India
20 regulators · 49 laws & regulations · 17 obligations · 90 enforcement actions · 10 upcoming deadlines
India operates one of the world's most layered financial regulatory architectures, built around sectoral regulators with statutory independence and coordinated through the Financial Stability and Development Council (FSDC).
Regulatory pulse · 90 days
Laws & Regulations Enforcement NewsOverview
India operates one of the world's most layered financial regulatory architectures, built around sectoral regulators with statutory independence and coordinated through the Financial Stability and Development Council (FSDC). The Reserve Bank of India (RBI) anchors the system as the central bank and regulator of banks, non-banking financial companies (NBFCs), payment systems, and, since 2019, housing finance companies. The Securities and Exchange Board of India (SEBI) governs capital markets, listed companies, and market intermediaries; the Insurance Regulatory and Development Authority of India (IRDAI) and the Pension Fund Regulatory and Development Authority (PFRDA) cover their respective sectors. Corporate law sits with the Ministry of Corporate Affairs (MCA) under the Companies Act, 2013, administered in the field through Registrars of Companies, with the Insolvency and Bankruptcy Board of India (IBBI) regulating the insolvency ecosystem created by the 2016 Code. India's anti-money-laundering framework rests on the Prevention of Money Laundering Act, 2002 (PMLA), with the Financial Intelligence Unit – India (FIU-IND) as the national FIU receiving suspicious transaction and cash transaction reports, and the Enforcement Directorate (ED) investigating money laundering and foreign-exchange violations under PMLA and FEMA. India's 2024 FATF mutual evaluation placed the country in the "regular follow-up" category, the strongest outcome band, while identifying areas for improvement in prosecution outcomes and supervision of designated non-financial businesses and professions. The regulatory perimeter has expanded rapidly into technology and data. The Digital Personal Data Protection Act, 2023, India's first comprehensive data protection statute, moved into implementation with rules notified in late 2025, creating the Data Protection Board of India as the adjudicatory body. CERT-In's 2022 directions impose some of the world's tightest cyber-incident reporting windows (six hours), layered beneath sector-specific cyber rules from RBI, SEBI, and IRDAI. Fintech regulation is dense and fast-moving: digital lending, payment aggregators, and prepaid instruments are governed by consolidated RBI directions, while virtual digital assets are taxed and brought under PMLA reporting obligations, though a full licensing regime remains under deliberation. The International Financial Services Centres Authority (IFSCA) operates a separate unified regulatory regime for GIFT City, India's offshore financial centre. Enforcement is active and public. RBI publishes monetary penalties typically for KYC, exposure-norm, and reporting failures on a near-weekly cycle, and has shown willingness to impose business restrictions on large institutions for supervisory concerns. SEBI runs a high-volume adjudication and settlement docket, and the ED's PMLA caseload has grown sharply. For compliance officers, India is a high-frequency jurisdiction: master directions are amended continuously, and the compliance calendar is dense with monthly, quarterly, and annual filings across regulators. This profile tracks the principal regulators, instruments, obligations, and deadlines, with enforcement actions updated on a rolling basis.
| Law or regulation | Type | Year | Regulator | Source |
|---|---|---|---|---|
| IFSCA FinTech Sandbox Framework, 2026 | Guideline | 2026 | IFSCA | official |
| Industrial Relations Code (Amendment) Act, 2026 | Act | 2026 | Ministry of Labour and Employment | official |
| SEBI Master Circular for compliance with the LODR Regulations, 2015 by listed entities status not recorded | Circular | 2026 | SEBI | official |
| RBI Digital Lending Directions, 2025 | Direction | 2025 | RBI | official |
| RBI Master Circular — Basel III Capital Regulations (updated annually) | Circular | 2025 | RBI | official |
| Reserve Bank of India (Commercial Banks – Climate Finance and Management of Climate Change Risks) Directions, 2025 | Direction | 2025 | RBI | official |
| Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025 | Direction | 2025 | RBI | official |
| No instruments match these filters. | ||||
Recent enforcement
Open tracker →| Date | Entity | Regulator | Action | Source |
|---|---|---|---|---|
| Oct 2026 | Puducherry Co-operative Urban Bank Ltd | RBI | Business Restriction | official |
| Oct 2026 | Sri Mahatma Basaveshwar Co-operative Bank Ltd., Afzalpur | RBI | Business Restriction | official |
| Oct 2026 | The Tiruvalla Urban Co-operative Bank Ltd., Tiruvalla, Pathanamthitta | RBI | Business Restriction | official |
| Sep 2026 | Madhukar Dubey & its Proprietorship firm viz. Magnum Industrial Corporation | SEBI | Monetary Penalty | official |
| Sep 2026 | The Monghyr-Jamui Central Co-operative Bank Limited, Bihar | RBI | Monetary Penalty | official |
Industry compliance
Essential obligations
All obligations →| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Keep system logs for 180 days within India | Rolling 180 days (logs); 5 years (VASP KYC and transaction records) | CERT-In | official | |
Direction (iv) requires logs of all ICT systems to be kept securely for a rolling period of 180 days within Indian jurisdiction. Direction (vi) requires virtual asset service providers, exchanges and custodian wallet providers to keep KYC information and financial transaction records for five years. |
||||
| Report cyber incidents to CERT-In within six hours | Within 6 hours of noticing the incident | CERT-In | official | |
