Government and RBI Strengthen Fintech Ecosystem with Enhanced Regulatory Frameworks & Consumer Protection Actions

Key Highlights:

• The Reserve Bank of India (RBI) issued the Framework for Self-Regulatory Organisation(s) in the FinTech Sector (SRO-FT framework) on May 30, 2024.
• The Ministry of Electronics and Information Technology (MeitY) notified the Digital Personal Data Protection Act, 2023 (DPDP Act) and DPDP Rules 2025.
• RBI issued Master Directions on Digital Payment Security Controls in February 2021 for banks.
• The Ministry of Home Affairs (MHA) launched the National Cybercrime Reporting Portal and National Cybercrime Helpline number “1930”.

Detailed Insights:

• The SRO-FT framework aims to establish regulatory standards, promote ethical conduct, and ensure market integrity within the fintech sector.
• RBI's Master Directions mandate common minimum security controls for various payment channels, including internet and mobile banking.
• The National Payment Corporation of India (NPCI) provides an AI/ML-based fraud monitoring solution for Unified Payments Interface (UPI) transactions.
• The DPDP Act and Rules are designed to protect the personal data of individuals in the digital realm.
• RBI introduced a Regulatory Sandbox in August 2019 to allow testing of new financial products and services in a controlled environment.
• The MHA initiatives facilitate citizens to report cyber incidents, including those related to illegal loan applications.
• Banks, through the SACHET portal and State Level Coordination Committee (SLCC), assist in lodging complaints against illegal money collection.
• RBI and banks conduct awareness campaigns, including electronic-banking awareness and training (eBAAT) programmes, to prevent cyber-crime.

Key Concepts Involved:

• Self-Regulatory Organisation (SRO): An entity that exercises regulatory authority over an industry or profession, often delegated by a government.
• Regulatory Sandbox: A framework allowing innovators to test new products/services in a live, controlled environment under regulatory supervision.
• Digital Personal Data Protection Act (DPDP Act): A law enacted to protect the digital personal data of individuals in India.