Thursday, 3 September 2026

Requirement for Fund Management Entities (FMEs) to maintain a website or webpage

The International Financial Services Centres Authority (“IFSCA”) issued the Circular File No. IFSCA-SOF/2/2026-Capital Markets dated 26 August 2026, requiring Fund Management Entities (“FMEs”) registered under the IFSCA (Fund Management) Regulations, 2025 (“FM Regulations, 2025”) to maintain an official website or webpage.

The Circular is intended to strengthen transparency, investor access to information and dissemination of information relating to FMEs and their operations in the IFSC. The Circular is scheduled to come into force on 1 December 2026.

1. FMEs covered by the Circular

The website requirement applies to every FME registered under the FM Regulations, 2025. However, the nature of the website requirement differs depending upon the category of FME.

Category of FME	Website requirement
Authorised FME	Independent official website or dedicated webpage on parent/holding/group entity's website
Registered FME (Non-Retail)	Independent official website or dedicated webpage on parent/holding/group entity's website
Registered FME (Retail)	Independent official website dedicated to its fund management activities in the IFSC

These requirements are expressly set out in clauses 2 and 3 of the Circular.

Key distinction

The Circular provides greater flexibility to Authorised FMEs and Registered FMEs (Non-Retail) by permitting them to use a dedicated webpage on the website of their parent, holding or group entity.

However, a Registered FME (Retail) must maintain an independent official website dedicated to its IFSC fund management activities.

This distinction is significant because Retail FMEs are subject to substantially more extensive public disclosure requirements.

2. Basic requirements applicable to the website/webpage

The website or webpage must satisfy certain minimum accessibility and identification requirements.

Public accessibility

The information specified under the Circular must be publicly accessible without registration, subscription or login.

Therefore, FMEs should not place mandatory regulatory disclosures behind investor logins or restricted-access sections.

Clear identification of the FME

The website/webpage must prominently identify:

the FME by the name under which it is registered with IFSCA;
its IFSCA registration number; and
its IFSC activities distinctly from other activities of the parent, holding or group entity.

Where a group or parent website is being used, the dedicated FME webpage must therefore be sufficiently distinct to avoid confusion between the IFSC-regulated activities and other businesses of the group.

Link from parent/group website

Where an FME uses a webpage hosted on the website of its parent, holding company or group entity, that webpage must be accessible through a conspicuously identifiable link on the host website's home page.

3. Mandatory disclosures by all FMEs

Clause 4 establishes a fairly comprehensive disclosure framework.

The website/webpage must prominently display the following:

A. Profile and registration details

The FME must provide:

brief profile;
category of registration; and
IFSCA registration number.

B. Contact details

The following must be disclosed:

registered office address in the IFSC;
correspondence address;
telephone number; and
email address.

C. Funds and schemes managed

Details of schemes or funds managed from the IFSC must be disclosed.

Where the FME undertakes portfolio management services or another activity permissible under the FM Regulations, 2025, details of such activities must also be disclosed, wherever applicable.

D. Third-party fund management arrangements

Where the FME manages a scheme or fund for another person or investment manager not based in the IFSC, the FME must disclose:

name of each scheme/fund; and
its IFSCA registration number.

This is particularly relevant given the development of third-party fund management arrangements within the IFSC regulatory framework.

E. Service providers

The names and contact particulars of the following must be disclosed, wherever applicable:

Custodian;
Trustee;
Fund Administrator; and
Statutory Auditor.

4. Investor grievance disclosures

One of the more important provisions relates to investor grievance redressal.

The website must contain:

investor grievance redressal mechanism;
contact details of the Grievance Redressal Officer;
escalation matrix;
timelines for redressal; and
status of investor complaints received, disposed of and pending.

The complaint status must be updated quarterly.

Compliance implication

This effectively converts the website into an ongoing investor-facing compliance and disclosure platform, rather than merely a corporate information webpage.

FMEs will consequently need an internal process to ensure that grievance information is periodically reviewed and updated.

5. Key managerial personnel disclosures

The website must also disclose the:

name;
designation;
email address; and
telephone number

of the Principal Officer, Compliance Officer and other Key Managerial Personnel responsible for IFSC operations, wherever applicable.

This enhances accountability by making the individuals responsible for regulatory and operational functions identifiable to investors and stakeholders.

6. Regulatory and enforcement disclosures

The Circular also introduces an important transparency requirement concerning regulatory actions.

The FME must disclose details of any material regulatory or enforcement action taken against:

the FME; or
its key managerial personnel,

in relation to the FME's IFSC operations during the preceding three years, along with the current status of such action.

This is a significant disclosure requirement from an investor-protection perspective, as it requires relevant regulatory history to be made publicly accessible.

7. Mandatory regulatory disclaimer

The website must contain a statement clarifying that:

Registration with IFSCA does not imply approval or endorsement by IFSCA.

The disclaimer must also clarify that registration does not constitute approval or endorsement of:

the FME;
any scheme; or
the financial soundness or performance of the FME/scheme.

FMEs should ensure that this disclaimer is prominently displayed, rather than buried in general website terms and conditions.

8. Additional requirements for Retail FMEs

Registered FMEs managing Retail Schemes have significantly greater disclosure obligations.

In addition to the disclosures applicable to all FMEs, their official website must prominently disclose:

Scheme documentation

Scheme Information Documents;
Key Information Documents;
addenda; and
other scheme-related documents specified by IFSCA.

Periodic scheme disclosures

These include:

portfolio disclosures;
scheme performance;
comparison with the stated benchmark;
NAV;
total expense ratio and its components; and
distribution commission.

