RBI/DoS/2026-27/434
DoS.CO.PPG.28/11.01.005/2026-27
July 31, 2026
Reserve Bank of India (Payments Banks – Miscellaneous) Supervisory Directions, 2026
Table of Contents
- Chapter I - Preliminary
- A. Short Title and Commencement
- B. Applicability
- C. Definitions
- Chapter II - Access to IT Systems
- Chapter III - Inoperative Accounts / Unclaimed Deposits
- Chapter IV - Nomination Facility
- Chapter V - Fraud Prevention Measures
- A. Frauds due to Collusion of the Bank Officials
- B. Large Value Frauds
- C. Safe Custody of Critical Documents
- D. Accounts opened by Employees
- E. Legal Compliance Certificate
- F. Legal Compliance Audit
- G. Forensic Scrutiny
- H. Exercise of Discretionary Power
- I. Best Practices Code in Banks
- J. Other Instructions
- Chapter VI - Protected Disclosure Scheme
- A. Scope and Coverage
- B. Procedure for Lodging the Complaint under the Scheme
- C. Protected Disclosure Policy
- Chapter VII – Vigilance
- A. Preamble
- B. Introduction
- C. Vigilance Angle
- D. Chief of Internal Vigilance
- D.1 Appointment
- D.2 Tenure
- D.3 Association with Sensitive Matters
- D.4 Submission of Reports and Returns - Review
- E. Preventive Vigilance
- F. Staff Rotation and Mandatory Leave
- G. Complaints
- H. Investigation Agency for Conducting Investigations
- I. Review of Cases entrusted to Investigating Agencies
- J. Action against Persons making False Complaints
- K. Liaison with Agencies
- Chapter VIII - Repeal and Other Provisions
- A. Repeal and Saving
- B. Application of Other Laws Not barred
- C. Interpretations
In exercise of the powers conferred by Section 35-A of the Banking Regulation Act, 1949, and all other provisions / laws enabling the Reserve Bank of India (‘RBI’) in this regard, RBI being satisfied that it is necessary and expedient in the public interest so to do, hereby, issues Directions hereinafter specified.
Chapter I - Preliminary
A. Short Title and Commencement
- These Directions shall be called the Reserve Bank of India (Payments Banks – Miscellaneous) Supervisory Directions, 2026.
- These Directions shall come into effect immediately upon issuance.
B. Applicability
- These Directions shall be applicable to Payments Banks (hereinafter collectively referred to as 'banks' and individually as 'bank').
C. Definitions
- All expressions used in these Directions, shall have the same meaning as have been assigned to them under the Reserve Bank of India Act, 1934, the Banking Regulation Act, 1949,the Companies Act, 2013, or any statutory modification or re-enactment thereto or other regulations issued by RBI or the Glossary of Terms published by RBI or as used in commercial parlance, as the case may be.
Chapter II - Access to IT Systems
- The bank shall provide the highest level of 'read only' access to its Information Technology systems and manpower assistance, if required, to RBI’s officers.
Chapter III - Inoperative Accounts / Unclaimed Deposits
- The bank shall take necessary steps to reduce the number of inoperative accounts and accounts pending for updation / periodic updation of ‘Know Your Customer’ (KYC) and make the process of updation / periodic updation of such accounts smoother and hassle free, including by enabling seamless updation of KYC through mobile / internet banking, non-home branches, and Video Customer Identification Process, in accordance with the relevant provisions of the Reserve Bank of India (Payments Banks - Responsible Business Conduct) Directions, 2025.
- The bank may facilitate the process of activation of accounts of beneficiaries of various Central / State government schemes like Direct Benefit Transfer (DBT) / Electronic Benefit Transfer (EBT) etc., and accounts pending for updation / periodic updation of KYC, by taking an empathetic view in such cases, since these accounts mostly pertain to the people from the underprivileged sections of the society.
- The bank may organise special campaigns for facilitating activation of inoperative accounts and accounts pending for periodic updation of KYC.
- The bank may also facilitate Aadhaar updation for its customers through its branches providing Aadhaar related services.
- The Customer Service Committee of the Board shall monitor the progress in reduction of inoperative accounts and accounts pending for updation of KYC and the special efforts made by the bank in this regard.