Direction (ii) requires service providers, intermediaries, data centres, body corporates and government organisations to report the cyber incidents listed in Annexure I to CERT-In within six hours of noticing them. Direction (i) requires clocks to be synchronised to the NIC or NPL network time servers. The Directions took effect 60 days after issue on 28 April 2022. |
||||
| Adopt a Board-approved outsourcing policy and give RBI access to outsourced records (commercial banks) | Ongoing; existing IT outsourcing agreements to comply at renewal or by 10 April 2026, whichever is earlier | RBI | official | |
Paras 10, 20 and 57 require Board-approved policies for financial-services outsourcing and for IT outsourcing. Para 15 bars outsourcing of core functions such as internal audit, compliance, KYC decisions for deposit accounts and loan sanctioning. Agreements must give RBI access to records held by the provider (para 34(viii)) and a right to inspect the provider (para 34(ix)); cloud adoption needs a documented cloud policy (para 92). No prior RBI approval is needed to outsource financial services (para 16). |
||||
| Adopt Board-approved green deposit policy and financing framework (commercial banks raising green deposits) | Ongoing; annual verification and impact assessment | RBI | official | |
Para 6 requires banks that raise green deposits to have Board-approved policies on green deposits and a financing framework. Para 13 requires the framework, with an external reviewer's opinion, to be published before implementation; para 8 requires the green deposit policy on the bank's website. Para 15 requires annual independent third-party verification of allocations and para 17 an annual impact assessment. |
||||
| Appoint a Designated Director and Principal Officer for AML/CFT compliance | Ongoing; notify FIU-IND and RBI of the appointments | RBI | official | |
Paras 5(1)(vii) and 14 of the Commercial Banks KYC Directions, 2025 have the Board nominate a Designated Director to ensure compliance with Chapter IV of the PML Act and Rules; para 15 requires a management-level Principal Officer. The bank notifies FIU-IND and RBI of each officer's name, designation, address and contact details, and the Principal Officer cannot also be the Designated Director. Rule 7(1) of the PML (Maintenance of Records) Rules requires the Principal Officer's details to be communicated to the Director, FIU-IND. |
||||
| Customer due diligence (KYC/CDD) at onboarding and on an ongoing basis | At onboarding + ongoing (updation every 2, 8 or 10 years by risk category) | RBI | official | |
Para 5(2)(v) defines CDD as identifying and verifying the customer and beneficial owner from reliable, independent sources, at account opening, for occasional transactions of ₹50,000 or more and for international money transfers. Para 17 bars anonymous or fictitious accounts. Paras 39-42 require risk-based updation at least every two years for high-risk, eight years for medium-risk and ten years for low-risk customers. Section 11A of the PMLA separately requires every reporting entity to verify the identity of clients and beneficial owners. |
||||
| No obligations match these filters. | ||||
Latest news
All news →-
RBI restricts Sri Mahatma Basaveshwar Co-operative Bank operations for six months
31 Oct 2026
The Reserve Bank of India has issued supervisory directions to Sri Mahatma Basaveshwar Co-operative Bank Ltd. in Afzalpur, effective October 8, 2026, under Section 35A of the Banking Regulation Act. The bank is…
-
RBI extends regulatory directive for cooperative urban bank three months
3 Oct 2026
The Reserve Bank of India has extended a regulatory directive issued under the Banking Regulation Act to Innovative Co-operative Urban Bank Limited, New Delhi for an additional three months through January 4, 2027. The…
-
RBI extends supervisory directions for Industrial Co-operative Bank Ltd.
3 Oct 2026
The Reserve Bank of India has extended supervisory directions issued to The Industrial Co-operative Bank Ltd., Guwahati under Section 35A read with Section 56 of the Banking Regulation Act, 1949. The original directive…
-
RBI finalizes Basel III market risk capital requirements for banks
26 Sep 2026
The Reserve Bank of India has issued final Directions on minimum capital requirements for market risk under the revised Basel III framework, effective April 1, 2027. The framework adopts the Simplified Standardised…
-
RBI penalizes gold-loan fintech KLM Axiva Finvest Limited for auction surplus non-payment
26 Sep 2026
The Reserve Bank of India imposed a monetary penalty of ₹2.70 lakh on KLM Axiva Finvest Limited for regulatory non-compliance discovered during statutory inspection. The company failed to remit surplus amounts to…
Quick links — official sites
- CBDT — Central Board of Direct Taxes
- CCI — Competition Commission of India
- DPBI — Data Protection Board of India
- ED — Directorate of Enforcement
- FIU-IND — Financial Intelligence Unit – India
- CERT-In — Indian Computer Emergency Response Team
- IBBI — Insolvency and Bankruptcy Board of India
- IRDAI — Insurance Regulatory and Development Authority of India
- IFSCA — International Financial Services Centres Authority
- MCA — Ministry of Corporate Affairs
- PFRDA — Pension Fund Regulatory and Development Authority
- RBI — Reserve Bank of India
- SEBI — Securities and Exchange Board of India
- SFIO — Serious Fraud Investigation Office
- Lokpal of India — Lokpal of India
- Ministry of Labour and Employment — Ministry of Labour and Employment
- NCIIPC — National Critical Information Infrastructure Protection Centre
- NFRA — National Financial Reporting Authority
- NPCI — National Payments Corporation of India
Newsletter
Get CRCGS Weekly
A free weekly email from the Centre for Risk, Compliance & Governance Studies: the week's regulatory news, new regulations, updated country profiles, and the Knowledge Hub's latest reading and events.