These disclosures must be made at the periodicity specified by IFSCA.

Valuation policy

The website must disclose the valuation policy, including:

basis for valuation of unlisted or illiquid securities; and
name of the independent valuer, wherever applicable.

Unclaimed amounts

Details of unclaimed redemption and distribution amounts, together with the procedure for claiming them, must be provided.

Investor education

Retail FMEs must also provide:

investor education material;
Investor Charter; and
other investor disclosures specified by IFSCA.

9. Format and accessibility requirements

The Circular goes beyond simply requiring information to be placed on a website.

The disclosed information must:

Be in English

The information under clauses 4 and 5 must be made available in the English language.

Identify monetary information properly

For every monetary figure, the website must state:

currency of denomination; and
date to which the figure relates.

For NAV and cut-off timings, the applicable time zone must also be specified.

Display the date of last update

Each relevant disclosure must carry a clearly visible date indicating when the information was last updated.

This is an important operational requirement because FMEs will need a mechanism for tracking and evidencing periodic updates.

Downloadable and machine-readable information

Information relating to:

NAV;
portfolio; and
expenses

must be made available in downloadable and, to the extent feasible, machine-readable formats.

Minimum three-year accessibility

The information must remain accessible for at least three years from the date of display, including after winding-up of the scheme.

This means FMEs should not treat website updates as simply replacing historical information. A proper website disclosure archive will be necessary.

10. Important compliance timelines

There are two important timelines.

Existing FMEs

Every existing FME must intimate the URL of its website/webpage to IFSCA at:

fme-reporting@ifsca.gov.in

on or before 1 December 2026.

Any subsequent change in the URL must be intimated through the subsequent quarterly reporting filings.

Newly registered FMEs

An FME registered on or after the Circular comes into force must:

comply with the website requirements before commencing fund management activities in the IFSC; and
intimate the website/webpage URL to IFSCA within 30 days of grant of registration.

11. Practical compliance checklist for FMEs

FMEs should ideally begin implementation well before 1 December 2026.

Website readiness

Determine whether an independent website or parent/group webpage is permissible.
Ensure public accessibility without login/subscription.
Display registered name and IFSCA registration number.
Clearly segregate IFSC activities from other group activities.
Provide a prominent link from the parent/group website, where applicable.

Regulatory disclosures

Additional Retail FME requirements

Website governance

Last-updated dates on disclosures.
Currency and relevant date for monetary figures.
Time zone for NAV/cut-off timings.
Downloadable disclosures.
Machine-readable formats wherever feasible.
Three-year historical archive.
Mechanism for retaining information after scheme winding-up.
URL intimation to IFSCA by the prescribed deadline.

12. Professional assessment

The Circular represents a material strengthening of the transparency and investor-disclosure framework for FMEs operating in GIFT-IFSC.

While the immediate requirement is simply expressed as an obligation to maintain a website or webpage, the substantive requirements make the website an important component of the FME's regulatory compliance architecture.

Three aspects are particularly noteworthy.

First, the requirement is not merely a corporate-information requirement. The disclosures encompass investor grievances, KMP details, regulatory/enforcement actions, schemes managed and service providers. The website therefore becomes an important channel for regulatory transparency.

Second, Retail FMEs face substantially higher disclosure obligations. The requirement to publish scheme documents, portfolio and performance information, NAV, expense information, valuation policies and investor-protection material brings a considerably greater degree of public disclosure into the Retail fund management framework.

Third, website governance will itself become a compliance function. The requirements concerning last-update dates, quarterly grievance updates, machine-readable data and three-year retention mean that FMEs should establish internal ownership, review and approval processes for website disclosures rather than treating the website as a conventional marketing platform.

The Circular is therefore best viewed as a move towards greater disclosure discipline, investor protection and regulatory transparency in the IFSC fund management ecosystem.

IFSCA's current Fund Management framework page also shows that this Circular forms part of a broader series of regulatory measures concerning FMEs, including KMP requirements, reporting, third-party fund management and governance of schemes.

Overall conclusion

FMEs should not wait until December 2026 to address the requirement. The preparation involves more than creating a website. It requires identification of all mandatory disclosures, allocation of responsibility for maintaining them, establishment of periodic review/update mechanisms, creation of historical archives and ensuring that the disclosures remain consistent with the FME's regulatory filings and scheme documentation.

For a Company Secretary/compliance professional, this Circular creates a useful opportunity to develop a formal “FME Website & Regulatory Disclosure Compliance Checklist” and periodic review mechanism, particularly for ensuring that regulatory disclosures, KMP particulars, grievance data and historical disclosures remain current and properly archived.

Wednesday, 2 September 2026

Digitisation of FPI Onboarding

The recent SEBI Circular dated 20 August 2026 permitting the submission of a digitally signed Power of Attorney (PoA) as part of the registration process for Foreign Portfolio Investors (FPIs) represents a significant and welcome step towards simplification and digitalisation of the regulatory framework governing FPI onboarding.

Under the revised framework, the requirement of having the Power of Attorney subjected to notarisation, apostillisation or consularisation is effectively dispensed with where the prescribed digitally signed documentation is submitted in accordance with the applicable requirements. This is a particularly important procedural reform, as the traditional process of notarisation, apostillisation or consularisation of documents executed outside India can often be cumbersome, time-consuming and disproportionately expensive, particularly for overseas applicants having to comply with the formalities prescribed by multiple jurisdictions.