- The bank shall report the progress on reduction of inoperative accounts and accounts pending for updation of KYC on a quarterly basis to the Senior Supervisory Manager (SSM), RBI through DAKSH portal.
Chapter IV - Nomination Facility
- The bank shall obtain nomination in case of all existing and new eligible customers having deposit accounts, safe custody articles, and safety lockers, as the case may be, to avoid inconvenience and undue hardship to survivors / family members of deceased depositors, in accordance with relevant provisions of the Reserve Bank of India (Payments Banks - Responsible Business Conduct) Directions, 2025.
- The Board of Directors / Customer Service Committee (CSC) of the Board of the bank shall review, on a periodic basis, the achievement of nomination coverage.
- The bank shall also report the progress on nomination coverage to the SSM, RBI through DAKSH portal on a quarterly basis.
- The bank shall suitably sensitise its frontline staff in the branches for obtaining nomination as well as appropriate handling of claims of deceased constituents and dealing with nominees / legal heirs. The bank shall modify the Account Opening Forms suitably (if not already done) with provision for the customers to avail or opt out of nomination facility.
- The bank, in addition to directly notifying the customers, shall publicise the benefits of using the nomination facility through various media, including launching periodical drives towards achieving a full coverage of all eligible customer accounts.
Chapter V - Fraud Prevention Measures
From time to time, RBI has constituted various committees such as the Ghosh Committee, Gilani Committee, and Narang Committee, to examine different aspects relating to frauds and malpractices in banks and to recommend measures for their prevention and early detection. Based on the recommendations of these committees, RBI has, over the years, issued several guidelines to banks aimed at strengthening internal controls, enhanced monitoring in sensitive areas of banking operations, and curbing the occurrence of frauds. The key fraud preventive measures covered under these guidelines are outlined below.
A. Frauds due to Collusion of the Bank Officials
- In order to prevent / detect frauds due to collusion of the bank officials, the bank shall take the following measures:
(1) ensure balancing of books at the stipulated intervals;
(2) interact with the concurrent auditors and enquire about the problems faced by them in auditing certain branches and indicate to them in clear terms the expectations of the management from the auditors while auditing branches; and
(3) immediately examine staff accountability and take appropriate action for the lapses / irregularities noticed.
B. Large Value Frauds
- The bank shall take the following measures for prevention / detection of large value frauds:
(1) Management Audit System and its emphasis on analysis of existing control system, its adequacy, scope and need for periodical review;
(2) Safe custody of critical items of bank stationery; and
(3) A scheme to honour alert bank staff for timely detection of frauds.
C. Safe Custody of Critical Documents
- The bank shall exercise safeguards like maintenance of proper records, dual control, periodical balancing of books / verification, submission of control returns, and ensure their observations.
- Blank Demand Drafts / Pay Orders and Mail Transfer forms should be treated as security items and the branches should take adequate safeguards against their pilferage. They should be held in joint custody and balanced daily.
- The bank shall ensure that no unauthorised person has access to security items like blank cheques, drafts, fixed deposit receipts, pay orders, account opening forms, specimen signature cards / books, and loose ledger sheets.
- The ledgers and other books of accounts, voucher bundles, and other items of Stationery should be stored properly.
D. Accounts opened by Employees
- The bank shall make it incumbent on the part of the staff members to intimate in writing about the accounts opened by them with another branch of the bank or another bank. Accordingly, necessary amendments to the Officers' Conduct Regulations as also the Standing Orders to the workmen employees may be issued in consultation with Indian Banks Association (IBA).
E. Legal Compliance Certificate
- The bank shall establish an in-house legal compliance certification process to be enforced from each desk, specially from each management category staff for making them accountable. A legal compliance certificate shall be mandated in all transactions exceeding a cut-off limit (may be decided by the bank). In case of exercise of discretionary power, an explanation shall be given indicating the circumstances warranting the exercise of discretionary power and whether all due diligence has been taken or not.
F. Legal Compliance Audit
- The bank should conduct a legal compliance and due diligence audit annually and submit the report to the Chairman / Managing Director & Chief Executive Officer (MD & CEO) and the SSM, RBI.
- In all banking transactions, such as opening of different types of accounts, if the transaction exceeds a cut off amount the concerned staff should certify that all stipulated conditions are complied with and during the internal audit, such certificate shall be checked by the internal auditor and report to the Chairman / MD & CEO and the SSM, RBI.
