The Reserve Bank of India (RBI) has issued comprehensive instructions for regulated entities on advertising, marketing and sale of financial products to curb mis-selling practices. According to reports from Business Standard, the final norms that are effective January 1, 2027 introduce stringent measures around customer consent, disclosures and sales practices. As reported by ETBFSI, these amendments seek to strengthen customer protection, curb mis-selling practices and enhance accountability across banks, direct selling agents (DSAs), direct marketing agents (DMAs) and third party product providers. The revised directions adopt a principle-based and channel-agnostic approach that places overall responsibility on regulated entities for all advertising, marketing and sale of financial products undertaken directly or through agents or outsourced arrangements. The latest amendments come in the backdrop of rising instances of mis-selling of financial products and services to common people, as reported by PTI.
The new regulations ban the use of 'dark patterns' in digital interfaces, defining them as design or user-experience techniques that mislead or trick customers into taking actions they did not intend. As reported by ETBFSI, these measures specifically target deceptive practices including creating false urgency through countdown timers and limited-period offers, basket sneaking through pre-selected products, confirm shaming that induces guilt to influence customer decisions, and forced actions that require customers to purchase unrelated products. The RBI has also prohibited subscription traps that make cancellation difficult, interface interference through pre-selected consent options, bait-and-switch advertising, drip pricing through undisclosed charges, and repetitive nagging prompts designed to pressure customers into making purchases. The notification's most detailed section is Annex IIA, which lists 11 specific digital tricks that banks and their agents are now prohibited from using in any app, website, or user interface, with concrete, real-world illustrations for each one. In its Responsible Business Conduct Second Amendment Directions, 2026 for REs, RBI emphasised that regulated entities should eschew the practice of compulsory bundling - making availment of one product/service by a customer conditional upon availment of another product/service, whether own or third-party.
Under the new framework, banks and NBFCs must obtain explicit customer consent that indicates agreement to a specific action by or arrangement with them. According to the RBI instructions reported by ETBFSI, before obtaining customer consent, banks must prominently disclose key features of the product, including interest rates, fees and charges, financial commitments, risks involved, lock-in periods, and exit conditions and penalties. Where regulators have prescribed standard disclosure formats such as Key Facts Statements (KFS) or Most Important Terms and Conditions (MITC), banks must use those formats. Banks will also be required to provide copies of agreements and terms and conditions to customers after completion of the sale. The default setting on any digital consent screen must be 'No' or 'I do not agree', with the burden of saying yes coming from the customer, not from inertia. Banks must keep all consent records for at least one year after the contractual relationship ends. The RBI has clarified that explicit customer consent must be a specific, informed and unambiguous indication of an individual's choice, given through a duly recorded/documented statement or clear affirmative action, indicating agreement to a specific action by or arrangement with them.
Before selling any complex financial product to an individual customer, the bank must now assess whether the product is actually right for that person through a comprehensive evaluation process. The assessment must weigh the customer's age, income, financial literacy, and risk tolerance against the product's risk profile, fees, tenure, and complexity. After every sale, banks must seek feedback from the customer within 30 days — through call-backs or surveys conducted by a team that had no role in making the sale. The findings must feed into a half-yearly report used to review and improve sales policies. The RBI has specified that mis-selling of a financial product/service includes the sale of a product/service which is neither suitable nor appropriate in view of the customer's profile evaluated at the time of sale, notwithstanding her/his explicit consent; or the sale of a product/service without providing correct or complete information or by giving misleading information; or the sale of a product/service without the customer's explicit consent; or compulsory bundling of another product/service with the sale of the requested product/service; or the sale of a product/service involving any other element defined by the financial sector regulator concerned as mis-selling. Separate application forms must be used for each product in physical mode, and in digital mode, each product must have its own dedicated section and its own separate explicit consent. Product documents must be available in the regional language or a language the customer understands — a provision that matters most for customers in semi-urban and rural branches, who have historically been the most vulnerable to pressure selling.
The new regulations introduce significant restrictions on how banks can work with third-party agents to prevent mis-selling. Agents can only contact customers between 9 AM and 7 PM, cannot visit a customer's home or office without explicit consent, and cannot represent themselves as bank employees. They cannot make false commitments on the bank's behalf and must obtain a written undertaking from DSAs and DMAs that they and their sub-agents will follow the bank's Code of Conduct. Banks and their DSAs must conduct periodic internal audits of all their digital interfaces to identify and remove deceptive practices. The RBI has brought Direct Selling Agents (DSAs) and Direct Marketing Agents (DMAs) directly under the regulatory framework for the first time, requiring banks to publish and maintain an updated list of all empanelled DSAs and DMAs on their website within seven calendar days of any change. Banks now have until December 31 to put in place comprehensive policies, codes of conduct for all sales staff and agents, website disclosures, digital consent architecture, suitability assessment processes, feedback mechanisms, and audit systems for dark patterns. The RBI has asked banks and NBFCs to put in place a comprehensive policy for advertising, marketing and the sale of their own as well as third-party financial products/services, covering aspects related to criteria for the determination of suitability and appropriateness of products/services offered to customers, feedback mechanism, customer compensation in cases of mis-selling, and other related matters.