The relaxation is therefore likely to substantially reduce the administrative burden associated with FPI registration and facilitate a faster, more efficient and technology-driven onboarding process. More importantly, it reflects a regulatory approach that recognises the realities of cross-border transactions and the need to eliminate procedural requirements that may no longer serve a meaningful regulatory purpose in an increasingly digital environment.

The initiative is also consistent with the broader objective of ease of doing business, particularly in the context of attracting and facilitating foreign investment into India. While appropriate safeguards relating to authenticity, integrity and enforceability of documents must necessarily continue to remain in place, regulatory compliance should, wherever possible, be achieved through technology-enabled verification mechanisms rather than through purely procedural and documentary formalities.

It is hoped that this progressive approach adopted by SEBI will serve as a precedent for other regulators and government authorities, including the Ministry of Corporate Affairs (MCA), Reserve Bank of India (RBI) and other statutory and regulatory bodies dealing with cross-border transactions and foreign entities.

There is considerable scope for reviewing the continuing requirement of notarisation, apostillisation and consularisation of documents executed by foreign parties, particularly where the authenticity and identity of the signatory can be established through reliable digital means or other technology-enabled verification mechanisms.

A calibrated transition towards digitally signed, electronically verifiable and self-certified documentation, supplemented by appropriate risk-based verification wherever necessary, could significantly reduce compliance costs and turnaround time without compromising regulatory oversight.

SEBI’s latest initiative is therefore more than a mere procedural relaxation. It represents a broader shift towards trusting technology, reducing redundant formalities and making regulatory compliance proportionate to the underlying risk. It is hoped that other regulators will take note of this development and similarly examine whether long-standing documentary requirements can be rationalised, thereby making India’s regulatory ecosystem more efficient, predictable and conducive to cross-border investment and business.

Enabling sharing of information by KYC KRA with entities regulated by IFSC

SEBI Circular No. HO/38/15/(7)2026-MIRSD-POD/I/19255/2026 dated August 20, 2026, concerning the sharing of KYC information by SEBI-registered KYC Registration Agencies (KRAs) with entities regulated by the International Financial Services Centres Authority (IFSCA).

1. Background and objective

The Circular has been issued to facilitate interoperability and information sharing between SEBI-registered KRAs and entities regulated by IFSCA. The regulatory mechanism is enabled through Regulation 16A of the SEBI (KYC Registration Agency) Regulations, 2011.

Regulation 16A(1) permits entities regulated by other financial-sector regulators, when specified by SEBI, to access the KRA system for undertaking KYC of their clients. SEBI has now formally specified IFSCA for this purpose.

This represents an important step towards creating greater integration between the KYC infrastructure of India's securities market and the financial ecosystem operating within the International Financial Services Centre (IFSC).

2. What has changed?

The principal regulatory change is that IFSCA-regulated entities are now enabled to access the KRA system maintained by SEBI-registered KRAs for undertaking KYC of their clients.

In practical terms, this means that eligible entities regulated by IFSCA can leverage the existing KRA infrastructure rather than having to operate an entirely independent KYC information-gathering mechanism.

The Circular therefore establishes a regulatory bridge between:

SEBI/KRAs → IFSCA-regulated entities → KYC information

This is particularly relevant to the expanding financial-services ecosystem in the IFSC.

3. Applicability of SEBI KRA Regulations

The Circular makes it clear that once an IFSCA-regulated entity accesses the KRA system, the provisions of the SEBI KRA Regulations, 2011 become applicable to such entity.

This is an important compliance consideration.

Access to the KRA database is therefore not merely a facility or technological integration. The accessing entity must comply with the applicable regulatory framework governing the KRA system.

Accordingly, IFSCA-regulated entities intending to use the KRA infrastructure should ensure that their internal KYC processes, systems, controls and personnel are aligned with the applicable requirements.

4. Compliance with SEBI's KYC framework

The Circular specifically requires all entities accessing the KRA system to follow the guidelines contained in SEBI's Master Circular dated October 12, 2023 on KYC norms for the securities market, as amended from time to time.

Therefore, IFSCA-regulated entities cannot treat KRA access as an isolated technical arrangement. Their use of KRA information must be integrated with the applicable KYC compliance framework.

From a compliance perspective, entities should therefore review:

KYC onboarding procedures;
KYC verification and validation processes;
access controls;
record-keeping arrangements;
data handling and confidentiality;
internal controls governing KRA access; and
compliance monitoring and audit mechanisms.

5. Special requirement for Foreign Portfolio Investors

The Circular contains an additional requirement where the client is registered as a Foreign Portfolio Investor (FPI).

In such cases, entities accessing the KRA system must also comply with the Data Security guidelines contained in SEBI's Master Circular dated May 30, 2024 relating to Foreign Portfolio Investors, Designated Depository Participants and Eligible Foreign Investors, as amended from time to time.

This is particularly significant because FPI-related KYC information can involve sensitive financial and identification data.

IFSCA-regulated entities dealing with FPIs should therefore pay particular attention to:

information-security controls;
authorised access;
data protection;
secure transmission and storage;
prevention of unauthorised disclosure; and
monitoring of access to KRA information.

6. Immediate effectiveness

The Circular is effective immediately from August 20, 2026.

Consequently, IFSCA-regulated entities that intend to utilise the KRA system should assess their readiness without waiting for a separate implementation date.

7. Regulatory significance

The Circular is significant beyond its immediate KYC implications.

The IFSC ecosystem is intended to provide a globally oriented financial-services platform, and efficient KYC interoperability is an important component of such an ecosystem. Enabling IFSCA-regulated entities to access the established KRA infrastructure should potentially:

reduce duplication in KYC processes;
improve operational efficiency;
facilitate smoother client onboarding;
improve consistency of KYC information;
reduce compliance friction for financial-sector participants; and
strengthen regulatory coordination between SEBI and IFSCA.