G. Forensic Scrutiny
- The bank shall build a database of officers / staff identified as those having aptitude for investigation, data analysis, and forensic analysis, and provide them appropriate training in investigations and forensic audit. For investigation of frauds, only such officers / staff should be deployed through the ‘Fraud Investigation Unit / Outfit’.
H. Exercise of Discretionary Power
- The bank shall build a database of its management and staff exercising discretionary power, recording all reasons for such exercise and the consequences. A close monitoring of such exercise of discretionary power is required. Discretionary power shall be exercised in circumstances only when it is essentially needed and there is no other method left.
I. Best Practices Code in Banks
- The bank shall reiterate the need for strict adherence to the laid down systems and procedures, to its branches / controlling offices. The bank may organize training programmes / seminars / workshops, for creating awareness among the field level functionaries on an ongoing basis.
- The procedures for entering into transactional relationship, especially those in the fraud-prone areas, should be well documented in the BPC, compared with the best national and international practices, experimented with, and improved upon in the light of the experience gained.
- Preparation of the BPC should involve examination of all procedures, processes, products, activities, and systems, existing and future (as and when a new product / process is introduced).
- The BPC should be integrated with the overall risk management strategy of the bank. Apart from it being viewed in the context of prevention of frauds, it should also be considered as a part of the strategy to mitigate all possible operational risk losses.
- The bank shall consider the following while compiling the BPC:
(1) The BPC should be a comprehensive and homogenous document.
(2) While the manual of instructions / circulars issued by the bank from time to time could be consolidated and incorporated, this by itself would not constitute BPC.
(3) The BPC should take into account the instructions relating to the common fraud prone areas and their prevention issued to banks by RBI from time to time.
(4) The BPC should also highlight the recommendations of the various committees constituted by RBI for prevention of frauds and banking sector reforms.
(5) The BPC should also take into account the instructions of the Central Vigilance Commission (CVC), if any, issued from time to time.
(6) The BPC should, at a minimum, cover all the functional areas like cash, safe custody of other valuables (Demand Draft / Telegraphic Transfer), deposit accounts, investment portfolio, foreign exchange transactions, treasury operations, bills portfolio, remittances, cash receipts and payments, issue / payment of demand drafts, clearing transactions, and government transactions.
(7) The BPC may also incorporate practices that would help prevention of losses to its customers and include suitable guidance to such customers. The bank shall codify the precautions to be taken by customers and the same should be publicised by placing on its website or through any other medium.
(8) The BPC should be periodically revised and updated in the light of the experience gained, fresh instructions from RBI and suggestions made by internal / external auditors.
J. Other Instructions
- The concurrent / internal / statutory auditors of the bank shall specifically report to the Chairman / MD & CEO of the bank and the SSM, RBI, about anything susceptible to be a fraud or fraudulent activity or any foul play in any transaction.
- The bank shall adhere strictly to the time frame fixed for reporting fraud cases to RBI as per Reserve Bank of India (Payments Banks – Fraud Risk Management) Directions, 2026.
- The bank shall invariably initiate departmental action against officials involved in bank frauds simultaneously with criminal action to ensure that internal fraudsters are immediately punished even if criminal cases against them continue.
- The officers posted in the Vigilance Department of the bank, preferably at the Head Office, should hold meetings with the investigating authorities at periodical intervals which should be minutised and action be taken within a time frame agreed to at the meetings.
Chapter VI - Protected Disclosure Scheme
- The bank shall take necessary action for implementing the Protected Disclosure Scheme. The salient features of the Scheme are as under:
A. Scope and Coverage
- The complaints under the Scheme would cover the areas such as corruption, misuse of office, criminal offences, suspected / actual fraud, failure to comply with existing rules and regulations such as the Reserve Bank of India Act, 1934 and the Banking Regulation Act 1949, and acts resulting in financial loss / operational risk or loss of reputation, detrimental to depositors' interest / public interest.
- Under the Scheme, employees of the bank, customers, stake holders, NGOs and members of public can lodge complaints.
- Anonymous / pseudonymous complaints will not be covered under the Scheme and such complaints will not be entertained.
