RBI Amendment Directions On NBFC Advertising, Marketing And Sale Of Financial Products

1                Introduction

On 15 June 2026, the Reserve Bank of India (RBI) issued, inter alia, the Reserve Bank of India (Non-Banking Financial Companies – Responsible Business Conduct) (Second Amendment) Directions, 2026 (Amendment Directions), introducing a comprehensive new chapter governing how non-banking financial companies (NBFCs) (including housing finance companies (HFCs)) advertise, market, and sell their own and third-party financial products and services, as set out under the Reserve Bank of India (Non-Banking Financial Companies – Responsible Business Conduct) Directions, 2025 (Existing RBC Directions).

The Amendment Directions form part of a broader package of 17 entity-specific notifications issued on the same date, spanning all categories of RBI-regulated entities. The package comprises two parallel tracks: (a) amendments to the master directions in relation to the undertaking of financial services applicable to each regulated entity respectively;¹ and (b) amendments to the master directions governing responsible business conduct (RBC) applicable to each regulated entity respectively, which introduce comprehensive requirements on advertising, marketing, sale, and conduct, including an express prohibition on compulsory bundling, a codified mis-selling framework with mandatory refunds, and regulation of dark patterns.

The Amendment Directions come into effect on 1 January 2027. They apply to NBFCs that have a customer interface, while excluding Core Investment Companies, NBFC-Account Aggregators, Non-Operative Financial Holding Companies, and NBFCs without any customer interface. Certain provisions will also apply to NBFC-P2P entities, Mortgage Guarantee Companies, and Standalone Primary Dealers. We have set out below our analysis of the key amendments introduced.

2                Key Amendments introduced in the Amendment Directions

1. Board-Approved Policy and Code of Conduct

NBFCs must put in place a comprehensive policy covering advertising, marketing, and sale of both own and third-party products, addressing suitability and appropriateness criteria, the customer feedback mechanism, and customer compensation for mis-selling. Where Direct Selling Agents (DSAs) or Direct Marketing Agents (DMAs) are engaged, the policy must additionally cover eligibility criteria, pre and post-engagement due diligence, sub-agent training, permissible functions, performance standards, inspection and audit, control mechanisms, and penal actions for non-compliance.

Separately, a Code of Conduct for sale and marketing must be adopted, applicable to employees, DSAs/DMAs and their sub-agents, and third-party product or service (TPPS) provider representatives operating on premises, with signed undertakings obtained from each of them before any activity is assigned. Such Code of Conduct must also be uploaded on the website of the NBFC.

Comments. The Amendment Directions embed conduct governance at the board level, requiring NBFCs to document and institutionalise their approach to product distribution. The dual requirement of a board-approved policy and a published Code of Conduct creates a layered compliance architecture, with the policy addressing operational and risk aspects, and the Code of Conduct setting behavioural standards enforceable through signed undertakings. NBFCs will need to ensure these instruments are integrated with existing operational frameworks and updated periodically to reflect regulatory changes.

2. DSA/DMA Governance, Onboarding and Public Disclosure

The Amendment Directions introduce a significantly enhanced agent-governance regime. The term DSA/DMA is defined broadly to capture any external entity or individual engaged to sell, market, promote, or influence customers, expressly including Loan Service Providers (LSPs) as well. The Amendment Directions also introduce a separate concept of DSA/DMA sub-agents at the point of customer interface.

NBFCs must maintain and display on their website an up-to-date list of all empanelled DSAs/DMAs (including type, address, period of engagement, and products handled), and update it within 7 calendar days of any change. Employees and sub-agents engaged in sales must hold any qualification or certification prescribed by the relevant regulator, and any sub-agent or TPPS representative present on premises must be clearly distinguishable from employees, with on-person identification.

Conduct obligations include upfront disclosure of fees and rates, contact only between 09:00 and 19:00 hours absent customer request, respect for ‘Do Not Disturb’ preferences, no residence visits without consent, and prohibitions on misleading, coercion, false representation of employee status, and unauthorized commitments. They also require personnel to provide customer care and grievance-redressal contact details where requested, and to discuss customer matters with any other individual only with the customer’s explicit request or consent.

Comments. The expanded definition of DSA/DMA, which now expressly includes LSPs, reflects the RBI’s intent to bring the entire distribution chain under a consistent regulatory standard. The mandatory website disclosure requirement will enhance transparency and customer awareness, while the conduct obligations codify several long-standing industry practices around contact hours, customer consent, and grievance redressal. NBFCs will need to review existing DSA/DMA agreements, onboarding processes, and training frameworks to ensure compliance with the new regime.

