Home India Rules RBI Credit Card Rules Every Indian Must Know (2026)

RBI Credit Card Rules Every Indian Must Know (2026)

Updated: 27 February 2026 · CardTrail

TL;DR: RBI’s 2026 credit card rules give you stronger rights around billing, consent, and fraud — but only if you know them. Most banks won’t volunteer this information, so read this before your next statement hits.

Why RBI Credit Card Rules Matter More Than Ever

India now has over 10 crore active credit cards. And yet most cardholders have no idea what protections exist for them. Banks routinely charge fees that RBI doesn’t permit, send misleading billing statements, and push insurance products through dark patterns.

That changed significantly between 2022 and 2026. RBI has issued a series of master directions and circulars that are genuinely consumer-friendly — if you know how to use them. This guide breaks down every major rule, what it means in practice, and what you can do when a bank violates it.


1. Billing and Statement Transparency

RBI requires all credit card issuers — HDFC Bank, SBI Card, Axis Bank, ICICI Bank, and everyone else — to provide clear billing disclosures in every statement.

What Banks Must Show You

  • The minimum amount due (MAD) and the total outstanding
  • The exact interest rate (APR) applied, not just the monthly rate
  • How long it will take to pay off your balance if you only pay the minimum (the “repayment warning”)
  • Any fee changes, communicated at least 30 days in advance

The Catch Most People Miss

If your bank changes your credit limit, interest rate, or fee structure without 30 days’ notice, that change is not enforceable under RBI rules. You can dispute it. Banks like SBI Card and Axis Bank have historically pushed limit changes without notice — now they cannot.


2. Auto-Debit and Standing Instruction Rules

This is the rule that quietly saved lakhs of Indians from surprise deductions.

From October 2022 onwards (and strengthened in 2025), any recurring payment above ₹15,000 linked to your credit card requires an Additional Factor of Authentication (AFA) — essentially a fresh OTP — before it goes through.

What This Means Practically

Transaction TypeAmountOTP Required?
Streaming subscription (Netflix, Hotstar)₹199–₹1,499/monthNo (below ₹15,000)
Insurance premium auto-debit₹20,000/yearYes
Gym membership or club fee₹5,000/monthNo
SIP or mutual fund mandate₹25,000/monthYes
Hotel pre-auth or travel booking₹50,000+Yes

Banks must also send a pre-debit notification at least 24 hours before any standing instruction is executed. If they skip this, and money is debited incorrectly, they owe you a refund — no questions asked.


3. The New “No One-Click” Rule (Effective July 1, 2026)

This is the newest and most significant change. Starting July 1, 2026, banks cannot sell you a credit card, insurance policy, or any other financial product through a single-click or pre-ticked consent flow.

What’s Now Banned

  • Pre-approved credit card offers where acceptance requires just one tap
  • Insurance bundled with credit cards without separate, explicit consent
  • Auto-enrollment in loyalty programs that charge fees
  • Dark-pattern upsells during credit card application processes

This directly affects products like HDFC Bank’s credit card + insurance bundles, Axis Bank’s co-branded offers, and SBI Card’s reward program upsells. Banks that violate this face penalties and — more importantly — customers can claim refunds on products sold without proper consent.


4. Credit Score Notification Rights

If a bank is about to report you as a defaulter to CIBIL, Experian, CRIF, or Equifax, they must notify you first.

The Rule in Plain Language

  • You must receive an SMS or email alert before your account is marked as “Days Past Due” (DPD) with any credit bureau
  • This gives you a window to pay and prevent a default from appearing on your credit report
  • If a bureau takes more than 30 days to update a correction you’ve requested, the credit institution owes you ₹100 per calendar day in compensation

That last point is rarely enforced simply because most cardholders don’t know it exists. If HDFC Bank or SBI Card reported a wrong default and took 45 days to fix it, you’re owed ₹1,500. File through the RBI Ombudsman if they refuse.


5. Fraud Liability: Your Rights When You’re Not at Fault

RBI’s zero-liability framework is clear: if fraud happens due to a bank’s negligence or a third-party breach (not your fault), you are not liable.

The Liability Table

Who’s at FaultYour Maximum Liability
Bank’s system failure or negligence₹0
Third-party breach, you report within 3 days₹0
Third-party breach, you report in 4–7 days₹5,000–₹10,000 (based on credit limit)
Negligence by the cardholderFull liability

Report fraud immediately — within 3 days — via the bank’s official helpline and follow up in writing (email). Banks like ICICI and HDFC have 24/7 fraud reporting lines. The written trail is what protects you.


6. Debt Collection: What Banks and Their Agents Cannot Do

Third-party collection agents working for credit card companies operate under strict RBI guidelines.

Prohibited Collection Practices

  • Calling before 8 AM or after 7 PM
  • Contacting family members, colleagues, or employers without your consent
  • Using abusive, threatening, or humiliating language
  • Visiting your home or workplace without prior notice

Any violation of these rules is a complaint to the RBI Banking Ombudsman. Keep call recordings if possible — they are legally valid evidence in India.


How to File a Complaint Under RBI Rules

  1. First, raise a formal complaint with your bank (in writing, via email)
  2. If unresolved in 30 days, escalate to the RBI Integrated Ombudsman at cms.rbi.org.in
  3. Complaints are free to file and must be resolved within 30–45 days
  4. Compensation for delays: ₹100/day after the 30-day resolution window


Frequently Asked Questions

Can a bank charge me a joining fee without telling me upfront?

No. RBI requires all fees — including joining fees, annual fees, and renewal fees — to be disclosed before card issuance. If a fee was not communicated in writing before you accepted the card, you can dispute it through the bank’s grievance redressal system and escalate to the RBI Ombudsman.

What happens if my credit card was used fraudulently and I reported it within 3 days?

You have zero liability if the fraud was not due to your own negligence (e.g., you didn’t share your OTP). Report immediately to the bank’s fraud helpline, then follow up via email within 3 days. The bank must investigate and reverse the charge within 10 working days.

Can HDFC or SBI Card reduce my credit limit without notice?

Yes — credit limit reductions don’t require prior notice under current RBI rules. However, any increase to fees or change in interest rates requires 30 days’ advance notice. Limit changes can happen, but they cannot affect your existing dues (e.g., a bank can’t suddenly make your existing balance “over limit”).

Is the ₹100/day compensation from CIBIL correction disputes automatic?

No — you have to claim it. File the complaint formally with the credit institution (bank or NBFC), document the timeline, and if they don’t resolve within 30 days, claim the compensation explicitly. If they refuse, escalate to the RBI Ombudsman with your documentation.

What is the new one-click rule and does it affect cards I already have?

The no-one-click rule (effective July 1, 2026) applies to new product sales and renewals. It means banks cannot auto-renew a credit card with bundled insurance without getting fresh, separate consent from you. It does not retroactively affect your existing card but does affect your next renewal cycle.

Can a credit card agent call me at 9 PM about an unpaid bill?

No. RBI prohibits collection calls before 8 AM and after 7 PM. If a bank’s agent calls outside those hours, note the time, save the call log, and file a formal complaint with the bank’s nodal officer. A second violation can support an RBI Ombudsman complaint with a compensation claim.

Found this helpful?

Explore more no-BS guides on Indian credit cards.