- RBI will be the Nodal Agency to receive complaints under the Scheme. RBI would keep the identity of the complainant secret, except in cases where complaint turns out to be vexatious or frivolous and action has to be initiated against the complainant as mentioned below:
(1) The institution against which complaint has been made can take action against complainants in cases where motivated / vexatious complaints are made under the Scheme, after being advised by RBI. An opportunity of hearing will, however, be given by the bank to the complainant before taking such action.
(2) Final action taken by RBI on the complaint will be intimated to the complainant.
B. Procedure for Lodging the Complaint under the Scheme
- The complaint should be sent in a closed / secured envelope.
- The envelope should be addressed to The Chief General Manager, Reserve Bank of India, Department of Supervision, Fraud Monitoring Group, 2nd Floor, Maker Tower-E, Cuffe Parade, Mumbai 400 005. The envelope should be superscribed ‘Complaint under Protected Disclosure Scheme for Banks’.
- The complainant should give his / her name and address in the beginning or end of the complaint or in an attached letter. In case of an employee making such complaint, details such as name, designation, department, institution and place of posting should be furnished.
- Complaints can also be made through e-mail also giving full details as specified above.
- The complainant should ensure that the issue raised by him involves dishonest intention / moral angle. They should study all the relevant facts and understand their significance. They should also make an effort, if possible, to resolve the issue through internal channels in order to avoid making the complaint.
- The text of the complaint should be carefully drafted so as not to give any details or clue to complainant's identity. The details of the complaint should be specific and verifiable.
- In order to protect the identity of the complainant, RBI will not issue any acknowledgement of receipt of the complaint and the complainants are advised not to enter into any further correspondence with the RBI in their own interest. RBI assures that, subject to the facts of the case being verifiable, it would take necessary action, as provided under the scheme. If any further clarification is required, RBI will get in touch with the complainant.
- If the complaint is accompanied by particulars of the person making the complaint, the RBI shall take the following steps:
(1) If necessary, it would ascertain from the complainant whether they were the person who made the complaint or not.
(2) The identity of the complainant will not be revealed unless the complainant himself has made the details of the complaint either public or disclosed his identity to any other authority.
(3) The identity of the complainant will be concealed, RBI will make discreet inquiries to ascertain if there is any basis for proceeding further with the complaint.
(4) Either as a result of the discreet enquiry, or on the basis of complaint itself without any enquiry, if RBI is of the opinion that the matter requires to be investigated further, RBI may consider calling for the comments / response from the Chairman / MD & CEO of the concerned bank.
(5) After obtaining the response of the concerned bank and / or on the basis of an independent scrutiny conducted / ordered by RBI, if RBI is of the opinion that the allegations are substantiated, then RBI shall recommend appropriate action to the concerned bank. These shall, inter alia, include the following:
(i) Appropriate action to be initiated against the concerned official.
(ii) Appropriate administrative steps for recovery of the loss caused to the bank as a result of the corrupt act or mis-use of office, or any other offence covered by the Scheme.
(iii) Recommend to the appropriate authority / agency for initiation of criminal proceedings, if warranted by the facts and circumstances of the cases.
(iv) Recommend taking corrective measures to prevent recurrence of such events in future.
(v) Consider initiating any other action that it deems fit keeping in view the facts of the case.
(6) If any person is aggrieved by any action on the ground that he is victimized due to filing of the complaint or disclosure, he may file an application before the RBI seeking redressal in the matter. RBI will take such action, as deemed fit. In case the complainant is an employee of the bank, RBI may give suitable directions to the concerned bank, preventing initiation of any adverse personnel action against the complainant.
(7) Either on the basis of application of the complainant or on the basis of information gathered, if the RBI is of the opinion that either the complainant or the witnesses in the case need protection, the RBI shall issue appropriate directions to the concerned bank.
(8) The system described herein shall be in addition to the existing grievances redressal mechanism in place. However, secrecy of identity shall be observed, only if the complaint is received under the scheme.
(9) In case RBI finds that the complaint is motivated or vexatious, RBI shall be at liberty to take appropriate steps.
(10) In the event of the identity of the informant being disclosed in spite of RBI's directions to the contrary, then RBI shall be authorised to initiate appropriate action as per extant regulations against the person or agency making such disclosure. RBI may also direct such person or agency to suitably compensate the complainant.
