Back to all jurisdictions

India

IN · IND · Asia-Pacific

20 regulators · 49 laws & regulations · 17 obligations · 90 enforcement actions · 10 upcoming deadlines

India operates one of the world's most layered financial regulatory architectures, built around sectoral regulators with statutory independence and coordinated through the Financial Stability and Development Council (FSDC).

India — hero image

Regulatory pulse · 90 days

Laws & Regulations Enforcement News
18 AUGSEPOCT15 NOV · TODAY

Overview

India operates one of the world's most layered financial regulatory architectures, built around sectoral regulators with statutory independence and coordinated through the Financial Stability and Development Council (FSDC). The Reserve Bank of India (RBI) anchors the system as the central bank and regulator of banks, non-banking financial companies (NBFCs), payment systems, and, since 2019, housing finance companies. The Securities and Exchange Board of India (SEBI) governs capital markets, listed companies, and market intermediaries; the Insurance Regulatory and Development Authority of India (IRDAI) and the Pension Fund Regulatory and Development Authority (PFRDA) cover their respective sectors. Corporate law sits with the Ministry of Corporate Affairs (MCA) under the Companies Act, 2013, administered in the field through Registrars of Companies, with the Insolvency and Bankruptcy Board of India (IBBI) regulating the insolvency ecosystem created by the 2016 Code. India's anti-money-laundering framework rests on the Prevention of Money Laundering Act, 2002 (PMLA), with the Financial Intelligence Unit – India (FIU-IND) as the national FIU receiving suspicious transaction and cash transaction reports, and the Enforcement Directorate (ED) investigating money laundering and foreign-exchange violations under PMLA and FEMA. India's 2024 FATF mutual evaluation placed the country in the "regular follow-up" category, the strongest outcome band, while identifying areas for improvement in prosecution outcomes and supervision of designated non-financial businesses and professions. The regulatory perimeter has expanded rapidly into technology and data. The Digital Personal Data Protection Act, 2023, India's first comprehensive data protection statute, moved into implementation with rules notified in late 2025, creating the Data Protection Board of India as the adjudicatory body. CERT-In's 2022 directions impose some of the world's tightest cyber-incident reporting windows (six hours), layered beneath sector-specific cyber rules from RBI, SEBI, and IRDAI. Fintech regulation is dense and fast-moving: digital lending, payment aggregators, and prepaid instruments are governed by consolidated RBI directions, while virtual digital assets are taxed and brought under PMLA reporting obligations, though a full licensing regime remains under deliberation. The International Financial Services Centres Authority (IFSCA) operates a separate unified regulatory regime for GIFT City, India's offshore financial centre. Enforcement is active and public. RBI publishes monetary penalties typically for KYC, exposure-norm, and reporting failures on a near-weekly cycle, and has shown willingness to impose business restrictions on large institutions for supervisory concerns. SEBI runs a high-volume adjudication and settlement docket, and the ED's PMLA caseload has grown sharply. For compliance officers, India is a high-frequency jurisdiction: master directions are amended continuously, and the compliance calendar is dense with monthly, quarterly, and annual filings across regulators. This profile tracks the principal regulators, instruments, obligations, and deadlines, with enforcement actions updated on a rolling basis.

Recent enforcement

Open tracker →
Enforcement actions in India
Date Entity Regulator Action Source
Oct 2026 Puducherry Co-operative Urban Bank Ltd RBI Business Restriction official
Oct 2026 Sri Mahatma Basaveshwar Co-operative Bank Ltd., Afzalpur RBI Business Restriction official
Oct 2026 The Tiruvalla Urban Co-operative Bank Ltd., Tiruvalla, Pathanamthitta RBI Business Restriction official
Sep 2026 Madhukar Dubey & its Proprietorship firm viz. Magnum Industrial Corporation SEBI Monetary Penalty official
Sep 2026 The Monghyr-Jamui Central Co-operative Bank Limited, Bihar RBI Monetary Penalty official

Essential obligations

All obligations →
Obligation Timing Regulator Source Detail
Keep system logs for 180 days within India Rolling 180 days (logs); 5 years (VASP KYC and transaction records) CERT-In official
Report cyber incidents to CERT-In within six hours Within 6 hours of noticing the incident CERT-In official
Adopt a Board-approved outsourcing policy and give RBI access to outsourced records (commercial banks) Ongoing; existing IT outsourcing agreements to comply at renewal or by 10 April 2026, whichever is earlier RBI official
Adopt Board-approved green deposit policy and financing framework (commercial banks raising green deposits) Ongoing; annual verification and impact assessment RBI official
Appoint a Designated Director and Principal Officer for AML/CFT compliance Ongoing; notify FIU-IND and RBI of the appointments RBI official
Customer due diligence (KYC/CDD) at onboarding and on an ongoing basis At onboarding + ongoing (updation every 2, 8 or 10 years by risk category) RBI official

Latest news

All news →

Quick links — official sites

Newsletter

Get CRCGS Weekly

A free weekly email from the Centre for Risk, Compliance & Governance Studies: the week's regulatory news, new regulations, updated country profiles, and the Knowledge Hub's latest reading and events.

Free. We first email you a link to confirm the address; you can unsubscribe at any time. How we handle your address: our Privacy Policy.