On this page
RBI urges fintechs to treat customer data as a fiduciary responsibility
Our read
RBI’s fiduciary-data push will make compliance and resilience a decisive vendor-selection criterion, concentrating retailer fintech partnerships among larger, better-governed providers.
For operators
Retailers using fintech partners should tighten customer-data controls, audit vendor resilience, and align payment journeys with RBI’s higher governance expectations.
Watch
RBI circulars or supervisory actions translating fiduciary-data language into mandatory controls, penalties or audit requirements.
The report,
RBI Governor Sanjay Malhotra urged Indian fintechs to treat customer data as a fiduciary responsibility, strengthen resilience as they scale, and focus on financial inclusion. RBI also recognised Unified Fintech Forum as the sector’s second self-regulatory organisation.
- PMJDY accounts
- 57 crore PMJDY accounts
- Digital transactions in FY26
- 280 billion digital transactions in FY26
- UPI transactions per month
- 24 billion UPI transactions per month
Reported figures
From the report. Source details below
| FACE was recognised as the first fintech SRO in | 2024 |
|---|
Also in the report
- 280 billion digital transactions in FY26
- 24 billion UPI transactions per month
- Indian fintechs rank third globally in funding
Other figures
- 57 crore PMJDY accounts
Why it matters to operators
Deal teams should prioritize fintech targets with proven data stewardship, resilient infrastructure, and readiness to operate under industry-led self-regulation.
What to watch next
- Unified Fintech Forum codes of conduct covering consent, data sharing, cyber resilience, grievance redressal or third-party risk.
- Increase in RBI enforcement actions, data-breach disclosures, payment outages or restrictions on fintech-bank partnerships.
- Large banks requiring enhanced retailer and fintech due diligence for co-lending, card issuance or payment-processing arrangements.
- Merchant and consumer adoption shifts toward payment providers marketing privacy, reliability and transparent data practices.
Likely next moves
Our read of what comes next — analysis, not reported by the source.
- Audit all consumer-data flows across payment, loyalty, credit, marketplace and customer-service systems; identify data shared with fintech, bank and analytics partners.
- Require fintech partners to provide evidence of consent management, data retention limits, encryption, subcontractor controls, breach notification and operational-resilience testing.
- Review customer disclosures and consent journeys for co-branded cards, BNPL, wallets and seller-finance products; separate essential service data from marketing and profiling permissions.
- Build contingency plans for payment or lending-partner outages, including alternative rails, customer communications and manual service procedures.
- Prioritise partners with established governance capabilities and self-regulatory alignment over lowest-cost providers.
The counter-case
The case against this reading — not reported by the source.
The remarks may be more rhetorical than regulatory: without new binding rules, enforcement timelines, audit standards or penalties, many fintechs could treat the guidance as a compliance narrative rather than a near-term operating mandate. Stronger data controls may also raise costs and slow onboarding, disproportionately burdening smaller firms and potentially reducing the inclusion gains RBI wants to preserve.