C. Protected Disclosure Policy
- The bank shall frame a 'Protected Disclosure Scheme' duly approved by its Board, keeping in view the broad framework given above. The policy should clearly lay down norms for protection of identity of employees making disclosures under the scheme and safeguarding them from any adverse personnel action. The role and responsibilities of the Board may also be well defined in dealing with the complaints received under the scheme. The Board, or a Board Committee may be made responsible for monitoring the implementation of the scheme. The bank may factor suggestions of the unions / associations of officers / employees before framing such a policy. Suitable mechanism should be put in place to make newly recruited employees of the bank aware of the existence of such a scheme in the bank.
Chapter VII – Vigilance
- The bank shall put in place a system of internal vigilance machinery as per the guidelines furnished below with the approval of the Board, in order to uniformly address issues arising out of lapses in the functioning of the bank especially relating to corruption, malpractices, and frauds, for timely and appropriate action:
A. Preamble
- Vigilance is an inseparable part of management. It promotes clean business transactions, professionalism, productivity, promptness and transparent practices and ensures putting in place systems and procedures to curb opportunities for corruption which results in improving efficiency and effectiveness of the personnel as well as the organization. These factors make it mandatory to have a dedicated vigilance setup in the banking industry. The following guidelines aim at structuring efficient and effective vigilance system in banks in the larger interest of all concerned stakeholders.
B. Introduction
- Anti-corruption measures taken by the bank are a responsibility of the disciplinary authority identified in the bank and it has the over-all responsibility of looking into the acts of misconduct alleged against, or committed by, the employees within its control and to take appropriate punitive action. It is also required to take appropriate preventive measures so as to prevent commission of misconducts / malpractices by the employees under its control and jurisdiction. The designated Officer (similar to Chief Vigilance Officers in case of Public Sector Banks) acts as a Special Assistant / Advisor to the CEO of the bank in the discharge of these functions. They also act as a liaison officer between the bank and the Police / Serious Fraud Investigation Officer / other law enforcement authorities.
C. Vigilance Angle
- Vigilance angle will be applicable in case of following acts:
(1) Demanding and / or accepting gratification other than legal remuneration in respect of an official act or for using his influence with any other official;
(2) Obtaining valuable thing, without consideration or with inadequate consideration from a person with whom he has or is likely to have official dealings or his subordinates have official dealings or where he can exert influence;
(3) Obtaining for himself or for any other person any valuable thing or pecuniary advantage by corrupt or illegal means or by abusing his position as an employee;
(4) Possession of assets disproportionate to their known sources of income; and
(5) Cases of misappropriation, forgery or cheating or other similar criminal offences.
- In case of other irregularities like gross or wilful negligence; recklessness in decision making; blatant violations of systems and procedures; exercise of discretion in excess, where no ostensible organisational interest is evident; failure to keep the controlling authority / superiors informed in time; the disciplinary authority with the help of the Chief of Internal Vigilance (CIV) should carefully study the case and weigh the circumstances to arrive at a conclusion whether there is reasonable ground to doubt the integrity of the officer concerned.
D. Chief of Internal Vigilance
- The bank shall designate an officer of suitable seniority as CIV who will head the Internal Vigilance Division of the bank. Vigilance functions to be performed by the CIV would be wide ranging and include collecting intelligence about the corrupt practices committed, or likely to be committed, by the employees of the bank; investigating or causing an investigation to be made into verifiable allegations reported to him; processing investigation reports for further consideration of the disciplinary authority concerned; referring the matters to the CEO of the bank for advice wherever necessary; and taking steps to prevent commission of improper practices / misconducts. Thus, the CIVs' functions can broadly be divided into three parts, viz. (i) Preventive vigilance; (ii) Punitive vigilance; and (iii) Surveillance and detection.
D.1 Appointment
- The basis for appointment of CIV should be experience, track record, proven integrity, and ability to inspire confidence among personnel in the bank.
D.2 Tenure
- The normal tenure of a CIV should be three years extendable up to a further period of two years. But if a CIV has to shift from one bank to another without completing the approved tenure in the previous bank, the principle of overall tenure of six years will apply.