3. Consent Architecture

The consent requirements under the Amendment Directions are prescriptive and will require redesign of digital onboarding flows. Products may be sold only with the customer’s explicit consent (which is defined as a specific, informed, and unambiguous indication through a recorded statement or clear affirmative action) captured via signed declaration, OTP, digitally recorded confirmation, or a clearly demarcated section of the agreement.

Where multiple products appear on a single form, each must be separately enumerated with the option to select only those desired. Critically, any consent user interface must be designed so that consent cannot be granted without going through the applicable terms and conditions, and the default choice must be set to ‘No’ / ‘I do not agree’. Key features such as fees, charges, interest rate, risks, financial commitment, lock-in, and exit terms must be prominently disclosed, using prescribed formats such as the Key Facts Statement (KFS) or Most Important Terms and Conditions (MITC) where applicable, and consent records retained for one year from cessation of the contract.

Comments. The prescriptive consent architecture mandates a fundamental shift in how digital lending journeys are designed. The requirement that consent cannot be granted without going through the terms and conditions, combined with the default ‘No’ / ‘I do not agree’ setting, directly targets pre-checked consent boxes and frictionless sign-up flows that have historically facilitated uninformed consent. NBFCs will need to undertake a comprehensive overhaul of their digital interfaces, customer-facing applications, and consent capture mechanisms to comply with these requirements.

4. Suitability and Appropriateness

Before selling any product not classified as suitable for all customers under the NBFC’s policy to an individual customer, the NBFC must assess suitability and appropriateness based on the product’s features, risk-return attributes, time horizon, complexity, and fee structure, weighed against the customer’s age, income, financial literacy, and risk tolerance. Where a sector regulator has prescribed a specific suitability methodology, the same must be followed. This effectively requires embedding a structured suitability assessment into the sale journey.

Comments. The suitability and appropriateness framework introduces a customer-centric approach to product distribution. By requiring NBFCs to weigh product attributes against customer characteristics, the Amendment Directions impose an affirmative obligation to assess fit before sale. This mirrors suitability frameworks prevalent in securities and insurance regulation and will require NBFCs to develop assessment methodologies, maintain documentation of suitability determinations, and integrate these checks into their sales processes.

5. Application Forms and Customer Documentation

The Amendment Directions also prescribe requirements for how the sale journey is documented and communicated to the customer. Physical application forms must be product-specific, while digital forms containing multiple products must clearly distinguish each product through a dedicated section or module and capture explicit consent separately for each product.

Documents relating to the NBFC’s own products, including terms and conditions, must be made available in the language of the region or in a language understood by the customer. Following receipt of an application, the NBFC must send the customer an acknowledgment through message, email, or another secure medium, including a telephone number for queries. On completion of the sale, the signed terms and conditions or agreement must be provided to the customer securely.

Comments. The documentation requirements emphasise clarity, accessibility, and acknowledgment throughout the customer journey. The regional language requirement addresses inclusivity concerns, particularly in semi-urban and rural markets, while the mandatory acknowledgment and post-sale delivery of signed documents establish a clear audit trail. NBFCs will need to review their application forms, language accessibility processes, and customer communication workflows to ensure compliance.

6. Anti-Mis-Selling and Bundling Controls

The Amendment Directions introduce a formal definition of mis-selling, covering sale of an unsuitable or inappropriate product (even with consent), sale on incomplete or misleading information, sale without explicit consent, and compulsory bundling. NBFCs must ensure their policies and practices do not create incentives for mis-selling, and that no employee receives any incentive from a Third-party Product or Service (TPPS) provider for selling third-party products.

Compulsory bundling of a TPPS with an own product is prohibited. Where a third-party product is required as a risk mitigant, the customer must be free to source it from any provider, and genuinely voluntary or complimentary packages are not treated as bundling. NBFCs are not allowed to fund the purchase of any product out of a sanctioned loan facility without the customer’s explicit consent.

Comments. The codification of mis-selling and bundling controls reflects the RBI’s intent to address persistent consumer protection concerns. Notably, the definition of mis-selling includes sale of unsuitable products even with consent, establishing that consent alone does not absolve the NBFC of responsibility. The prohibition on TPPS incentives to employees directly targets cross-selling practices that have contributed to mis-selling. NBFCs will need to review their incentive structures, product bundles, and loan-funding flows to identify and mitigate risks.

