RBI's new advertising and mis-selling rules from 1 January 2027: what fintech and NBFC marketing teams must change

RBI's new advertising and mis-selling rules from 1 January 2027: what fintech and NBFC marketing teams must change

Last updated: 8 Oct 2026, 11:45 PM IST. Based on RBI's directions of 15 June 2026. We'll update this post if RBI issues clarifications or FAQs.

Short answer: From 1 January 2027, RBI's amended Responsible Business Conduct Directions require banks, NBFCs and housing finance companies to check suitability before selling, take explicit consent per product (default "No"), show interest rates and fees in ads, drop compulsory bundling and dark patterns, and control their DSAs and DMAs. Proven mis-selling means a full refund plus compensation.

What changes on 1 Jan 2027	What RBI's NBFC directions say	NBFC para
Ads must show the price	Advertising materials "shall disclose the interest rate and other fees / charges associated with the financial product / service being promoted"	101K
Consent per product, default "No"	Each product "shall be clearly enumerated" and "the default choice for the customer to give consent shall be 'No' / 'I do not agree'"	101G, 101I
Promotional messages need consent	Promotions go to a customer "only if he / she has given explicit consent to receive such communication / alerts"	101L
No compulsory bundling	An NBFC "shall not resort to compulsory bundling of any TPPS with any of its own product / service"	101V
No dark patterns	User interfaces of the NBFC and its DSA / DMA must not "deploy any dark pattern", with user testing and periodic internal audit	101X
Suitability checks	Suitability is judged against "the customer's age, income, level of financial literacy, risk tolerance, etc."	101P
DSA / DMA controls	A public list of DSAs / DMAs, updated "within seven calendar days", and a Code of Conduct they sign up to	101C, 101F
Refund plus compensation	If mis-selling is established, a refund of "the entire amount paid" plus compensation "for any loss arising due to mis-selling"	101Z

Sources: RBI press release, 15 June 2026; NBFC Responsible Business Conduct Second Amendment Directions, 2026. Commercial banks have the same rules as paragraphs 85A to 85ZA of their own amendment directions.

If you run growth or marketing for a lender, a co-branded card, a lending app or a fintech that sources customers for a bank or NBFC, this changes your ad creatives, landing pages, lead forms, app screens, WhatsApp and SMS campaigns, and partner contracts. Here's what RBI actually wrote, and a checklist you can work through before January.

What did RBI issue, and when does it take effect?

On 15 June 2026, RBI issued final amendment directions on "Advertising, Marketing and Sale of Financial Products and Services by Regulated Entities", after a draft published on 11 February 2026 and public feedback (RBI press release). In RBI's words, they are "comprehensive instructions on advertising, marketing and sale of financial products and services (including third-party products and services) by banks and NBFCs", covering "activities of Direct Selling Agents (DSAs) / Direct Marketing Agents (DMAs), dark patterns, prevention of mis-selling, etc."

All of them "shall come into effect from January 1, 2027." That's the date in the press release, and in the commencement clauses of the commercial bank, NBFC and HFC directions we read.

The rules cover your own products and third-party products you sell, such as insurance or investments sold alongside a loan or account.

Who do the new rules cover?

RBI issued ten sets of Responsible Business Conduct amendment directions on the same day (press release), covering:

• Banks: commercial banks, small finance banks, payments banks, local area banks, regional rural banks, and urban and rural co-operative banks
• All India Financial Institutions
• NBFCs: all NBFCs "excluding Core Investment Companies, NBFC-Account Aggregators, Non-Operative Financial Holding Companies, and NBFCs not having any customer interface" (NBFC directions). The new chapter also applies to NBFC-P2P lending platforms, mortgage guarantee companies and standalone primary dealers.
• Housing finance companies: the HFC directions replace HFCs' old advertising and DSA rules with one line: an HFC "shall ensure compliance with the provisions of paragraphs 101A to 101ZA" of the NBFC directions.

Does this apply to a fintech that isn't regulated by RBI?

Not directly, but in practice, yes. The rules bind the bank or NBFC, and that lender must apply them to anyone who markets for it. RBI defines a DSA / DMA as anyone "(other than an NBFC's own employee) engaged by an NBFC, irrespective of the contractual designation / nomenclature used for such engagement (such as Loan Service Provider (LSP), etc.), to sell or market / promote / influence customers". The bank version also names Business Correspondents.