It also reflects a broader movement towards inter-regulatory cooperation and standardisation of financial-sector KYC infrastructure.

8. Impact on IFSCA-regulated entities

From the perspective of an IFSCA-regulated entity, the Circular should be viewed as both an opportunity and a compliance responsibility.

The opportunity lies in being able to access an established KYC repository and potentially streamline client onboarding.

The corresponding responsibility is that such access brings with it the requirement to comply with the relevant SEBI KRA framework and, where applicable, the enhanced data-security requirements for FPIs.

Entities should therefore consider conducting an internal gap assessment covering:

Area	Suggested compliance action
KRA access	Establish appropriate authorised access
KYC processes	Align procedures with SEBI KRA requirements
Internal controls	Define responsibility and approval mechanisms
Data security	Review controls over KRA information
FPI clients	Implement applicable additional data-security requirements
Record keeping	Ensure appropriate maintenance of KYC records
Employee access	Restrict access to authorised personnel
Compliance monitoring	Include KRA usage within periodic compliance reviews

9. Impact on KRAs

For SEBI-registered KRAs, the Circular effectively expands the universe of entities that may access their systems.

KRAs will therefore need to facilitate access by eligible IFSCA-regulated entities in accordance with the regulatory framework, while ensuring appropriate controls around authentication, access, information sharing and data security.

The Circular does not, however, appear from the uploaded document to prescribe a separate operational implementation mechanism or specific technical timeline for KRAs. Such operational requirements may therefore need to be read along with the applicable KRA regulations, master circulars and subsequent directions.

10. Key takeaway for compliance professionals

The most important takeaway is that IFSCA has now been specifically recognised by SEBI under Regulation 16A(1) as a regulator whose regulated entities may access the SEBI KRA system.

However, such access comes with corresponding obligations. The accessing entities must comply with the SEBI KRA Regulations and the applicable SEBI KYC framework, with additional data-security requirements applying in relation to FPI clients.

Conclusion

The August 20, 2026 Circular is a relatively concise regulatory intervention, but its practical significance is considerable. By permitting IFSCA-regulated entities to access SEBI's KRA infrastructure, SEBI has taken a concrete step towards greater harmonisation of KYC processes across India's financial regulatory architecture.

For IFSCA-regulated entities, the immediate priority should be to determine whether they intend to utilise the KRA facility and, if so, ensure that their KYC policies, systems, access controls and data-security framework are capable of meeting the requirements incorporated through the Circular.

In essence, the Circular facilitates interoperability, but interoperability comes with regulatory accountability.

Wednesday, 26 August 2026

Modification in the regulatory framework for Online Bond Platform Providers (OBPPs)

SEBI Circular dated 14 August 2026 concerning modifications to the regulatory framework for Online Bond Platform Providers (OBPPs).

1. Executive Summary

The circular primarily seeks to liberalise and simplify the regulatory framework applicable to Online Bond Platform Providers (OBPPs) and promote ease of doing business.

The principal changes are:

OBPPs may offer certain products, securities and services regulated by IFSCA.
OBPPs may offer 54EC bonds and the corresponding bonds issued under Section 85 of the Income-tax Act, 2025.
The requirement concerning the appointment and qualifications of the Compliance Officer has been revised.
Additional disclosure, labelling and grievance-redressal requirements have been prescribed for the newly permitted products.

The circular has immediate effect, while all other provisions of the NCS Master Circular remain unchanged.

2. Expansion of Permissible Products

The most significant change is the expansion of the products that an OBPP can offer.

The revised Clause 5.2 now permits an OBPP to offer, among other things:

Listed debt securities;
Listed municipal debt securities;
Listed securitised debt instruments;
Debt, municipal debt and securitised debt instruments proposed to be listed through a public offering;
Listed Government Securities, State Development Loans and Treasury Bills;
Listed Sovereign Gold Bonds;
Products/securities/services regulated by SEBI, RBI, IRDAI, IFSCA or PFRDA; and
Bonds issued under Section 54EC of the Income-tax Act, 1961 or Section 85 of the Income-tax Act, 2025.

This represents a meaningful broadening of the permissible business scope of OBPPs. Instead of functioning primarily as platforms for specified domestic debt products, OBPPs can now potentially operate as a broader distribution channel for products regulated across multiple financial-sector regulators.

This could substantially improve product diversification and customer engagement, subject to the applicable regulatory restrictions.

3. IFSCA-Regulated Products – Important Compliance Considerations

The circular specifically permits OBPPs to offer products regulated by IFSCA. However, this permission is not unrestricted.

For IFSCA-regulated products, the OBPP must:

Follow the manner prescribed for SEBI-registered stock brokers operating within GIFT-IFSC;
Comply with applicable FEMA requirements;
Observe the applicable Overseas Investment Rules; and
Comply with the limits applicable under the Liberalised Remittance Scheme (LRS).

Further, these products must be clearly identified as international or overseas instruments, so that investors do not confuse them with domestic debt securities.

Key implication: An OBPP cannot treat IFSCA products as simply another category of domestic bonds. The platform will need appropriate product segregation, disclosures, regulatory controls and investor communication.

For platforms proposing to introduce such products, FEMA/LRS compliance should therefore be incorporated into the product onboarding and transaction-processing framework.

4. 54EC Bonds – Significant New Opportunity

The circular permits OBPPs to offer bonds issued under Section 54EC of the Income-tax Act, 1961, as well as the corresponding provision under the Income-tax Act, 2025.