D.3 Association with Sensitive Matters
- The vigilance functionaries should not be a party to processing and decision-making processes or be involved in other administrative transactions of such nature, which are likely to have clear vigilance sensitivity. While it may not be difficult for full-time vigilance functionaries to comply with this requirement, the compliance of these instructions could be achieved in respect of part-time vigilance functionaries by confining their duties, other than those connected with vigilance work, as far as possible, to such items of work that are either free from vigilance angle or preferably serve as input to vigilance activities such as inspection and audit.
D.4 Submission of Reports and Returns - Review
- CIV should invariably review all pending matters, such as investigation reports, disciplinary cases, and other vigilance complaints / cases in the first week of every month and take necessary steps for expediting action on those matters. The CIV would arrange periodic meetings to be taken by the CEO for reviewing the vigilance activities undertaken by the bank. CIV would also be required to furnish a report on the vigilance activities in the bank to the Board / Local Governing Council on a periodic basis.
E. Preventive Vigilance
- The CIV may take the following measures on preventive vigilance:
(1) undertake a study of existing procedure and practices prevailing in the bank with a view to modifying those procedures or practices which provide a scope for corruption, and also to find out the causes of delay, the points at which it occurs and devise suitable steps to minimize delays at different stages;
(2) undertake a review of the regulatory functions with a view to see whether all of them are strictly necessary and whether the manner of discharge of those functions and exercise of powers of control are capable of improvement;
(3) devise adequate methods of control over exercise of discretion so as to ensure that discretionary powers are not exercised arbitrarily but in a transparent and fair manner; and
(4) identify the areas in his organisation which are prone to corruption and to ensure that the officers of proven integrity only are posted in those areas;
F. Staff Rotation and Mandatory Leave
- The bank should identify sensitive positions and frame specific Board approved internal policy on staff matters such as rotation of staff in general and in respect of sensitive desks in particular. The bank may, while framing such policy, include the minimum period for staff rotation and mandatory leave that would apply to the staff at all levels. The bank shall also refer to Reserve Bank of India (Payments Banks – Miscellaneous) Directions, 2025.
G. Complaints
- Receipt of information about corruption, malpractice or misconduct on the part of employees, from whatever source, would be termed as a complaint. Information about corruption, malpractice or misconduct on the part of employees may flow to the administrative authority / the Police / Serious Fraud Investigation Officer / RBI from any of the following sources:
(1) Complaints received from employees of the bank or from the public;
(2) Departmental inspection reports and stock verification surveys;
(3) Scrutiny of annual property statements;
(4) Scrutiny of transactions reported under the Conduct Rules;
(5) Reports of irregularities in accounts detected in the routine audit of accounts, e.g., tampering with records, over-payments, and misappropriation of money or materials;
(6) Audit reports of the accounts of the bank;
(7) Complaints and allegations appearing in the press;
(8) Source information, if received verbally from an identifiable source, to be reduced in writing; and
(9) Intelligence gathered by agencies like Central Bureau of Investigation and local bodies.
- In addition, the CIV may also devise and adopt appropriate methods to collect information about any malpractice and misconduct among the employees. Anonymous / pseudonymous complaints received by the CIV may be dealt with on merit.
H. Investigation Agency for Conducting Investigations
- As soon as a decision has been taken to investigate the allegations contained in a complaint, the bank shall decide whether the allegations should be inquired into departmentally or whether a police investigation is necessary. Instructions as to with which agency the complaint is to be lodged, are contained in the Reserve Bank of India (Payments Banks – Fraud Risk Management) Directions, 2026.
I. Review of Cases entrusted to Investigating Agencies
- No review should ordinarily be made by the administrative authority of a case registered by the Police. If, however, there are special reasons for discussion / review, the Police should invariably be associated with it.
J. Action against Persons making False Complaints
- If a complaint against an employee is found to be malicious, vexatious or unfounded, it should be seriously considered whether action should be taken against the complainant for making a false complaint.
K. Liaison with Agencies
- The CIV should closely liaise and co-operate with the Police / Serious Fraud Investigation Office (SFIO) during the course of an inquiry and investigation and the processing of individual cases, as both the Police / SFIO and the CIV, receive information about the activities of the officer from diverse sources. Such information may be cross checked at appropriate intervals to keep Police / SFIO fully apprised with the latest developments through periodical meetings between the CIV and Police / SFIO.
