RBI Credit Card Rules 2026: What Changed and Your Rights
RBI’s credit card rulebook has had four meaningful updates between 2022 and 2026 — card-on-file tokenisation, billing-date freedom, OTP for international transactions, and stricter card-closure timelines. Each one changes how you should manage your cards. This guide walks through what’s now mandatory, what’s banned, what your bank can and can’t do under current rules, and the three RBI rights every cardholder should know to enforce against errant banks.
The four major RBI changes 2022-2026
1. Card-on-file (CoF) tokenisation — October 2022
Before tokenisation, e-commerce sites stored your raw 16-digit card number, expiry, and CVV for one-click checkout. RBI banned this practice. Now merchants must request a unique “token” from your card issuer for each card; the token is merchant-specific and can’t be used elsewhere. If a merchant gets hacked, the leaked tokens are useless on other sites.
What you’ll notice as a user: at checkout you’ll see “Save card as RBI-mandated secure token” or similar consent box. Click yes; no underlying security risk. Some merchants haven’t migrated and have stopped saving cards entirely — you’ll have to enter the full number each time on those sites.
2. Billing date / cycle change freedom — April 2022
RBI Master Direction on Credit, Debit and Prepaid Cards (April 2022, updated 2024) mandates that issuers must allow at least one billing date change per year on request. Before this rule, banks varied — some allowed it freely, some required branch visits, some refused outright.
Practical implication: you can now request your statement closing date be moved to a date that aligns with your salary inflow. Most banks process this via netbanking or phone in 1-2 days. See our billing cycle guide for how to optimise.
3. OTP required for all online and international transactions — October 2023
RBI made OTP mandatory for:
- All online transactions above ₹2,000 (was ₹5,000 before)
- All international transactions regardless of amount
- All recurring auto-debit setups above ₹15,000
The cost: an extra OTP step at checkout. The benefit: most card-fraud cases involving your card number being stolen on the dark web no longer result in successful transactions, because the fraudster doesn’t have your phone.
4. Card-closure timelines and penalties — September 2024
RBI’s most consumer-friendly recent change: banks must close credit card accounts within 7 working days of a closure request. If they delay, banks owe you ₹500 per day in compensation — credited to your account.
Banks are also required to:
- Issue No Dues Certificate (NDC) within 30 days of closure
- Update CIBIL with “Closed” status within 30 days
- Provide closure request options via netbanking and app (not just phone)
What’s banned outright (banks cannot do these)
Unsolicited card upgrades or cross-sells
Banks cannot issue you a new credit card without your explicit consent. They also cannot upgrade you to a higher-fee variant without written consent. If you receive a new card you didn’t apply for, you’re entitled to:
- Refuse activation
- File a complaint via the bank’s grievance officer
- Demand a fee refund if you were charged anything
Penal interest on uncharged amounts
RBI clarified in 2022 that banks can only charge interest on the unpaid balance — not on amounts that have already been paid. If your statement shows ₹50,000 and you pay ₹40,000 by due date, interest accrues only on ₹10,000 (not ₹50,000). Some banks were historically charging interest on the full statement.
Charging interest from transaction date instead of statement date
If you pay your minimum amount due, banks were historically charging interest from the transaction date on all subsequent purchases. RBI now permits this only if you haven’t paid in full — the moment you pay 100% of any statement, the interest-free grace resets fully on the next cycle.
Selling insurance bundled with cards without disclosure
Banks cannot add insurance (group health, accident, etc.) to your card account without explicit opt-in. Auto-debit of premiums without consent is a banned practice and a refundable charge under RBI’s Fair Practices Code.
The three rights every cardholder should know
Right 1: Get a copy of all communications
You can request a written statement of any verbal communication you’ve had with the bank — whether about a charge dispute, fee waiver promise, or upgrade pitch. Banks are required to respond in writing within 30 days. Always use this when negotiating annual fee waivers; the verbal promise from a retention agent has no force unless you have it in writing.
Right 2: Dispute any unauthorised transaction within 3 days
RBI’s “zero liability” framework: if you report an unauthorised transaction within 3 working days of receiving the SMS/email alert, you owe nothing (assuming you didn’t share OTP or PIN). 4-7 days: liability capped at ₹10,000. After 7 days: full liability to a maximum.
Practical tip: set up SMS+email alerts for every transaction, no matter how small. The faster you catch a fraud, the lower your liability.
Right 3: Escalate to RBI Banking Ombudsman
If the bank doesn’t resolve your complaint within 30 days, escalate to the Reserve Bank of India’s Complaint Management System. Filing is free, online, and turnaround is typically 30-60 days. The Ombudsman has compensation powers up to ₹20 lakh and routinely rules in favour of consumers on disputes involving unauthorised transactions, billing errors, and closure delays.
What’s coming next (proposed changes for 2026-27)
RBI has issued discussion papers on:
- Standardised credit card terms and conditions — a proposed Key Fact Statement (KFS) document of 1-2 pages summarising fees, interest, rewards in a uniform format across banks. Likely effective late 2026.
- Caps on credit card APR — currently 3.49-4% per month is industry standard. RBI hasn’t capped, but pressure is growing. Premium cards may end up regulated separately.
- Mandatory annual review — banks may be required to send an annual “card health” report showing your usage, fee paid, rewards earned, and whether the card is still the right fit.
- Cooling-off period for new cards — proposed 14-day window during which you can cancel a newly-issued card with full fee refund.
How to enforce your RBI rights
Three-step escalation that works:
- Internal grievance redressal — every bank has a designated Nodal Officer for credit card complaints. Email + send screenshots of the dispute. Banks must respond in 30 days.
- RBI Banking Ombudsman — if step 1 fails or response is unsatisfactory. File at cms.rbi.org.in. Online, free, no lawyer needed.
- Consumer court — last resort. Most credit card disputes never need to reach this stage; banks settle at the Ombudsman level when the case is clear-cut.
Things RBI rules don’t cover (so banks have full latitude)
Even with all the rules above, banks remain free to:
- Devalue rewards programmes (with 30-day notice) — see our devaluation tracker
- Change annual fees on existing cards (with notice)
- Modify lounge access caps, milestone benefits, partner network
- Decline card upgrade or limit increase requests
- Reject your application for any reason (within RBI’s overall framework)
Verdict
RBI’s framework gives Indian credit card holders significant protections — but only if you know they exist and use them. The single most underused right is the 3-day fraud-dispute window: most consumers think they need to wait for the statement before disputing, and miss the zero-liability window. Save the RBI Banking Ombudsman URL in your bookmarks; the moment a bank delays or denies legitimate compensation, file there rather than negotiating endlessly with the bank’s customer service.