However, the circular makes it clear that these are tax-specific investment instruments and imposes enhanced disclosure obligations.

The OBPP must disclose matters including:

Eligible issuers;
Lock-in period;
Investment limits;
Non-transferability;
Tax features;
Application size; and
Exemption from listing requirements under the SEBI LODR Regulations, 2015.

The platform must also prominently state that these investments are intended for investors seeking the relevant tax benefits, subject to satisfaction of the applicable eligibility conditions.

This is commercially significant because 54EC bonds are closely connected with tax planning. Their availability through OBPPs could make such platforms more attractive to investors seeking tax-efficient investment options.

At the same time, the disclosure requirements indicate that SEBI expects OBPPs to avoid presenting these instruments merely as conventional fixed-income products.

5. Grievance Redressal – Important Distinction

For products regulated by other financial-sector regulators, the applicable regulator's directions and stipulations will govern the products. The OBPP must specify the grievance-redressal mechanism on its platform.

For 54EC bonds, however, the circular specifically requires a disclaimer that grievance redressal does not lie with SEBI but with the issuer.

This distinction should be reflected clearly in the platform's:

Product pages;
Terms and conditions;
Risk disclosures;
FAQs;
Complaint-management process; and
Investor communications.

6. Compliance Officer Requirement – Major Governance Change

The circular makes a notable change to the compliance-officer requirement.

The revised provision requires the entity to appoint a Compliance Officer in accordance with the SEBI (Stock Brokers) Regulations, 2026, who must comply with the prescribed certification requirements, namely the NISM-Series-III-A: Securities Intermediaries Compliance (Non-Fund) Certification Examination.

Importantly, the footnote records that the earlier requirement was that:

“The entity has appointed a Company Secretary as a compliance officer.”

This is a material governance relaxation/change. The requirement is no longer framed specifically around appointment of a Company Secretary. Instead, the framework aligns the Compliance Officer requirement with the regulatory architecture applicable to stock brokers.

For existing OBPPs, this warrants an immediate review of:

Current Compliance Officer appointment;
Qualification and certification status;
Reporting structure;
Compliance responsibilities;
Board/management approvals; and
Internal compliance policies.

7. Operational Impact on Existing OBPPs

Existing OBPPs should consider undertaking a structured compliance-gap assessment covering at least the following:

Area	Recommended action
Product catalogue	Reassess products currently offered and products now permitted
IFSCA products	Establish separate regulatory/FEMA/LRS compliance controls
Platform architecture	Create appropriate segregation/labelling for overseas products
54EC bonds	Introduce dedicated disclosures and tax-related warnings
Grievance mechanism	Clearly identify the responsible regulator/issuer
Compliance Officer	Review appointment against the 2026 requirements
NISM certification	Verify applicable certification requirements
Website disclosures	Update product descriptions, disclaimers and investor communications
Policies & SOPs	Align internal procedures with revised Clause 5.2
Legal documentation	Review T&Cs, risk disclosures and investor documentation

8. Regulatory Philosophy Behind the Circular

The circular reflects a broader regulatory approach of facilitating business expansion while retaining investor-protection safeguards.

SEBI has expanded the permissible universe of products, but it has simultaneously introduced safeguards through:

Product segregation;
Regulatory labelling;
FEMA/LRS compliance;
Tax-specific disclosures;
Grievance-redressal disclosures; and
Compliance-officer certification requirements.

Therefore, the circular should not be interpreted simply as a relaxation. It is more accurately viewed as a controlled expansion of the permissible business activities of OBPPs.

9. Key Risks for OBPPs

From a compliance perspective, the principal risks arising from the revised framework are:

a. Misclassification risk
An OBPP could inadvertently offer a product that does not fall within the permitted categories.

b. Cross-regulatory compliance risk
IFSCA products introduce additional FEMA, LRS and overseas-investment considerations.

c. Disclosure risk
Insufficient disclosure of tax characteristics, lock-in periods or non-transferability could create investor-protection concerns.

d. Regulatory confusion
Investors may incorrectly assume that all products available on an OBPP are SEBI-regulated. The circular specifically addresses this concern through product labelling and disclaimers.

e. Governance risk
Existing OBPPs should ensure that their Compliance Officer arrangements conform to the revised framework.

Overall Professional Assessment

The 14 August 2026 SEBI Circular is materially favourable to OBPPs from a business-development perspective. It broadens the permissible product universe, enables access to IFSCA-regulated offerings and expressly permits distribution of 54EC bonds.

At the same time, SEBI has adopted a compliance-by-design approach: broader product access is accompanied by enhanced disclosures, regulatory segregation, FEMA/LRS compliance and strengthened compliance-officer requirements.

For an existing OBPP, the immediate priority should therefore be a regulatory and operational gap analysis, particularly covering the revised Clause 5.2 and Annexure-XXIA. Since the circular takes effect immediately, implementation should not be deferred.

In conclusion, the circular can be viewed as a positive regulatory development for the OBPP sector, but its commercial benefits will depend on each platform's ability to implement the expanded product scope without compromising regulatory segregation, investor disclosures and cross-regulatory compliance.

Tuesday, 25 August 2026

RBI (Commercial Banks - Responsible Business Conduct) Fourth Amendment Directions, 2026

1. Executive Summary

The Reserve Bank of India (Commercial Banks – Responsible Business Conduct) Fourth Amendment Directions, 2026, issued on 6 August 2026, represent a significant strengthening and consolidation of the regulatory framework governing loan recovery, recovery agencies and recovery agents. The provisions come into force from 1 January 2027.

