The essentials first, before we get into the detail:

• What is changing. From 1 January 2027, every NBFC that deals directly with customers must rethink how it advertises, sells and resolves complaints around financial products.
• Where it comes from. The RBI’s Second Amendment Directions, issued on 15 June 2026, fold a fresh set of rules into the existing Responsible Business Conduct Directions, 2025.
• Why it matters now. The deadline is roughly six months away — and the groundwork, from policies and contracts to disclosures and interface fixes, needs to begin well before then.

Reference: RBI/2026-27/123  |  DOR.MCS.REC.No.102/01-01-039/2026-27, issued under Sections 45JA, 45L and 45M of the RBI Act, 1934, amending the RBI (NBFCs – Responsible Business Conduct) Directions, 2025.

Who Is Covered

The reach is wide, with a short list of exceptions:

• In scope. Every NBFC with a customer interface, and the rules reach further still to take in NBFC-P2P lenders, Mortgage Guarantee Companies and Standalone Primary Dealers.
• Out of scope. Four categories — Core Investment Companies, NBFC-Account Aggregators, Non-Operative Financial Holding Companies, and NBFCs that have no customer interface at all.

A few terms worth keeping in mind. A DSA/DMA is a Direct Selling or Marketing Agent — the outside salesperson or firm an NBFC hires to sell its products. A TPPS is a Third-Party Product or Service, something the NBFC sells on another company’s behalf. And the KFS/MITC — the Key Facts Statement or Most Important Terms and Conditions — is the standard one-page summary a customer must see before signing up.

The Definitions That Set the Tone

Before the operative rules, the amendment lays down seven new definitions. They are worth pausing on, because they quietly draw the boundary lines for everything that follows.

• Compulsory Bundling. Tying one product to another, so a customer can only get what they came for if they also take something else — whether that something comes from the NBFC or a third party. This is now off the table. Genuinely voluntary packages, and add-ons offered free of charge, are expressly left alone.
• Mis-selling. Defined broadly, across five situations, each one actionable on its own:
  • selling a product that doesn’t suit the customer’s profile, even where the customer agrees to it;selling on the back of incomplete or misleading information;selling with no consent at all;compulsory bundling; and
  • anything else a relevant regulator chooses to add.
• Dark Pattern. Any design choice in an interface — the layout, the wording, the flow — built to nudge or trick users into doing something they did not intend, quietly overriding their autonomy or choice.
• DSA / DMA. Any person or firm engaged to sell or market an NBFC’s products, whatever the contract calls them. Label an arrangement a “Loan Service Provider” if you like; if it sells the NBFC’s products, it carries a DSA’s obligations.
• DSA Sub-agent. Someone who is not the NBFC’s own employee, brought in by a DSA, who deals with customers face to face at the point of sale. The NBFC’s obligations follow right through to them. And if the NBFC bypasses the DSA and hires such a person directly under an outsourcing arrangement, nothing changes — the label shifts, the duties do not.
• Explicit Consent. A specific, informed and unambiguous yes, captured in a way that leaves a record: a signed declaration, an OTP, a digital confirmation, or a clearly marked section of an agreement.
• Third-Party Product or Service (TPPS). Something the NBFC offers on behalf of another provider, under an agency or referral arrangement permitted by the 2025 Undertaking of Financial Services Directions. This is the “TPPS” that recurs throughout the rest of the rules.

