RBI Consent Rules for BFSI: The 1 January 2027 Business Conduct Directions

RBI Moved on Consent Ahead of the DPDP Deadline

Banks and Non-Banking Financial Companies have a date on the calendar before the DPDP Act 2023 obligations take effect on 13 May 2027. The Responsible Business Conduct Second Amendment Directions, 2026 were notified on 15 June 2026 and come into effect on 1 January 2027.

The Directions are binding, and they commence four months before the DPDP Act’s obligations. This guide sets out what they require and the position a Board must be able to report against them.

From 1 January 2027: The Business Conduct Second Amendment Directions

The commercial bank instrument is the Reserve Bank of India (Commercial Banks - Responsible Business Conduct) Second Amendment Directions, 2026 (RBI/2026-27/115, DOR.MCS.REC.No.94/01-01-032/2026-27). The draft of 12 February 2026 proposed a 1 July 2026 start. The final Directions were notified on 15 June 2026 and come into effect on 1 January 2027. The parallel Non-Banking Financial Companies Second Amendment Directions (RBI/2026-27/123) were notified the same day with the same commencement date.

From 1 January 2027, the Directions require:

• Explicit consent for each product or service. New paragraph 4(13A) defines explicit consent as a specific, informed and unambiguous indication of choice, given through a recorded statement or clear affirmative action. Paragraph 85G allows products and services, own or third-party, to be offered or sold only with that consent, and where one form covers several products, each must be enumerated with the option to choose only the desired ones.
• A ban on compulsory bundling and on dark patterns. Paragraph 85V prohibits compulsory bundling of any third-party product with the bank’s own; paragraph 4(10.1A) defines dark patterns, and the examples include a pre-checked opt-out box. The single checkbox that covers everything no longer satisfies the standard.
• A retained consent record. Consent and related records for a product or service must be stored for one year from the date the contract for it ends.

The framing changed once since the draft circulated: the proposal became a notified direction with a fixed date, and the date moved from 1 July 2026 to 1 January 2027. An institution without per-product, auditable consent capture has one quarter of lead time, not a grace period.

Why the Pressure Concentrated in This Window

Two unrelated events landed in the same window for BFSI compliance teams. The 15 June 2026 notification of the Directions, with its 1 January 2027 start, is one. The other is commercial: a competing compliance platform’s free enrollment period ended June 30, 2026, after which new customers face a list price near ₹50 lakh per year. Organizations that onboarded for free face a migration decision in the same months the Directions were notified. The two pressures point at the same action: put real consent infrastructure in place now.

The Directions Gap Analysis

Use this framework to position your institution against the Directions. The left column is what the Directions require from 1 January 2027. The right column is the readiness action.

Consent area	Directions require (from 1 January 2027)	Readiness action
Consent capture	Affirmative, auditable consent per interaction	Single consent record of truth, timestamped and retrievable
Bundled consent	Ban on compulsory bundling and dark patterns, including pre-checked boxes	Replace the single checkbox with per-purpose capture
Per-product consent	Separate consent for each product	Map products to purposes, capture consent per purpose
Consent record	Consent records kept for one year after the contract ends	Timestamped consent record with retention built in

An institution that holds per-product consent in a single, retrievable record, kept for one year after each contract ends, has the record the Directions ask for.

What BFSI Should Do Now

1. Brief the Board on two dates. The Business Conduct Directions bind from 1 January 2027. The DPDP Act’s obligations commence on 13 May 2027. They are two reporting lines, not one blurred date.
2. Inventory consent capture. Identify every point where customer consent is collected and whether it is per-product or bundled. Bundled consent is a direct target of the Directions, and from 1 January 2027 compulsory bundling is a directions breach, not a best-practice gap.
3. Stand up a single consent record. A per-product consent record, kept for one year after the contract ends, is what the Directions ask an institution to produce.
4. Document the readiness position. An inspector or a Board reporting cycle needs a documented, verifiable answer, not an in-progress consultant engagement.

The retention and erasure conflict that NBFCs face under RBI and PMLA mandates sits alongside this. For that dimension, see the RBI-DPDP retention conflict guide, NBFC DPDP compliance, and the Compliance Vault approach to statutory retention versus DPDP erasure.

RBI has since added a second instrument to the stack. The July 2026 draft Guidance on Regulatory Expectations for Data Governance puts data governance in front of the board and writes DPDP compliance into the framework it expects every regulated entity to run. Comments close on August 17, 2026.

Get Your Position Scored

The fastest way to know where your institution sits against these consent expectations is to score it. Run the free DPDP Gap Assessment. It returns a compliance score and a report you can take into a Board reporting cycle, mapped to the obligations above. For a documented, examination-ready position, see the NBFC readiness page.