The principal regulatory shift is that the RBI is moving from relatively broad principles concerning recovery agents toward a much more prescriptive governance framework covering:

appointment and due diligence of recovery agencies;
training and certification of recovery agents;
borrower notification;
monitoring and recording of recovery communications;
field-visit protocols;
permissible recovery hours;
privacy and customer-data protection;
possession and sale of secured assets;
technology-enabled recovery mechanisms;
prohibited recovery practices;
compensation for certain wrongful actions; and
dedicated grievance-redressal mechanisms.

Importantly, the Directions make it clear that outsourcing recovery does not outsource regulatory responsibility. The bank remains responsible for establishing controls, monitoring recovery agencies and ensuring that their conduct does not expose the bank to regulatory, legal or reputational risk. This is consistent with the RBI's longstanding approach to recovery-agent supervision.

The RBI's official website also identifies the August 2026 measure as an amendment concerning the conduct of regulated entities in recovery of loans and engagement of recovery agents.

2. Scope and Applicability

The Directions apply to commercial banks other than:

Small Finance Banks;
Payments Banks;
Regional Rural Banks; and
Local Area Banks.

The provisions apply to recovery of loan dues from borrowers in default, including taking possession of security. Certain provisions may also apply to normal collection from borrowers who are not in default where the Directions expressly provide for such application.

Important definitional change

The amendment introduces two important concepts:

Recovery agency means an entity or individual, other than the bank's own employees, engaged under an outsourcing arrangement to assist in recovery of loan dues, including taking possession of security.

Recovery agent means the representative of a recovery agency who interacts directly with the customer.

The definition is deliberately broad and is based on the substance of the arrangement rather than its contractual label. A Business Correspondent involved in recovery activities, for example, will be treated as a recovery agency for these purposes.

Professional interpretation

This is important from a compliance perspective because banks cannot necessarily avoid the recovery-agency framework simply by calling an arrangement something else.

The RBI is effectively saying:

If the third party performs recovery functions, the regulatory requirements follow the activity, not merely the contractual nomenclature.

3. Governance and Recovery Policy

A bank is required to establish a formal policy covering collection and recovery of loan dues, including possession of security.

The policy must address, among other matters:

triggers for initiating recovery;
graded recovery actions;
escalation matrices;
code of conduct;
recovery following the death of a borrower;
handling of financially distressed borrowers;
documented pre-escalation engagement; and
available resolution options.

For recovery agencies, the policy must additionally cover:

eligibility;
due diligence;
performance evaluation;
inspection and audit;
compliance controls;
procedures for dealing with non-compliant agencies;
penalties/sanctions for non-compliance; and
borrower compensation for losses arising from recovery actions inconsistent with the Directions.

Compliance significance

This is more than a requirement to have a document titled "Recovery Policy."

The wording indicates an expectation for a structured recovery governance framework, where the bank can demonstrate:

Default → Assessment → Pre-escalation engagement → Resolution opportunity → Escalation → Agency assignment → Monitoring → Closure

Accordingly, banks should be able to demonstrate that recovery decisions are systematic, documented and proportionate, rather than purely target-driven.

4. Engagement of Recovery Agencies

4.1 Due diligence

Banks must establish a due-diligence process for recovery agencies consistent with RBI outsourcing requirements.

Importantly, verification is required not only at the agency level but also in relation to the antecedents of individual recovery agents, both before engagement and periodically thereafter in accordance with the bank's policy.

Practical implication

A bank should therefore maintain an auditable file containing, at minimum:

agency due-diligence records;
ownership/management information;
contractual documentation;
agent identity records;
antecedent verification;
periodic re-verification;
training/certification status;
performance records; and
complaints and disciplinary history.

5. Mandatory Training and IIBF Certification

The bank must ensure that a recovery agency deploys only agents who have obtained the relevant certificate from the Indian Institute of Banking and Finance (IIBF) after completing the prescribed Debt Recovery Agents training programme, or training through an institute having a tie-up arrangement with IIBF.

This makes agent competency a formal compliance requirement, rather than merely a recommended internal control.

A bank should therefore have a mechanism to prevent an uncertified or expired/unverified agent from being deployed.

6. Disclosure and Transparency

One of the stronger provisions concerns transparency regarding recovery agencies.

Banks must publish an up-to-date list of recovery agencies on their websites, including details such as:

name;
type of agency — corporate or individual;
correspondence address;
period of engagement; and
purpose of engagement, including recovery or possession of security.

The list must be updated within seven calendar days of modification, while termination must be reflected promptly.

Borrower-specific notification

Before a recovery agency makes an in-person visit to the borrower/guarantor, the bank must provide the recovery-agency details at least one day before the first visit.

If the agency changes during the recovery process, the borrower/guarantor must be notified immediately. The same applies where an agency's engagement is terminated.

Significance

This substantially reduces the scope for an individual appearing at a borrower's premises without a verifiable connection to the bank.

It also creates an important evidentiary trail:

Bank assignment → borrower notification → authorised agent → identification → field visit

7. Customer Information and Privacy

The bank must restrict disclosure of borrower/guarantor information to employees and recovery agencies to what is necessary for recovery-related duties.

Banks must also implement safeguards, including penal provisions, against misuse of customer information.

This is a significant compliance principle:

Recovery access ≠ unrestricted customer-data access.

The agency should receive only information necessary to perform its authorised function.

This is particularly relevant for technology platforms, call centres, field-recovery applications and third-party recovery vendors.

8. Recording of Recovery Communications

Banks must document:

the time of calls;
the number of calls; and
the content/text of calls made by recovery personnel to borrowers/guarantors.

