and / or information systems through the cyber medium. In addition, other properties, such as authenticity, accountability, non-repudiation, and reliability can also be involved. (4) ‘Cyber Incident’ - A cyber event that adversely affects the cybersecurity of an information asset whether resulting from malicious activity or not. (Source: Cyber incident definition is adapted from FSB Cyber Lexicon. By the definition, it includes cybersecurity as well as IT incident) (5) ‘Cyber Resilience’ - The ability of an organisation to continue to carry out its mission by anticipating and adapting to cyber threats and other relevant changes in the environment and by withstanding, containing, and rapidly recovering from cyber incidents. (6) ‘Cyber-attack’ - Malicious attempt(s) to exploit vulnerabilities through the cyber medium to damage, disrupt, or gain unauthorised access to assets. (7) ‘Cyber Threat’ - A circumstance with the potential to exploit one or more vulnerabilities that adversely affects cybersecurity. (8) ‘De-militarized Zone (DMZ)’ - A perimeter network segment that is logically between internal and external networks. (Source: NIST SP 800-82 Rev. 2) (9) ‘Distributed Denial of Service (DDoS)’ - A denial of service that is carried out using numerous sources simultaneously. (10) ‘Framework’ - A structured set of strategies, policies, processes, methods, and best practices that guides organisational activities, enables governance and control, and supports the achievement of defined objectives. (Source: adapted from ISACA glossary and ISO 22340:2024) (11) ‘Information Asset’ - Any piece of data, device, or other component of the environment that supports information-related activities. Information Assets include information system, data, hardware, and software. (Source: Information Asset definition is adapted from “Guidance on cyber resilience for financial market infrastructures” publication of Bank for International Settlements and International Organization of Securities Commissions of June 2016) (12) ‘Information System’ - Set of applications, services, information technology assets, or other information-handling components, which includes the operating environment and networks. (13) ‘Malware’ - Software designed with malicious intent containing features or capabilities that can potentially cause harm directly or indirectly to entities or their information systems. (14) ‘Penetration Testing’ - A test methodology in which assessors typically working under specific constraints, attempt to circumvent or defeat the security features of an information system. (15) ‘Privileged User’ - A user who, by virtue of function, and / or role, has been allocated powers within an information system, which are significantly greater than those available to the majority of users. (Source: adapted from ISO/IEC 24775-2:2021) (16) ‘Vulnerability’ - A weakness, susceptibility, or flaw of an asset or control that can be exploited by one or more threats. (17) ‘Vulnerability Assessment (VA)’ - Systematic examination of an information system or product to determine the adequacy of security measures, identify security deficiencies, provide data from which to predict the effectiveness of proposed security measures and confirm the adequacy of such measures after implementation.
All other expressions unless defined herein shall have the same meaning as have been assigned to them under the Reserve Bank of India Act, 1934, the Banking Regulation Act, 1949, the Companies Act, 2013, or any statutory modification or re-enactment thereto or other regulations issued by the RBI or the Glossary of Terms published by the RBI, or as used in commercial parlance, as the case may be.
The bank, in the interest of fairness and transparency, shall review its practices regarding mode of disbursal of loans, application of interest and other charges, charging of Equated Monthly Instalments (EMIs), and take corrective action, including system level changes, as may be necessary, to address unfair practices, some of which are briefly explained below: (1) Charging of interest from the date of sanction of loan or execution of loan agreement and not from the date of actual disbursement of funds to the customer. For loans disbursed by cheque, charging interest from the cheque date while handing over the cheque to the customer several days later. (2) Charging of EMIs on the sanctioned loan amount rather than on the actual disbursed amount, without the knowledge or consent of the borrower. (3) Any changes in the amortisation schedule originally provided in the Key Facts Statement (KFS), with each part-disbursement of loan, not being communicated to the borrowers. (4) In case of disbursal or repayment of loans during a month, charging interest for the entire month rather than charging interest only for the period for which the loan was outstanding. (5) Collecting one or more instalments in advance but reckoning the full loan amount for charging interest.
These and other such non-standard practices of charging interest are not in consonance with the spirit of fairness and transparency while dealing with customers. These are matters of serious concern to the RBI.
The bank may use online account transfers in lieu of cheques for loan disbursal.
The bank shall take necessary steps to reduce the number of inoperative accounts and accounts pending for updation / periodic updation of ‘Know Your Customer’ (KYC) and make the process of updation / periodic updation of such accounts smoother and hassle free, including by enabling seamless updation of KYC through mobile / internet banking, non-home branches, and Video Customer Identification Process, in accordance with the relevant provisions of the Reserve Bank of India (Local Area Banks - Responsible Business Conduct) Directions, 2025.
The bank may facilitate the process of activation of accounts of beneficiaries of various Central / State government schemes like Direct Benefit Transfer (DBT) / Electronic Benefit Transfer (EBT) etc., and accounts pending for updation / periodic updation of KYC, by taking an empathetic view in such cases, since these accounts mostly pertain to the people from the underprivileged sections of the society.
The bank may organise special campaigns for facilitating activation of inoperative accounts and accounts pending for periodic updation of KYC.
The bank may also facilitate Aadhaar updation for its customers through its branches providing Aadhaar related services.
The Customer Service Committee of the Board shall monitor the progress in reduction of inoperative accounts and accounts pending for updation of KYC and the special efforts made by the bank in this regard.
The bank shall report the progress on reduction of inoperative accounts and accounts pending for updation of KYC on a quarterly basis to the Senior Supervisory Manager (SSM), RBI through DAKSH portal.