RBI's dark-pattern rules from 1 January 2027: a checklist

Published 16 Oct 2026. By Team Conduct Lens. Updated 16 Oct 2026.

What the directions say, who should read which text, and twelve things to look for in every customer journey.

What changed

RBI issued its Responsible Business Conduct (Second Amendment) Directions, 2026 on 15 June 2026. They apply from 1 January 2027. Press coverage describes four things that matter to anyone who runs a digital lending journey:

Dark patterns in digital interfaces are barred, with an illustrative list that includes false urgency, basket sneaking, forced action, subscription traps and drip pricing.
Explicit consent is needed before selling the entity's own or a third party's products, and compulsory bundling is treated as mis-selling.
Interfaces are to be tested and audited periodically to find unfair features, including dark patterns.
Where mis-selling is established, the customer is to be refunded in full.

Who is covered

Reports disagree on scope. One says the directions reach both banks and NBFCs; another says they apply to commercial banks and excludes small finance banks, payments banks, regional rural banks and local area banks. RBI issues its conduct directions entity category by category, so read the direction for your own category and ask your counsel. We do not state here which entities are covered.

A twelve-point checklist for each journey

Walk each customer journey, from the first offer to the final decision, and note the answer to each question with a dated screenshot.

Urgency. Is there a countdown, an “offer ends today” or a “only 2 left” claim? Is it true, and does it ever restart?
Consent defaults. Is every optional consent box or toggle switched off when the screen loads?
One purpose, one choice. Does each consent cover a single purpose, or does one tick cover terms, data sharing and marketing together?
Add-ons. Is anything, such as insurance, added to the loan or basket without the customer choosing it?
Bundling. Can the customer be approved without buying a third-party product?
Fees upfront. Are all mandatory charges visible before the customer commits, and does the total stay the same at every step?
Equal choices. Is declining as easy to see and press as accepting, in size, contrast and wording?
Respectful wording. Does the decline option avoid guilt, fear or ridicule?
No forced detours. Does progress ever require an unrelated action, such as installing an app or sharing contacts?
Leaving is as easy as joining. Can the customer cancel or withdraw consent in about as many steps as it took to sign up?
No nagging. After a prompt is dismissed, does it come back?
Plain language. Are there double negatives or confusing choices anywhere?

Keeping evidence for the periodic audit

Because the directions expect periodic testing and audits, an auditor will want more than a statement that you checked. Keep, for every run:

dated screenshots of each step, with the build or release version;
a written definition of the journey, so the same route can be repeated;
a findings register with the requirement each finding relates to, who reviewed it and when;
proof that a fix was re-tested after the next release, not just that a ticket was closed.

That is the work ConductLens is built to do. A free snapshot looks at one public page; a baseline audit covers up to eight journeys.

Want to see how one of your journeys measures up? We look at one public journey for free and send a one-page snapshot, with no access or data needed from you. Ask for a free snapshot

Keep reading

Sources

This guide is general information, not legal advice, and not an opinion on any institution's position. Requirements change: check the official RBI text for your entity category before relying on anything here.