Calls made by the borrower/guarantor to the telephone/mobile number communicated by the bank must also be recorded.

These records generally need to be retained for six months, or, where the matter is sub judice, until disposal of the matter. The bank must also take reasonable precautions such as informing the borrower that the conversation is being recorded.

Practical consequence

A recovery call is no longer simply an operational interaction. It becomes a potentially important compliance record and evidentiary record.

Banks should therefore consider controls around:

call recording;
call metadata;
retention;
retrieval;
access controls;
audit trails; and
complaint/investigation processes.

9. Recovery Targets and Incentive Structures

The RBI specifically requires banks to ensure that recovery targets or incentive structures for employees and recovery agencies do not encourage harsh recovery practices.

This is a particularly important management-level requirement.

The issue is not merely whether an agent violates the Code of Conduct.

The design of the incentive system itself must not create an incentive to violate it.

For example, a recovery model excessively focused on:

"Amount collected per agent per day"

could create conduct risk if it encourages aggressive calling, repeated visits or intimidation.

Banks should therefore consider incorporating conduct/compliance indicators into agency and employee performance evaluation.

10. Taking Possession of Security

Where a bank relies on a contractual possession clause, the clause must be legally valid and clearly brought to the borrower's attention at the time of execution.

The loan agreement must address:

notice period before possession;
circumstances where the notice period may be waived;
possession procedure;
final repayment opportunity before sale/auction;
procedure for returning possession; and
sale/auction procedure.

Significance

The RBI is effectively requiring procedural transparency around repossession.

A possession right should therefore not operate as an opaque contractual power. The borrower should understand when and how the bank can exercise it.

11. Technology-Based Recovery — Major New Compliance Area

This is arguably one of the most significant aspects of the amendment.

Banks generally cannot use technology to restrict or disable functions of a borrower's mobile phone, tablet or laptop as a recovery mechanism.

There is a narrow exception where:

the particular device itself was financed by the bank;
the loan agreement expressly and unambiguously permits device restrictions;
prescribed notice requirements are followed; and
the other conditions under the Directions are satisfied.

11.1 30-day and 60-day thresholds

Restrictions cannot begin merely because a borrower has missed a payment.

The device cannot be subjected to the technology-based restriction mechanism until the associated loan has become 30 days past due, and the borrower has failed to pay despite notice.

Thereafter:

gradual restrictions may begin after 30 days past due;
the full set of contractual restrictions can take effect only after 60 days past due;
outgoing calls cannot be restricted before 60 days past due.

This establishes a clear regulatory distinction between:

default → notice → 30 DPD → gradual restrictions → 60 DPD → full contractual restrictions

12. Essential Device Functions

Even where device restrictions are permitted, the bank cannot disable essential functionality such as:

incoming calls;
SMS; and
emergency SOS features.

The restrictions must also not prevent the borrower from carrying out activities related to work or employment.

Compliance implication

A technology solution cannot simply be designed around:

"Borrower defaults → phone gets locked."

The system must incorporate regulatory rules and exceptions into its technical architecture.

13. One-Hour Unlocking Requirement and Compensation

Once dues are realised, restrictions must be reversed expeditiously and no later than one hour after realisation.

Where wrongful restriction or delayed reversal is attributable to the bank, compensation is payable at:

₹250 per hour

subject to a maximum equal to the amount of the loan disbursed.

This creates a direct financial consequence for technology or operational failures.

Banks therefore need appropriate real-time payment-to-unlock integration and monitoring.

14. Personal Data on the Device

This provision is exceptionally important.

A bank and its technology service provider must not access or use personal data on the device for recovery or any other purpose.

The provision expressly identifies data such as:

contacts;
SMS;
call logs;
photographs;
location history; and
other personal data.

Regulatory principle

The technology may control an authorised recovery mechanism in the limited circumstances permitted by the Directions.

It cannot become a surveillance mechanism.

This will be particularly important for fintechs, device-financing platforms, OEM partnerships and technology vendors.

15. Recovery-Agent Conduct

When visiting a borrower or guarantor, the recovery agent must:

identify himself/herself;
display the appropriate identity card;
carry an authorisation letter;
carry the bank's relevant notice;
provide relevant agency/grievance contact details.

The agent must interact only with the borrower/guarantor as applicable and must behave with civility, decency and decorum.

16. Permitted Recovery Hours

The Directions prescribe a general contact/visit window of:

08:00 to 19:00

Contact outside these hours requires the borrower's express request or authorisation.

A borrower's request to avoid contact at a particular time should ordinarily be honoured.

This should be reflected directly in:

dialler systems;
field-agent applications;
call-centre controls;
escalation workflows; and
agency contracts.

A system that automatically permits calls outside the prescribed window creates an obvious compliance weakness.

17. Appropriate Contact Location and Sensitive Circumstances

The agent should ordinarily contact the borrower at the borrower's chosen location.

If no specific location is chosen, or the borrower fails to attend the selected location on two or more successive occasions, contact may ordinarily move to the borrower's residence or business/occupation location.

Agents must also avoid inappropriate circumstances such as:

bereavement;
medical emergencies;
other calamities; and
marriage functions.

This reinforces the RBI's broader shift toward proportionate and humane recovery practices.

18. What Constitutes "Harsh" Recovery?

The amendment gives a detailed list of prohibited practices.

These include:

threatening or abusive language;
publishing borrower information or recordings on social media;
inappropriate mobile/social-media messages;
excessive calling or messaging;
contacting outside permitted hours;
threatening or anonymous calls;
harassment or intimidation of borrowers, relatives, friends or co-workers;
threats of violence or damage to reputation/assets; and
false or misleading statements concerning the debt or consequences of non-payment.

