The Reserve Bank of India is about to rewrite the rulebook for digital money safety. While the headline sounds consumer‑friendly, the underlying mechanics could reshape profit margins for every commercial bank that processes UPI, internet banking, and card payments. If you own shares in HDFC, ICICI, or even a payment aggregator like Paytm, the new liability matrix will directly hit your bottom line.
Electronic funds transfer (EFT) has been the lifeblood of India’s payments boom, growing at double‑digit rates since the 2016 demonetisation wave. The Payment and Settlement Systems Act, 2007 defines EFT as any transfer of money through electronic means, covering UPI, NEFT, IMPS, and card networks. The RBI’s draft directions sharpen the definition of “authorised” versus “unauthorised” transactions, aligning India with the EU’s PSD2 standards that demand strong customer authentication (SCA).
Advertisement
By mandating that any transaction secured with OTP, PIN, CVV, or dynamic password counts as authorised, the central bank pushes banks to upgrade authentication layers. The cost of compliance—typically 1‑2% of transaction volume—will be absorbed by banks, potentially squeezing net interest margins (NIM) if they cannot pass the expense to customers.
Historically, Indian banks have limited customer liability to ₹5,000 for unauthorised card fraud, a figure that many critics called a “token” amount. The 2026 draft raises the ceiling to ₹50,000 but offers a generous 85% reimbursement, capped at ₹25,000, for a single lifetime claim. The mechanism works as follows:
From an investor’s perspective, this creates a two‑fold exposure: higher provisioning for fraud losses and a new administrative overhead to verify timely reporting.
Legacy banks (HDFC, ICICI, Axis, Kotak) will face the steepest compliance costs because they handle the bulk of high‑value UPI and card traffic. Their large customer bases also mean a higher absolute number of fraud incidents, inflating provisioning ratios. In contrast, payments‑only banks and fintechs—Paytm Payments Bank, PhonePe, Razorpay—operate on thin‑margin, high‑volume models and have already invested heavily in tokenised card data and device fingerprinting. These players could emerge as the “secure‑by‑design” alternative, attracting risk‑averse consumers.
Advertisement
Small finance banks, payments banks, and regional rural banks are exempt from the draft, creating a regulatory arbitrage opportunity. Investors might see a migration of low‑value digital transactions toward these exempt entities, subtly shifting market share.
In 2019 the RBI introduced the “Two‑Factor Authentication” mandate for all online banking, which forced banks to roll out OTP‑based logins. The immediate cost was estimated at ₹2,500 crore across the sector, yet fraud losses fell by roughly 12% in the following year. A similar pattern emerged after the 2021 “Customer Liability” amendment, where banks tightened liability to ₹5,000 per incident, prompting a short‑term dip in share prices of major banks due to higher provisioning, but the market recovered as fraud rates declined.
These precedents suggest that while the short‑term earnings impact may be negative, the long‑term risk profile improves, potentially rewarding banks that execute the transition efficiently.
Bull Case: Banks that swiftly integrate AI‑driven fraud detection, partner with secure TPAPs, and communicate the new protection to customers could see higher retention and lower net fraud loss. This operational edge could translate into a 3‑5% uplift in ROE over the next 12‑18 months. Fintechs with already tokenised architectures stand to gain market share, making them attractive acquisition targets for larger banks.
Advertisement
Bear Case: Institutions that under‑invest in security, experience a surge in fraud claims, or fail to meet the five‑day reporting window will face higher provisioning, eroding profitability. The exemption of small finance and payments banks may also divert low‑value transaction volume away, compressing fee income for legacy players.
Strategic positioning will matter more than ever. Investors should scrutinise each bank’s disclosed fraud‑prevention budget, the speed of rollout for the new “authorised transaction” framework, and any partnership announcements with leading cybersecurity firms.