RBI New Credit Card Rules 2026 Explained: 10 Changes Every Credit Card User Must Know

India now has more than 100 million active credit cards in circulation. That number has doubled in roughly five years, and it has brought a matching wave of complaints with it: cards nobody applied for, limits raised without a word, late fees charged on the full bill after paying 95% of it, and closure requests that quietly vanished into a call centre.

The Reserve Bank of India has responded with a steady tightening of the rulebook rather than one dramatic announcement. The foundation is the Master Direction on Credit Card and Debit Card – Issuance and Conduct, 2022. On top of it, three separate 2026 developments now change how your card behaves: an amendment to the credit card conduct directions covering late fees, a new two-factor authentication mandate for every digital payment, and a finalised framework that bans banks from quietly bundling a card into something else you were buying.

Some of these are already live. Some arrive in 2027. A lot of what you will read elsewhere gets those dates wrong, which matters — a right you don't have yet is not a right you can complain about.

This guide walks through all ten changes in plain language, with the effective dates stated honestly, worked examples where money is involved, and the exact escalation path when a bank ignores any of it.

Why Did RBI Introduce New Credit Card Rules?

RBI did not act because credit cards are dangerous. It acted because the complaint data kept pointing at the same handful of practices, year after year, across almost every issuer.

Read through the RBI Ombudsman's annual reports and card grievances cluster into a short, familiar list. Cards arriving unrequested and then generating an annual fee. Limits jumping from ₹50,000 to ₹2 lakh with no conversation. Statements where "Total Amount Due", "Minimum Amount Due", GST and finance charges are technically all printed but arranged so that only an accountant could reconstruct what happened. Closure requests bounced between a helpline and a branch until the cardholder gave up. Recovery agents calling at 10 pm.

Four forces pushed the regulator from persuasion to prescription:

• Scale. Cards crossing 100 million active accounts means even a small percentage of bad outcomes is a very large number of people.
• Mis-selling incentives. Cards are sold by direct selling agents paid per activation, which reliably produces pressure and half-truths.
• Digital fraud. SIM-swap and phishing attacks made SMS OTP alone look thin as a defence.
• Inconsistency. Every issuer interpreted "late", "past due" and "grace period" slightly differently, so identical behaviour produced different credit scores at different banks.

The thread running through every rule below is the same: the cardholder must be able to see what is happening and must have said yes to it.

Quick Summary of RBI Credit Card Rules

Here is the whole picture in one table. Note the effective dates carefully — three of these are not in force yet.

Rule 1 Explicit Consent Before Any Credit Limit Increase

Your card issuer cannot raise your credit limit unless you specifically ask for it or agree to it. Not an SMS saying "congratulations, your limit is now ₹3 lakh." Not a pre-ticked box. Explicit consent, on record.

What changed

Under the Master Direction, limit enhancement requires the cardholder's explicit consent. The same logic applies in reverse for card upgrades — an issuer cannot move you from a basic card to a premium variant with a ₹5,000 annual fee because your spending "qualified" you.

A worked example

Rohit holds a card with a ₹80,000 limit. His bank's algorithm flags him as a good customer and pushes the limit to ₹2,50,000, sending an SMS. Rohit does nothing. Two things have now quietly happened. First, his available credit tripled, which is a genuine risk if the card is ever compromised. Second — and this is the part almost nobody notices — his credit utilisation ratio changed. On a ₹40,000 balance, utilisation dropped from 50% to 16%.

That sounds like good news, and for the score it usually is. But it also means the bank has extended him ₹1.7 lakh of unsecured exposure he never asked for or budgeted against. Under the rule, that push requires his yes.

Rule 2 No Unsolicited Credit Cards — and No Bundling One In

Issuing an unsolicited card, or upgrading an existing one without explicit consent, is strictly prohibited. This has been the position for years, and the penalty has teeth.

What you get if it happens

If an unsolicited card is issued and activated without your consent and you are billed for it, the issuer must reverse the charges immediately and pay you a penalty equal to twice the value of the charges reversed — without argument. You can also approach the RBI Ombudsman, who can award additional compensation for your time, expenses, harassment and mental anguish.