Key observation

The prohibition extends beyond the borrower.

For example, intimidating the borrower's:

relatives, referees, friends or co-workers

can constitute prohibited conduct.

This materially limits the traditional practice of applying social pressure through third parties.

19. Grievance Redressal

Banks must establish a dedicated recovery-related grievance mechanism.

Its details must be:

included in the loan agreement;
provided when the recovery agency is communicated to the borrower; and
included in recovery-related communications.

The communication must contain the grievance officer's:

name;
email;
telephone number; and
address.

This is an important accountability mechanism because it gives the borrower a defined escalation channel instead of leaving complaints solely with the recovery agent.

20. Overall Regulatory Impact

In my assessment, the amendment creates five major compliance pillars:

Pillar	Regulatory direction
Governance	Banks must establish structured recovery policies and oversight
Accountability	Banks remain responsible for recovery agencies
Customer protection	Recovery must be proportionate, transparent and non-coercive
Technology governance	Device-based recovery is tightly controlled
Evidence & monitoring	Calls, agency activities and complaints must be documented

The overall direction is clearly toward controlled, auditable and borrower-sensitive recovery, rather than purely outcome-driven collection.

21. Key Risks for Banks

From a compliance and operational-risk perspective, I would classify the principal risks as follows:

High Risk

1. Recovery-agent misconduct

Because the bank is required to monitor recovery agencies, misconduct by an outsourced agent can become a bank-level compliance issue.

2. Technology-enabled recovery

The 30/60-day thresholds, essential-function restrictions, one-hour unlocking requirement and ₹250/hour compensation create significant technology and operational dependencies.

3. Data misuse

Accessing customer-device data for recovery purposes is expressly prohibited.

4. Uncontrolled calling

Call frequency, timing and content now require much stronger governance.

5. Inadequate agency oversight

Simply executing an outsourcing agreement will not be sufficient. The bank needs continuing monitoring and control.

22. Recommended Compliance Architecture

For implementation before 1 January 2027, I would recommend banks establish the following framework:

A. Policy

Review and amend the Board-approved recovery policy to incorporate:

escalation matrix;
distress-handling process;
agency eligibility;
due diligence;
agent verification;
training;
monitoring;
penalties;
compensation;
technology recovery controls.

B. Contracts

Review all recovery-agency agreements to incorporate:

RBI-mandated conduct;
audit rights;
data restrictions;
call-recording obligations;
agent certification;
reporting;
indemnification/compensation provisions;
termination rights;
regulatory cooperation requirements.

C. Technology

Implement system controls for:

calling hours;
call recording;
call-frequency monitoring;
DPD-based restrictions;
30/60-day thresholds;
essential-function exclusions;
payment-triggered unlocking;
one-hour SLA;
compensation calculation;
audit logs.

D. Agent Management

Maintain a centralised database covering:

identity;
certification;
antecedent verification;
agency;
territory;
authorisation;
training;
complaints;
disciplinary history.

E. Customer Communication

Standardise:

agency-intimation letters;
pre-visit notices;
authorisation letters;
recovery messages;
grievance disclosures;
possession notices;
technology restriction notices.

23. Recommended Management Dashboard

For senior management/Board oversight, I would suggest monitoring at least:

number of active recovery agencies;
number of active recovery agents;
percentage of agents with valid certification;
overdue due-diligence/re-verification cases;
complaints against agencies;
complaints substantiated;
prohibited-conduct incidents;
calls outside permitted hours;
excessive-call alerts;
field-visit exceptions;
data/privacy incidents;
device restrictions initiated;
wrongful device restrictions;
average unlocking time;
compensation paid;
agency penalties/terminations; and
unresolved recovery-related grievances.

This would convert the RBI requirements into measurable management controls.

24. Most Important Takeaways

If I had to reduce the entire 11-page amendment to 10 management-level conclusions, they would be:

The amendment becomes effective on 1 January 2027.
Banks remain accountable for recovery agencies they engage.
The regulatory definition of recovery agency is deliberately broad.
Recovery agents must undergo prescribed IIBF-related training/certification.
Borrowers must receive greater transparency before agency-led field recovery.
Recovery calls and related records require systematic documentation and retention.
Recovery incentives must not encourage harsh practices.
Recovery contact is generally restricted to 08:00–19:00.
Technology-based device locking is permitted only in a tightly controlled device-financing context.
Harassment, intimidation, public humiliation, misuse of personal data and misleading representations are expressly prohibited.

Overall conclusion

This amendment should be viewed not merely as a revision of recovery-agent guidelines, but as a comprehensive recovery-governance framework.

The most significant change is the shift in regulatory emphasis from simply controlling the conduct of individual recovery agents to controlling the entire recovery ecosystem — including the bank's policy, outsourcing arrangements, incentives, technology, data practices, communications, field operations, monitoring, grievance mechanisms and accountability.

For a bank, the key compliance question going forward should therefore not be:

"Are our recovery agents following the rules?"

but rather:

"Can we demonstrate that our entire recovery process is designed, monitored and controlled so that regulatory-compliant behaviour is the default outcome?"

That is, in my view, the central message of these Directions.

Note: The above analysis is based primarily on the uploaded RBI Directions. It is an interpretive/compliance analysis and should not be treated as a formal legal opinion. The RBI's broader regulatory framework also contains related requirements, including its outsourcing and grievance-redressal frameworks, which should be mapped separately when implementing the amendment.