So a lending app, marketplace or lead-generation partner that sources customers for a lender is treated as a DSA / DMA. The dark-pattern rule also names you directly: "An NBFC and its DSA / DMA shall ensure that their user interfaces do not deploy any dark pattern." Expect your lending partners to update contracts, audits and approvals before January.

What counts as mis-selling under the new rules?

RBI now defines mis-selling. It's the sale of a product, own or third-party (NBFC directions, para 6(9A)):

1. "which is neither suitable nor appropriate in view of the customer's profile evaluated at the time of sale, notwithstanding her / his explicit consent"
2. "without providing correct or complete information or by giving misleading information"
3. "without customer's explicit consent"
4. with "compulsory bundling of another product / service with sale of the requested product / service"
5. involving anything else the relevant financial regulator defines as mis-selling

Note the words "notwithstanding her / his explicit consent". A ticked box doesn't protect an unsuitable sale.

What do the rules require, point by point?

Paragraph numbers below are from the NBFC directions. Commercial banks have the same text at paragraphs 85A to 85ZA.

Suitability: who can you sell to?

Before selling a product to an individual, other than products the lender's policy marks as suitable for all customers, "its suitability and appropriateness for the customer shall be determined... based on an analysis of the features, risk-return attributes, time horizon, complexity, fee structure, etc. vis-à-vis the customer's age, income, level of financial literacy, risk tolerance, etc." (101P). The lender's advertising, marketing and sales policy must set the suitability criteria (101A).

For marketing: targeting and offers need to line up with those criteria. Blasting a pre-approved offer to everyone in a list doesn't, if the product isn't on the "suitable for all" list.

Consent: what does "explicit" and "separate" mean?

RBI defines explicit consent as "a specific, informed and unambiguous indication of an individual's choice, given through a duly recorded / documented statement or clear affirmative action" (6(4A)). In practice:

• How: "a signed declaration (either physically or electronically), OTP based approval, digitally recorded confirmation, consent embedded in a clearly demarcated section of the agreement", etc. (101G)
• One product at a time: on a single form, "each product / service shall be clearly enumerated and the customer shall have the option to choose only the desired product(s) / service(s)" (101G). In digital forms, each product needs "a dedicated section / module" and "explicit consent for each product / service" (101Q).
• No skipping the terms, and default "No": consent "cannot be granted by the user without going through the applicable terms and conditions", and "the default choice for the customer to give consent shall be 'No' / 'I do not agree'" (101I).
• Keep the records: consent records must be kept "till one year from the date of cessation of the contractual agreement" (101G).
• Marketing messages need their own consent: promotional communication goes out "only if he / she has given explicit consent" (101L), and unsubscribing must be "easy and simple" (101M).

Rates and fees: what must every ad and landing page show?

• Ads: "all its advertising / promotional materials such as pamphlets, brochures, etc., whether in physical or digital form, are clear and factual. Such materials shall disclose the interest rate and other fees / charges associated with the financial product / service being promoted." Terms "shall be prominently disclosed at all points of sale / digital channels such as website, mobile app, etc." (101K)
• At consent: prominently disclose "fees / charges / interest rate, etc., risks involved, financial commitment for the customer, lock in conditions, exit terms including penalties", using the KFS or MITC format where one is prescribed (101H).
• Sales staff and agents must "make upfront disclosure regarding the fees / charges, interest rate, etc." (101N(1)).
• Third-party products: you can't "advertise / market any TPPS as its own" and must clarify your role (101J).

RBI's dark-pattern list also names the familiar tricks: "Advertising a lower interest rate initially and charging a higher interest rate at the time of actually applying for a loan" (bait and switch), and "Not revealing processing fees and other charges upfront" (drip pricing).

Bundling: can you still sell insurance with a loan?

Only by choice. Compulsory bundling means making one product "conditional upon availment of another product / service" (6(1A)). An NBFC "shall not resort to compulsory bundling of any TPPS with any of its own product / service" (101V). Where a third-party product is genuinely needed "as a risk mitigant", the customer must be able to buy it "from any TPPS Provider". Voluntary packages and genuinely free add-ons aren't compulsory bundling. A lender also can't fund a product "out of any loan facility sanctioned to the customer without her / his explicit consent" (101W).