The 2026 addition: no more one-click bundling

The newer development closes a subtler loophole. Banks rarely mail out random cards these days. What they do is attach one to something else — a home loan sanction, a salary account opening, a fixed deposit — behind a single "I Agree" button covering five products at once.

The RBI's Responsible Business Conduct (Second Amendment) Directions, 2026, released on 15 June 2026 and effective 1 January 2027, addresses exactly this. The framework:

• Bans compulsory bundling of third-party or add-on products with the product you actually requested
• Requires separate, explicit consent for every additional product — no bundled consent screens
• Bans "dark patterns": pre-ticked boxes, false urgency, hidden fees, disguised ads, subscription traps, deliberately difficult opt-outs
• Requires banks to publish the list of their DSAs and DMAs so you can verify whether a caller is genuine
• Restricts sales calls to standard business hours, with no calls at all to DND-registered customers
• Requires disclosure of interest, fees, lock-ins and exit penalties before consent is taken
• Requires a feedback check-in within 30 days of any sale, to catch mis-selling early
• Bars bank employees from receiving incentives from third-party product providers

The remedy is the strongest part. Where mis-selling is established, the bank must refund the entire amount paid and compensate for any resulting loss — and the definition of mis-selling includes selling a product unsuitable for your profile even where you gave explicit consent.

What to do if you receive a card you never applied for

1. Do not activate it. No PIN generation, no OTP, no call to customer care asking about it.
2. Write to the issuer's grievance email stating you did not apply and want it closed with all charges reversed.
3. Ask explicitly for the 2× penalty if you were billed. Cite the Master Direction.
4. Check your credit report — an unactivated card must not be reported to credit bureaus at all.
5. No resolution in 30 days? Escalate to the RBI Ombudsman.

Rule 3 Faster Credit Card Closure — 7 Working Days or ₹500 a Day

This is the rule with the sharpest edge, and the one most cardholders don't know they can invoke.

The timeline

Any request to close a credit card must be honoured within seven working days, subject to your having paid all dues. If the issuer fails, it owes you ₹500 per day of delay, payable until the account is actually closed — provided there is no outstanding balance. You must be notified of the closure immediately by email or SMS.

The channels

Issuers must offer multiple routes to submit a closure request: helpline, a dedicated email ID, IVR, a prominently visible link on the website, internet banking, and the mobile app. Critically, the issuer cannot insist you send the request by post or any other channel designed to slow things down. That old trick is specifically named and banned.

If the bank stalls

1. File through a written channel — email or the app — never only a phone call. You need a timestamp.
2. Clear all dues first. The clock only runs on a zero-outstanding account.
3. Note the acknowledgement reference number and the date.
4. On day 8, write again citing the seven-working-day rule and claiming ₹500 per day.
5. Still nothing after 30 days? Escalate to the RBI Integrated Ombudsman.
6. Verify closure on your credit report — issuers must update credit information companies within 30 days.

Rule 4 Transparent Billing Statements

The core requirement: you must be able to reconstruct your bill without a spreadsheet. Two documents do the heavy lifting.

The Key Fact Statement

Every issuer must give you a one-page Key Fact Statement (KFS) along with the card application, setting out interest rates and charges. Alongside it, the Most Important Terms and Conditions (MITC) must be provided before activation, in bold text at a legible font size — not in six-point grey on page 14.

What your statement must make clear

Issuers must also publicise interest rates for various customer categories on their website, and must indicate the methodology for calculating finance charges with illustrative examples — particularly for the case where only part of the outstanding is paid. That last clause is the one that forced banks to start printing worked examples in statements.

Fee structure changes must be communicated at least 30 days in advance of implementation.

Rule 5 How Interest Must Be Calculated

This rule is quietly one of the most valuable, and almost nobody knows it exists. It stops the debt spiral from feeding on itself.

