RBI Consent Rules for BFSI: Advisory 3/2026 and the 1 January 2027 Business Conduct Directions

RBI Moved on Consent Ahead of the DPDP Deadline

Banks and Non-Banking Financial Companies have a date on the calendar before the DPDP Act 2023 obligations take effect on 13 May 2027. The Reserve Bank of India advanced its consent expectations through two separate instruments. One is supervisory guidance in circulation since March 2026. The other is binding direction with a fixed commencement: the Responsible Business Conduct Second Amendment Directions, 2026 were notified on 15 June 2026 and come into effect on 1 January 2027.

The distinction between the two still matters. One is the expectation an inspector measures you against. The other is binding direction with a commencement date four months before the DPDP Act’s. This guide separates them and sets out the position a Board must be able to report against both.

What RBI Already Expects: Advisory No. 3/2026

RBI Advisory No. 3/2026, issued by the Department of Supervision on March 25, 2026, is real and in circulation. It followed a thematic study across supervised entities and reads as supervisory best practice rather than a binding direction. It directs regulated entities toward three things:

• Centralized consent management. The requirement, as rendered in KPMG’s published analysis of the Advisory: a unified platform that captures, tracks, and updates customer consent consistently, and in an auditable manner.
• Automated data discovery. Tooling to find and classify personal data across systems rather than relying on manual inventory.
• Board-level accountability. Data protection treated as a standing Board agenda item, not a project owned three layers down.

The Advisory is guidance, not a penalty provision. Its weight comes from what it signals. It is the supervisory expectation banks and NBFCs are now measured against during inspection. The answer “we are evaluating our options” is not a position against that expectation.

From 1 January 2027: The Business Conduct Second Amendment Directions

The second instrument is the Reserve Bank of India (Commercial Banks - Responsible Business Conduct) Second Amendment Directions, 2026 (RBI/2026-27/115, DOR.MCS.REC.No.94/01-01-032/2026-27). The draft of 12 February 2026 proposed a 1 July 2026 start. The final Directions were notified on 15 June 2026 and come into effect on 1 January 2027. The parallel Non-Banking Financial Companies Second Amendment Directions (RBI/2026-27/123) were notified the same day with the same commencement date.

From 1 January 2027, the Directions require:

• Explicit consent for each product or service. New paragraph 4(13A) defines explicit consent as a specific, informed and unambiguous indication of choice, given through a recorded statement or clear affirmative action. Paragraph 85G allows products and services, own or third-party, to be offered or sold only with that consent, and where one form covers several products, each must be enumerated with the option to choose only the desired ones.
• A ban on compulsory bundling and on dark patterns. Paragraph 85V prohibits compulsory bundling of any third-party product with the bank’s own; paragraph 4(10.1A) defines dark patterns, and the examples include a pre-checked opt-out box. The single checkbox that covers everything no longer satisfies the standard.
• A retained consent record. Consent and related records for a product or service must be stored for one year from the date the contract for it ends.

The framing changed once since the draft circulated: the proposal became a notified direction with a fixed date, and the date moved from 1 July 2026 to 1 January 2027. An institution without per-product, auditable consent capture has one quarter of lead time, not a grace period.

Why the Pressure Concentrated in This Window

Two unrelated events landed in the same window for BFSI compliance teams. The 15 June 2026 notification of the Directions, with its 1 January 2027 start, is one. The other is commercial: a competing compliance platform’s free enrollment period ended June 30, 2026, after which new customers face a list price near ₹50 lakh per year. Organizations that onboarded for free face a migration decision in the same months the Directions were notified. The two pressures point at the same action: put real consent infrastructure in place now.

The Two-Instrument Gap Analysis

Use this framework to position your institution against both instruments. The left column is what RBI expects under the Advisory. The middle column is what the Directions require from 1 January 2027. The right column is the readiness action that satisfies both.

Consent area	RBI expects (Advisory 3/2026)	Directions require (from 1 January 2027)	Readiness action
Consent capture	Centralized consent mechanism	Affirmative, auditable consent per interaction	Single consent record of truth, timestamped and retrievable
Bundled consent	Move away from blanket consent	Ban on compulsory bundling and dark patterns, including pre-checked boxes	Replace the single checkbox with per-purpose capture
Per-product consent	Implied by centralization	Separate consent for each product	Map products to purposes, capture consent per purpose
Consent record	Track and update consent	Consent records kept for one year after the contract ends	Timestamped consent record with retention built in
Data discovery	Automated discovery and classification	Supports the consent and audit obligations	Automated personal-data inventory across systems
Accountability	Board-level data protection agenda	Auditable digital trail for supervisory review	Board-ready readiness report, generated not assembled

The pattern is consistent across both instruments. The institution that holds a centralized consent record and per-product consent architecture is ready for both.

What BFSI Should Do Now

1. Brief the Board on both instruments. Advisory 3/2026 is the supervisory expectation in force since March 2026. The Business Conduct Directions bind from 1 January 2027. They are two reporting lines, not one blurred date.
2. Inventory consent capture. Identify every point where customer consent is collected and whether it is per-product or bundled. Bundled consent is the first thing both instruments target, and from 1 January 2027 compulsory bundling is a directions breach, not a best-practice gap.
3. Stand up a single consent record. Centralization is the one expectation common to the Advisory and the Directions. It is the single move that satisfies the most obligations at once.
4. Document the readiness position. An inspector or a Board reporting cycle needs a documented, verifiable answer, not an in-progress consultant engagement.

The retention and erasure conflict that NBFCs face under RBI and PMLA mandates sits alongside this. For that dimension, see the RBI-DPDP retention conflict guide, NBFC DPDP compliance, and the Compliance Vault approach to statutory retention versus DPDP erasure.

RBI has since added a third instrument to the stack. The July 2026 draft Guidance on Regulatory Expectations for Data Governance puts data governance in front of the board and writes DPDP compliance into the framework it expects every regulated entity to run. Comments close on August 17, 2026.

Get Your Position Scored

The fastest way to know where your institution sits against these consent expectations is to score it. Run the free DPDP Gap Assessment. It returns a compliance score and a report you can take into a Board reporting cycle, mapped to the obligations above. For a documented, examination-ready position, see the NBFC readiness page.