Dark patterns: what's banned in your app and funnels?

Dark patterns are design that "mislead or trick users to do something they originally did not intend or want to do" (6(2A)). Lenders and their DSAs / DMAs must not use them, must run "user testing and periodic internal audit" of their interfaces, and must follow the CCPA's "Guidelines for Prevention and Regulation of Dark Patterns, 2023" (101X).

RBI's annex lists 11 patterns, with examples that read like a growth team's playbook:

• False urgency: "Displaying countdown timers on the NBFC's website or app for promotional offers / cashback / reward points", and "Using phrases like 'Act Now', 'Hurry', 'Limited Time Only', or 'Offer Ends Soon'"
• Basket sneaking: "adding protection against online fraud / loan protection insurance by default during the loan application process"
• Confirm shaming: opt-out buttons like "No, I don't want extra security for my account"
• Forced action: pop-ups that "cannot be closed without redirection", or asking for contacts, camera or location access the service doesn't need
• Subscription trap: easy sign-up, but cancellation buried with "multiple confirmation steps"
• Interface interference: "Default choice for consent being 'Yes'", or the lender's preferred option in "bright colours / bold fonts"
• Bait and switch and drip pricing: see the rates section above
• Disguised advertisement: promos dressed up as alerts, such as "Important: Your account might benefit from this new feature!"
• Nagging and trick wording: for example, "Uncheck this box if you do not want to receive offers"

DSAs and DMAs: what controls do lenders need?

• A policy covering DSA / DMA "eligibility criteria, due diligence at the pre and post-engagement level, training... performance evaluation standards, inspection / audit" and penalties (101B)
• An up-to-date public list of DSAs / DMAs on the website, with type, address, period of engagement and products, updated "within seven calendar days of any modification" (101C)
• A Code of Conduct, published on the website, signed up to by DSAs / DMAs before they start, with penalties written into the agreement (101F)
• Calls and visits "normally between 09:00 hours and 19:00 hours", unless the customer asks otherwise; no home or office visits without explicit consent; no misleading or coercing (101N)
• Agents can't "falsely represent themselves" as the lender's employees (101O)
• Lenders must also follow TRAI's commercial communication rules (TCCCPR, 2018) (101ZA)

Refunds and compensation: what happens if a sale goes wrong?

• Complaints: customers can complain within the timeline set by the relevant regulator or, if none is set, "within 30 days of receiving the signed copy of the terms and conditions / agreement" (101Z)
• Refund plus compensation: if mis-selling is established, the lender "shall refund the entire amount paid by the customer" and "compensate the customer, for any loss arising due to mis-selling, as per its approved policy" (101Z)
• Feedback within 30 days of every sale to check the customer understood the product and its risks, run by a team "not associated with sale of products / services", with a half-yearly report (101Y)
• Incentives: policies and practices must not "create incentives for mis-selling" (101U). Sales targets and agent commissions are in scope.

What should marketing teams change before 1 January 2027?

A practical checklist. Agree each item with your compliance team, because they own the interpretation.

Ads, landing pages and content

• ☐ Every ad and landing page for a financial product shows the interest rate and the other fees and charges, not just "from x%" (101K)
• ☐ The rate in the ad matches the rate at application, and processing fees appear upfront (no bait and switch or drip pricing)
• ☐ Remove countdown timers and "Act Now", "Hurry", "Limited Time Only" and "Offer Ends Soon" from financial-product creatives
• ☐ Third-party products (insurance, investments) are labelled with the provider's name and your role (101J)
• ☐ Terms are linked prominently on the website and app (101K)
• ☐ Push notifications and emails that are promotions don't look like account alerts

Lead forms, consent and onboarding

• ☐ Every consent box is unticked by default ("No / I do not agree") (101I)
• ☐ Users can't consent without reaching the terms (101I)
• ☐ Each product, including add-on insurance, has its own section and its own consent (101G, 101Q)
• ☐ Consent records (OTP, timestamp, version of the terms shown) are stored until one year after the contract ends (101G)
• ☐ Key facts, including fees, risks, lock-in and exit penalties, appear before consent, in KFS or MITC format where one is prescribed (101H)
• ☐ An acknowledgement with a contact phone number goes out after every application (101S)
• ☐ App permissions (contacts, camera, location) are asked only where needed and explained