The principle: no capitalisation of charges

Unpaid charges, levies and taxes cannot be added to the balance on which interest is computed. Late payment fees, annual fees and the GST on them do not get folded into the principal and then start earning interest of their own. Before this, an unpaid ₹500 late fee plus ₹90 GST would join the revolving balance and compound at 42% a year alongside your actual spending.

The principle: no negative amortisation

The Minimum Amount Due must be structured so that paying it does not leave you worse off. RBI's own illustration in the Master Direction FAQs makes it concrete:

In plain terms: the minimum due must cover the full interest component plus some part of the principal. If it covered less, your balance would grow even while you paid every month — which is exactly the trap the rule closes.

What this does not change

Paying the minimum is still expensive. Interest still runs from the transaction date once you revolve, and your interest-free period disappears on new purchases until the balance is cleared. Cash withdrawals attract interest from day one with no grace period at all. The rule caps how the damage compounds; it does not make revolving cheap.

Rule 6 Penalty Charges Must Be Fair and Proportionate

The 2026 amendment to the credit card conduct directions makes two specific changes here. Both are meaningful. Neither is in force yet.

Change one: a three-day buffer before "past due"

Under the amendment, a card account can be reported as 'past due' to credit information companies — and penal charges such as late payment fees levied — only when the account remains past due for more than three days. Both triggers are now tied to the same threshold, replacing issuer-specific timelines with a single uniform standard.

Change two: fees on the outstanding, not the total

Late payment charges and related charges must be levied only on the outstanding amount after the due date, and not on the total amount due.

Here is why that sentence is worth real money. Suppose your bill is ₹50,000 and you pay ₹48,000 by the due date, leaving ₹2,000. Under the old practice at many issuers, the late fee slab was applied to the ₹50,000 bill. Under the amendment, it applies to the ₹2,000 you actually left unpaid. Same behaviour, radically different penalty.

What the three-day buffer does not do

Read this carefully, because the misunderstanding is expensive:

• Your due date does not move. The three days is a window before penalties and past-due flagging begin, not an extension of the deadline.
• Interest still accrues from the original due date. The buffer covers penal charges and bureau reporting only.
• Days past due are still counted from the statement due date, not from day four. This matters for the bank's internal asset classification.
• It applies to credit cards — not to personal loan EMIs or other dues.

On recovery practices, the broader position is unchanged and worth restating: agents may not intimidate or harass, may not call at odd hours, and may not contact your family or employer to apply pressure. Charges must be reasonable and proportionate to the amount due; exorbitant and arbitrary charges are prohibited.

Rule 7 Card Activation Rules and Dormant Cards

A card sitting unactivated in a drawer used to generate an annual fee anyway. That is now specifically dealt with.

The 30-day OTP rule

If a card has not been activated for more than 30 days from the date of issuance, the issuer must seek OTP-based consent from you before activating it. If no consent comes back, the issuer must close the account at no cost to you within seven working days from the date it sought confirmation, and must tell you the account has been closed.

Nothing reaches your credit report before activation

No issuer may report credit information about a new card account to credit information companies before the card is activated. Any such information already reported for inactivated cards had to be withdrawn.

This is a bigger deal than it sounds. It means a card you never activated cannot appear on your CIBIL report, cannot count as a new credit enquiry hitting your profile, and cannot show up as an account when a future lender assesses you.

Cards you stop using

If a card goes unused for more than one year, the issuer may initiate closure — but only after informing you and waiting 30 days for a response, and subject to your paying any dues. So a dormant card will not silently vanish; you get notice and a chance to object.

Rule 8 Fraud Protection, 2FA and Tokenisation

This is where 2026 brought the most immediately visible change to how you actually pay.

Two-factor authentication — live since 1 April 2026

Under the RBI's Authentication Mechanisms for Digital Payment Transactions Directions, 2025, every digital payment in India must now use at least two independent authentication factors, and at least one of them must be dynamically generated — unique to that specific transaction. This applies across credit cards, debit cards, UPI and wallets, both online and at point of sale.