7. Digital Interfaces and Dark Patterns

NBFCs and their DSAs/DMAs must ensure their user interfaces deploy no dark patterns, and interfaces must be subjected to user testing and periodic internal audit to identify unfair features. Adherence to the Central Consumer Protection Authority’s Guidelines for Prevention and Regulation of Dark Patterns, 2023 is mandatory.

The Amendment Directions append an illustrative list of eleven patterns highly relevant to lending journeys, including false urgency (e.g., countdown timers and ‘rate will rise’ prompts on pre-approved loans), basket sneaking (default-adding loan protection insurance during application), confirm shaming, forced action, subscription traps, interface interference (default ‘Yes’ consent, burying account-closure options), bait-and-switch on interest rates, drip pricing (failing to reveal processing fees upfront), disguised advertisement, nagging, and trick wording.

Comments. The dark patterns regulation is a significant development, bringing financial services user interfaces under explicit scrutiny. The illustrative list of eleven patterns is particularly relevant for digital lending platforms, where countdown timers, default-added insurance, and drip pricing have been common. The requirement for user testing and periodic internal audits introduces an ongoing compliance obligation, and NBFCs will need to establish audit protocols and remediation processes to address identified issues.

8. Advertising, Promotional Communications and Third-Party Products

All advertising and promotional materials, physical or digital, must be clear and factual and disclose the interest rate and associated fees, with terms and conditions prominently displayed at all points of sale and digital channels. Promotional communications may be sent only to customers who have given explicit consent to receive them, and the unsubscribe process must be easy and simple.

An NBFC is not allowed to advertise a third-party product as its own and must clarify its role when presenting any TPPS provider’s product.

Comments. The advertising and promotional requirements align with broader consumer protection principles requiring transparency in marketing communications. The explicit consent requirement for promotional communications and the simplified unsubscribe process address telemarketing and digital marketing practices. The prohibition on advertising third-party products as own products is particularly relevant for co-branded products and white-labelled arrangements, where role clarity is essential for customer awareness.

9. Feedback Mechanism and Customer Compensation

NBFCs must establish a mechanism to seek customer feedback within 30 days of any sale to confirm the customer has understood the features and risks (this needs to be conducted by a department not associated with sales), with a half-yearly report feeding back into policy review.

Customers may lodge mis-selling complaints within the timeline set by the relevant regulator or, absent one, within 30 days of receiving the signed agreement. Where mis-selling is established, the NBFC must refund the entire amount paid, intimate the customer of cancellation where applicable, and compensate the customer for any resulting loss as per its approved policy.

Comments. The feedback mechanism and compensation framework create a closed-loop system for identifying and addressing mis-selling. The requirement that feedback be collected by a department not associated with sales is intended to ensure independence and objectivity. The mandatory refund and compensation obligations for established mis-selling represent a significant consumer protection measure, and NBFCs will need to establish dedicated processes for complaint intake, investigation, and remediation.

10. Interface with Other Regulatory Regimes

The Amendment Directions require continued compliance with adjacent frameworks, including the TRAI/DoT commercial-communication rules (TCCCPR, 2018, as amended), the product-specific requirements of SEBI, IRDAI, and PFRDA, and the RBI's own guidelines on agency business, outsourcing of financial services, and deposit mobilization through agents.

Comments. The express reference to adjacent regulatory frameworks highlights the need for a coordinated compliance approach. NBFCs distributing third-party products regulated by SEBI, IRDAI, or PFRDA will need to ensure compliance with both the Amendment Directions and the applicable sector-specific regulations. The reference to TCCCPR requirements is particularly relevant for telecalling operations and commercial communications.

3                Concluding Remarks

The Amendment Directions represent a comprehensive overhaul of the regulatory framework governing how NBFCs advertise, market, and sell financial products. Effective 1 January 2027, NBFCs have approximately six months to implement key changes, including: mapping in-scope products and DSA/DMA ecosystems; framing board-approved policies and Codes of Conduct; reworking consent flows, customer communications, and language-accessibility processes; auditing digital journeys against dark-pattern guidelines; updating DSA/DMA agreements with penal clauses; and establishing structured mis-selling complaint and compensation procedures. A cross-functional approach involving compliance, legal, technology, operations, and business teams will be essential to ensure timely and effective implementation.

Footnote

^{1 The authors have previously examined the amendments relating to the undertaking of financial services by regulated entities in detail. See: https://www.khaitanco.com/sites/default/files/2026-06/Ergo_Agency%20Business%20and%20Third%20Party%20Product_30062026.pdf}

The content of this document does not necessarily reflect the views / position of Khaitan & Co but remain solely those of the author(s). For any further queries or follow up, please contact Khaitan & Co at editors@khaitanco.com.