What the New Rules Require

• Policy. Written policy now sits at the base of everything:
  • Every NBFC must have a written policy covering suitability criteria, the feedback mechanism, and how mis-selling is compensated.
  • Those working through DSAs must document more: who qualifies as a DSA, the due diligence done before and after engaging one, the functions a DSA may be assigned, how performance is measured, the audit and inspection controls, and the penal action for a DSA that falls short.
• Governance of selling agents. The agent network has to be visible and accountable:
  • An up-to-date list of every empanelled DSA — name, type, address, period of engagement and products handled — must sit on the NBFC’s website and be refreshed within seven calendar days of any change.
  • Employees and sub-agents who sell a product must hold whatever qualification or certification the relevant regulator prescribes for it.
  • Sub-agents on NBFC premises must wear visible identification that sets them apart from NBFC staff.
  • A published Code of Conduct, backed by signed undertakings from DSAs, sub-agents and TPPS representatives, is now a precondition for selling and marketing financial products.
• Consent. Consent must be explicit, informed and on the record:
  • Nothing may be sold without explicit consent, and where one form offers several products, each needs its own opt-in.
  • On a digital interface, the consent flow must route the customer through the relevant terms before they can agree, and the default must read “No” or “I do not agree” — never a pre-ticked yes.
  • Key features — fees, risks, lock-ins, exit penalties — must be laid out before consent is taken, prominently and in whatever standard format a regulator requires, such as a Key Facts Statement or the Most Important Terms and Conditions.
  • Consent records must be kept for a year after the contract ends.
• Advertising and marketing. Promotion has to be honest and easy to step away from:
  • A third-party product can never be dressed up as the NBFC’s own; when walking a customer through a third-party offering, the NBFC must be straight about its own role in it.
  • Every piece of promotional material — pamphlet, brochure, web page, app screen, whatever the medium — must be clear, factual, and upfront about the interest rate and all other charges.
  • The full terms must be on display at every point of sale, website and app included, rather than tucked away in the fine print.
  • Promotional messages may only reach customers who have explicitly agreed to receive them, and opting out must be easy.
• Conduct on the ground. Anyone selling on the NBFC’s behalf — employees, DSAs and DMAs, their sub-agents, and TPPS representatives on NBFC premises — shares a common set of duties:
  • be upfront about fees and interest rates, and hand over the full terms to a customer who means to buy;
  • stick to NBFC-approved channels and formats;
  • call or visit only between 9 AM and 7 PM unless the customer has asked otherwise;
  • share the grievance officer’s contact details on request;
  • respect the customer’s privacy and discuss their affairs with others only with consent;
  • honour “Do Not Disturb” flags and pass those names along;
  • never turn up at a customer’s home or office uninvited; and
  • never mislead, pressure or make promises the NBFC has not authorised.
  • DSAs, DMAs and their sub-agents carry one extra line they cannot cross: they must not misrepresent their own organisation, nor pass themselves off as NBFC employees.
• Sale practices. The mechanics of a sale are tightened end to end:
  • A suitability check is required before selling anything not pre-cleared as suitable for everyone.
  • Application forms must name each product clearly, and a digital form carrying more than one product must give each its own marked section and its own consent.
  • Documents must be available in the customer’s language, and third-party documentation must follow any specific instruction its regulator has issued.
  • When an application comes in, the customer gets an acknowledgement and a number to call; when the sale closes, a signed copy of the terms must reach them securely.
  • An NBFC’s own incentives must not push staff toward mis-selling, and no employee may take any incentive — direct or hidden — from a third-party provider for pushing its product.
  • Compulsorily tying a third-party product to the NBFC’s own is barred, with one narrow exception: where the NBFC’s product depends on a risk-mitigant cover, the customer must still be free to buy that cover wherever they like.
  • Bundles the customer genuinely chooses, or that come free, do not count as compulsory.
  • Loan money cannot be steered into buying products without the customer’s explicit consent.
  • Every interface must be tested and audited for dark patterns.
• Feedback and compensation. The loop has to close after the sale:
  • Feedback must be sought within 30 days of every sale, by a team that sits apart from the sales function, with a half-yearly report on what it finds.
  • Where mis-selling is established, the NBFC must refund everything the customer paid, unwind the sale where that applies, and make good any further loss.
  • Customers get 30 days to complain, or longer if their regulator says so.
• Recovery agents, and how this fits with other regulators. Conduct is recast, and the new rules stack rather than replace:
  • Recovery agents must be trained to handle solicitation, calling hours, privacy and accurate disclosure of terms with care.
  • They must give an undertaking to follow the NBFC’s code of conduct on top of the existing Fair Practices Code.
  • They must keep customer information strictly confidential and avoid anything that could dent the NBFC’s reputation.
  • The amendment sits on top of the existing rulebook, not in place of it: the telecom rules from the Department of Telecommunications and TRAI (such as the TCCCPR, 2018), the product-level regimes of SEBI, IRDAI and PFRDA, and the RBI’s own instructions on agency business, outsourcing and deposit mobilisation through agents all continue to apply in full.

Dark Patterns and the Course of Action

The amendment bans dark patterns outright on any NBFC or DSA interface — and gives the ban some bite. Every interface has to go through user testing and periodic internal audit to catch unfair features, dark patterns included, before and after they go live, and NBFCs and DSAs must also follow the Central Consumer Protection Authority’s Guidelines for Prevention and Regulation of Dark Patterns, 2023, which set out the illustrative categories to watch for.

What all of this adds up to, in practice, is a fairly clear course of action. The natural starting point is to frame the policies the rules now demand — on suitability, feedback and mis-selling compensation — and to write a code of conduct built specifically for the sale of third-party products, backed by signed undertakings from everyone who touches that sale. Existing arrangements then need a fresh look: the terms agreed with insurers and other partners whose products are sold will often have to be renegotiated, so that nothing is bundled compulsorily and the customer keeps a free choice of provider, while contracts with DSAs and DMAs must be reopened to build in the new due diligence, conduct and penal provisions. Running alongside is a long list of website disclosures to put in place — the empanelled-DSA register kept current within seven days of any change, interest rates and all charges, the full terms at every point of sale, and an easy way to opt out — each of which has to be live and accurate before the deadline rather than retro-fitted after it.

Before January 1, 2027

Six months is not a lot of time. These are the places to start.

• Put every web and mobile interface through the dark-pattern categories in the annexure — a job for compliance and UX teams together.
• Rewrite DSA agreements to fold in the Code of Conduct undertaking, the penal provisions and the due diligence requirements.
• Update the advertising and sales policy so it covers suitability criteria, mis-selling compensation and the post-sale feedback mechanism.
• Walk through every consent flow. Defaults must read “No,” and each product on a shared form needs its own opt-in.
• Stand up the public DSA register, with a process to update it within seven calendar days of any change.
• Design the post-sale feedback programme and its half-yearly report, run by a team that sits outside sales.

A Closing Thought

At heart, the amendment reframes advertising, marketing and selling as a governance obligation, not a back-office checklist. The thread running through the new definitions, the consent architecture and the eleven dark-pattern categories is the same one: the RBI wants the customer’s choice to be real, informed and reversible at every touchpoint — whether that touchpoint is an employee, a sub-agent, a recovery agent or an app screen. And it does not replace what is already there. The telecom rules from TRAI and the Department of Telecommunications, the product-level regimes of SEBI, IRDAI and PFRDA, and the RBI’s own outsourcing and agency-business instructions all keep running alongside. With the deadline now six months out, the NBFCs that treat this as a shared effort across compliance, UX and sales leadership — rather than a drafting job handed to the legal team alone — will be the ones that get there without disrupting their sales channels.