The three categories a factor can come from:

• Something you know — PIN, password
• Something you have — your registered device, a card, a device-bound token
• Something you are — fingerprint, face

OTPs still qualify as a factor. What changed is that an OTP can no longer be the only line of defence — which is the direct response to SIM-swap and phishing attacks where the fraudster gets the OTP. Banks can now combine OTPs with biometrics, device tokens or in-app approvals. In practice, most people notice this as more in-app approval prompts and fewer pure-SMS flows.

RBI has also signalled that similar norms extend to international card-not-present transactions by October 2026 — the category that historically bypassed Indian OTP requirements entirely.

Tokenisation

Merchants, payment aggregators and other third parties are prohibited from storing full card-on-file data — only the card issuer and the network may. Everyone else may retain limited data such as the last four digits and the issuer name, purely for identification on your saved-cards screen. Separate tokens are required for online, point-of-sale and in-app transactions.

This is why checkout pages started asking you to "secure your card" instead of silently saving it.

If an unauthorised transaction happens

Under RBI's customer liability framework, the timeline is what protects you:

Practically: block the card in the app first, then report in writing, then follow up. Never share an OTP, CVV or PIN with anyone — including someone claiming to be from your bank. No genuine bank employee will ever ask.

Rule 9 Grievance Redressal — The Escalation Ladder

Every rule above is only as good as your ability to enforce it. The path is fixed and it works, provided you follow it in order.

Step 1 — The issuer's grievance cell

Start here. It is mandatory. Use the bank's dedicated grievance email or the complaint form in the app or on the website — not a phone call. Include your card number's last four digits, the date, the specific rule breached, and the outcome you want. Get a complaint reference number and keep it.

Step 2 — The Nodal Officer

If the frontline cell doesn't resolve it, escalate to the bank's Nodal Officer or Principal Nodal Officer, whose contact details must be published on the bank's website.

Step 3 — The RBI Integrated Ombudsman

If the bank has not resolved your complaint within 30 days, or has rejected it, or you are unsatisfied with the resolution, you can approach the RBI Ombudsman.

• Online: the RBI's Complaint Management System at cms.rbi.org.in
• Cost: free — there is no fee, and you do not need a lawyer
• Powers: the Ombudsman can direct the bank to pay compensation for loss of your time, expenses incurred, and harassment or mental anguish suffered

Rule 10 Clear Communication of Terms and Conditions

The final rule is the one the other nine rest on: you cannot consent to something you were never shown.

Issuers must clearly disclose, before you commit:

• Fees — joining fee, annual fee, renewal fee, and the exact spend threshold at which the fee is waived
• Interest — the annual percentage rate for different transaction categories, including retail purchases and cash advances, published on the website and in the welcome kit
• Rewards — earn rates, caps, exclusions, expiry, and any redemption fee
• EMI conversion — for EMI offers the issuer must give clear details of principal, interest, and any discount provided to make it "no cost", and must include those details in the card statement
• Foreclosure — the charge for pre-closing an EMI conversion early
• Surcharges — fuel and railway surcharges require issuer disclosure; foreign currency markup must be shown on each transaction

Two further points worth knowing. Cards issued free of charge must have no hidden charges — "lifetime free" has to actually mean it. And any change in the fee structure must be communicated to you at least 30 days in advance, so a bank cannot introduce an annual fee on a free card and bill you the same month.

Issuers also cannot disclose information obtained when opening your account or issuing your card to any other person or organisation without your explicit consent. And you have the right to change your billing cycle at least once, which is genuinely useful if your due date lands awkwardly against your salary date.

Other 2026 Changes Worth Knowing

Your credit report is going weekly

RBI moved lenders from monthly to 15-day credit bureau reporting from 1 January 2025. Draft amendments to the Credit Information Reporting Directions push this further: a full file once a month, plus weekly incremental files as on the 9th, 16th, 23rd and last day of each month, capturing new accounts, closures, repayments and classification changes.

What this means for you is symmetrical. Pay down a large balance on the 6th and it can reach the bureaus within days rather than next month. Miss a payment and that reaches them just as fast. The system stops being sluggish about recognising discipline — and stops being slow to notice slippage. Our guide to credit utilisation explains why the timing of your payment relative to your statement date matters more under faster reporting.

