About This Webinar
RBI + DPDP: One customer journey, connected compliance obligations
The Reserve Bank of India’s Business Conduct Amendment Directions introduce significant changes to how regulated financial institutions approach customer consent, digital interfaces, product bundling, suitability, mis-selling, and third-party relationships. With the relevant directions taking effect on January 1, 2027, bank and NBFC compliance teams need to assess how these requirements translate into day-to-day operations.
At the same time, India’s Digital Personal Data Protection (DPDP) framework calls for clearer controls over personal data, consent, processing purposes, Data Principal rights, and accountability.
For financial institutions, these are not two isolated compliance programmes. The same customer journey can involve loan applications, credit profiling, insurance cross-selling, digital consent, assisted onboarding, and data shared with DSAs, LSPs, and other partners. Each interaction raises questions about customer choice, permitted data use, ownership, and the evidence available to demonstrate compliance.
This on-demand webinar brings together the RBI Business Conduct Directions and DPDP through a practical BFSI lens. It explores what needs to change across customer journeys, technology systems, third-party relationships, and internal governance, and how institutions can move beyond documented policies to demonstrable operational readiness.
This Webinar Covers
- Customer consent and onboarding:How RBI and DPDP requirements intersect across digital, assisted, and branch-led journeys.
- Dark patterns and anti-bundling:What the restrictions mean for customer choice, cross-selling, product recommendations, and digital lending journeys.
- Data governance and profiling:How institutions should approach purpose limitation, customer profiling, product suitability, and downstream data use.
- Third-party accountability: What effective governance looks like across DSAs, LSPs, fintech partners, and third-party product providers.
- DPARs and audit trails:How to connect customer-facing controls with data principal rights workflows, processing records, and evidence.
- January 1, 2027 readiness:What legal, business, operations, and technology teams should prioritise to prepare for the applicable RBI requirements.
Why Watch This Now?
- Bank and NBFC compliance is moving beyond policy documentationCompliance teams need to understand how regulatory requirements translate into actual customer journeys, system behaviour, business decisions, and evidence. Updated policies alone will not resolve gaps in onboarding, consent capture, product suitability, or downstream data handling.
- Dark patterns in India’s financial services journeys need closer scrutinyDigital interfaces influence how customers accept terms, select products, and exercise choice. Institutions need to assess whether interface design, consent defaults, product bundling, or sales practices undermine meaningful customer choice under the applicable RBI directions.
- RBI and DPDP obligations meet inside operational systemsCRM platforms, loan origination systems (LOS), loan management systems (LMS), consent systems, and third-party integrations need to work together. A customer’s consent or withdrawal cannot be treated as an isolated record if it affects how data is subsequently processed.
- Third-party compliance requires more than a contractDSAs, LSPs, fintech partners, and other service providers may participate in critical parts of the customer journey. Institutions need visibility into their data handling, contractual obligations, risk controls, retention, deletion, and ability to demonstrate that instructions are being followed.
- The January 2027 deadline calls for cross-functional actionLegal, compliance, risk, business, technology, and operations teams need a shared view of what is required, what is already working, and where gaps remain. This session helps leaders identify the questions to resolve before implementation timelines become more difficult to manage.
Puja Deshpande
Head of Privacy Implementation
IDfy
Gowree Gokhale
Solicitor & Advocate
Rahul Vithani
Vice President & Head of Data Privacy
TATA Capital
FAQs
NBFC compliance involves meeting the Reserve Bank of India's regulatory requirements for the conduct of non-banking financial companies. The 2026 Business Conduct Amendment Directions introduce requirements affecting customer consent, digital interfaces, product bundling, suitability, mis-selling, and third-party relationships. The relevant directions take effect on January 1, 2027. Institutions should assess the applicable requirements against their customer journeys, processes, and technology systems.
The directions require regulated entities to review how they engage with customers, offer products, capture consent, design digital interfaces, assess product suitability, and govern third-party relationships. The operational impact can extend across onboarding, sales, cross-selling, CRM, loan origination, and vendor management. Institutions should map each applicable requirement to the relevant business process, system control, accountable owner, and supporting evidence.
RBI's Business Conduct Directions govern specified aspects of regulated financial institutions' conduct, including customer treatment, product sales, consent, and third-party engagement. The DPDP framework governs the processing of digital personal data, including consent where required, data principal rights, and data fiduciary responsibilities. The two frameworks address different legal obligations, so compliance with one should not automatically be treated as satisfying the other. Institutions need to assess the requirements together wherever they intersect.
Dark patterns are deceptive or manipulative interface practices that can undermine a person's ability to make a free and informed choice. In financial services, these risks may arise through misleading urgency, forced actions, confirm shaming, or interfaces that obscure meaningful alternatives. Banks and NBFCs should assess customer-facing journeys against the applicable RBI requirements, including relevant restrictions on dark patterns, and ensure that product selection and consent flows support genuine customer choice.
Digital lending requirements and applicable RBI business conduct rules can affect how lenders present loan products, optional services, insurance, and other third-party offerings. Institutions should review whether customers can make independent choices, whether applicable consent is purpose-specific, and whether access to a primary product is improperly conditioned on accepting an additional product. The precise obligations depend on the applicable direction and product context.
shivani@idfy.com
Unit no. 801, Skyline Icon, 804, Andheri - Kurla Rd, Chimatpada, Marol, Andheri East, Mumbai, Maharashtra 400059
1800 123 4339