Campaigns: SMS, WhatsApp, email and calls

• ☐ Promotional messages go only to customers with recorded marketing consent (101L)
• ☐ Unsubscribing takes one step, with no confirm shaming (101M)
• ☐ Calls run normally between 09:00 and 19:00 (101N(4))
• ☐ DND preferences flow from agents back to the lender (101N(7))
• ☐ Templates are approved by the lender: agents send "only in the mode and format approved" (101N(3))

Partners, DSAs, DMAs and affiliates

• ☐ List everyone who markets for you, including LSPs, lead-gen partners, affiliates and agencies. They may count as DSAs / DMAs
• ☐ Publish the DSA / DMA list on the website and set up a 7-day update process (101C)
• ☐ Get partners to sign the Code of Conduct, and add penalties to agreements (101F)
• ☐ Audit partner landing pages and apps for dark patterns, not just your own (101X)

Targeting, incentives and after the sale

• ☐ Map campaign audiences to the lender's suitability criteria (101P)
• ☐ Review sales and agent incentives for anything that rewards mis-selling (101U)
• ☐ Set up 30-day post-sale feedback through a non-sales team (101Y)
• ☐ Put user testing and a periodic internal audit of journeys on the calendar (101X)

How can Vilva Business help?

Vilva Business (Vilva Networks), Chennai is a technology and marketing partner. We are not an RBI-regulated entity, and your compliance team and legal counsel decide what meets the directions. Where we can help:

• Landing pages and campaigns: our digital marketing team can review and rebuild landing pages, ad creatives and lead flows against the checklist above.
• Onboarding journeys: our fintech team builds customer portals and digital onboarding suites with audit trails.
• Verification steps: the Vilva Verification API covers KYC, bank and business checks, plus confirmation of e-signatures, consent tokens and digital authorisations.

FAQ

When do RBI's new advertising and mis-selling rules take effect?

On 1 January 2027. RBI issued the final amendment directions on 15 June 2026, after a draft in February 2026, and the directions for commercial banks, NBFCs and housing finance companies all say they come into effect on 1 January 2027.

Do the rules apply to NBFCs and housing finance companies?

Yes. They apply to all NBFCs except Core Investment Companies, NBFC-Account Aggregators, Non-Operative Financial Holding Companies and NBFCs without a customer interface. They also apply to NBFC-P2P platforms, and housing finance companies must follow the same NBFC paragraphs.

Do they apply to fintechs and loan service providers?

Indirectly. RBI's definition of a DSA or DMA covers anyone engaged by a bank or NBFC to sell, market or influence customers, whatever the contract calls them, and names loan service providers as an example. Lenders must control their DSAs and DMAs, and both must avoid dark patterns.

Do ads now need to show interest rates and fees?

Yes. RBI says advertising and promotional materials, physical or digital, must be clear and factual and disclose the interest rate and other fees and charges for the product being promoted. Terms and conditions must be prominently disclosed on websites and apps.

Can a lender still sell insurance with a loan?

Only with the customer's choice. Compulsory bundling of a third-party product is banned. If insurance is genuinely needed as a risk mitigant, the customer must be free to buy it from any provider. Each product needs its own explicit consent, and add-ons can't be pre-selected.

Are countdown timers and "limited time" offers banned?

For financial products, RBI lists them as examples of false urgency, which is a dark pattern. Its examples include countdown timers for offers or cashback and phrases like Act Now, Hurry, Limited Time Only and Offer Ends Soon. Lenders and their DSAs and DMAs must not use dark patterns.

What happens if mis-selling is established?

The lender must refund the entire amount the customer paid for the product, inform the customer of the cancellation where applicable, and compensate the customer for any loss under its approved policy. Where no regulator sets a deadline, customers can complain within 30 days of receiving the signed terms.

Audit your fintech landing pages and lead flows before January. Vilva Business (Vilva Networks), Chennai can review your ads, landing pages, lead forms and partner journeys against this checklist. Book a demo.

This article summarises RBI directions in plain language for marketing teams. It isn't legal or regulatory advice. Check how the directions apply to your entity and products with your compliance team or legal counsel. Quotes are from RBI's directions of 15 June 2026, as published on rbi.org.in on 8 Oct 2026.