Disaster relief without asking

The 2026 amendment also lets card issuers extend relief to customers affected by natural disasters on their own initiative, without waiting for the customer to apply. This provision takes effect earlier than the rest of the amendment — from 1 July 2026.

Higher-value spending is more visible to the tax department

Separately from RBI, credit card spending above prescribed thresholds is reported to the Income Tax Department under the Statement of Financial Transactions framework. This is worth stating plainly because it is widely misunderstood: it is a reporting mechanism, not a new tax. You owe nothing extra for spending. Problems only arise where there is a large gap between declared income and actual spending. If you're preparing your return, our ITR filing guide covers what to keep ready.

Your Rights as a Credit Card User

Every item below is a rule an issuer must follow, not a courtesy.

• Transparent statements and a Key Fact Statement
• Explicit consent before any card, limit or upgrade
• Closure in 7 working days or ₹500/day
• Fair, proportionate recovery practices
• Interest with no capitalisation of fees or GST
• Free closure of an unactivated card
• Zero liability on fraud reported in 3 working days
• Tokenised card data at merchants
• 30 days' notice before any fee change
• Change your billing cycle at least once
• Nothing on your credit report before activation
• Free escalation to the RBI Ombudsman

Common Mistakes Cardholders Still Make

The rules protect you from the bank. They do not protect you from yourself. These six mistakes cost Indian cardholders more than every hidden charge combined.

1. Treating the Minimum Amount Due as the bill

It is the single most expensive misreading on the statement. The MAD keeps your account current and your score intact. It does almost nothing to the debt. A ₹1,00,000 balance serviced at the minimum, at typical card rates, takes many years and costs more in interest than the original spending. Rule 5 stops it compounding as fast. It does not stop it.

2. Withdrawing cash on a credit card

There is no interest-free period on a cash advance. Interest starts on the day of withdrawal, and a cash advance fee applies on top. A personal loan is almost always cheaper if you genuinely need cash.

3. Missing due dates by carelessness rather than shortage

Most late payments aren't affordability problems, they're calendar problems. Set an auto-debit for at least the minimum as a floor, and pay the rest manually. The auto-debit is insurance against forgetting, not a payment strategy.

4. Never reading the statement

Subscription charges you cancelled months ago, a fee that appeared without notice, a transaction you don't recognise — all of it is visible, and all of it is only disputable if you notice. Two minutes a month.

5. Sharing OTPs

Every rule above is void the moment you hand over an OTP. If the transaction is authenticated with your credentials, establishing zero liability becomes much harder. No bank calls to ask for one.

6. Closing the oldest card for no reason

Covered in Rule 3, but worth repeating because it is so common: your oldest card is quietly doing useful work for your credit age and your total available credit. Closing a free card you simply don't use much is often a small self-inflicted score cut.

Common Myths, Corrected

Frequently Asked Questions

Summary at a Glance

Final Thoughts

Strip away the regulatory language and these ten rules say something quite simple. A credit card is a loan you carry in your wallet. Every element of that loan — how much you can borrow, what it costs, when it's due, what happens if you're late, and how you walk away — must be shown to you clearly and agreed to by you specifically.

The direction of travel is unmistakable. Consent has to be explicit and separate. Penalties have to be proportionate to what you actually owe. Authentication has to be more than a code over SMS. Your credit file has to reflect reality within days. And when a bank gets it wrong, there is a free, lawyer-free escalation path that ends at a regulator with the power to order compensation.

Three practical things to do this week. Open your last statement and find the Total Amount Due, the Minimum Amount Due and the due date — if you can't locate all three in thirty seconds, that is worth knowing. Check your credit limit against what you agreed to. Turn on transaction alerts, because the three-working-day fraud window is the most valuable right you have and it only works if you notice.

And keep the two 2027 dates in mind. On 1 January 2027, no bank can bundle a card into a loan without asking you separately. On 1 April 2027, paying most of your bill on time finally counts for something. Neither right helps you if you don't know it exists on the day it arrives.