RBI Credit Card Rules 2026: Every Change, Explained

India's credit-card market runs on one rulebook: the RBI Master Direction – Credit Card and Debit Card (Issuance and Conduct), 2022, plus the tokenisation and authentication directions that fully bite in 2026. Most cardholders never read it — and banks count on that. This guide lays out every rule that protects you in 2026, in plain language, with the exact step to escalate when an issuer breaks one.

Why these rules exist

The Master Direction was RBI's response to years of aggressive card practices — silent limit hikes, surprise add-ons, opaque interest, and forced retention when you tried to close a card. It converts "industry norm" into enforceable rights. Every rule below is something a bank must do (or must not do); breaches are actionable through the bank's grievance channel and then the RBI Ombudsman.

1. Consent & card activation

You cannot be issued — or charged for — a card you never asked for or activated.

• If a card is not activated within 30 days of issuance, the issuer must seek your OTP-based consent to activate it.
• If you don't consent, the issuer must close the account free of cost within 7 working days — no closure charge, no lingering fees.
• No card can be issued without your explicit application/consent (no "pre-approved card auto-dispatched and billed").

2. Credit limit can't change without your consent

Clause 15 is explicit: the credit limit shall not be increased without the cardholder's consent in writing, digitally, or through any other recordable means.

We cover the full escalation for unauthorised hikes in credit card limit increase without permission.

3. Billing cycle & the 14-day window

Two protections matter here:

• You must get at least 14 days between statement generation and the payment due date.
• Issuers must send the bill with no delay that compresses your payment window; disputes raised within the stipulated period can't be treated as default.

Understanding the gap between your statement date and due date is the single biggest lever on interest-free credit — see how the rewards and float work together when you time spends right.

4. Late fees & interest — what's regulated

RBI curbed the compounding traps that ballooned small misses into large debts:

• Late-payment fees can only be levied on the amount unpaid after the due date, not the total bill.
• Unpaid charges, levies and taxes cannot be capitalised for charging interest — i.e., late fees and GST are not themselves compounded.
• Interest can only be charged from the transaction/statement date as disclosed; "no-cost EMI" must not hide an interest component beyond what's disclosed.

Even with these limits, revolving a balance at typical 36–48% APR is the most expensive debt most Indians can take. Always pay the full statement, not the minimum.

5. Tokenisation & authentication (April 2026)

RBI's authentication directions require full compliance by 1 April 2026. For you:

• Merchants can no longer store your raw 16-digit card number — they store a token instead.
• Tokenisation is free and only on explicit consent, validated with an Additional Factor of Authentication (AFA — typically OTP).
• You can refuse tokenisation and enter card details manually each time; you can also de-register tokens.

6. Add-on services are opt-in — and removable

Bundled insurance, alert packs, and similar add-ons must be opt-in; they cannot be auto-enrolled. You can disable any add-on at any time without penalty. If you spot a recurring add-on charge you never enabled, it's reversible.

7. MITC: the document banks bury

The Most Important Terms and Conditions (MITC) must be sent separately with your welcome kit, and a fresh MITC must be issued every time a term changes. This is your audit trail: when a bank devalues rewards or changes fees, the MITC update is the legal record — keep them.

8. Free, fast card closure

Banks must let you close a card easily:

• A closure request must be honoured within 7 working days (after clearing dues).
• If the issuer fails to close within 7 working days, it must pay ₹500 per day of delay to you until closure.
• Issuers cannot force "retention" loops or keep a card alive against your written request.

If a bank breaks a rule: the escalation

1. Raise a written complaint with the issuer (email + ticket number). Cite the specific Master Direction clause.
2. If unresolved in 30 days, escalate to the RBI Ombudsman via cms.rbi.org.in — it's free and online.
3. Keep your MITC, statements, and the bank's responses as evidence.

FAQ

Can a bank charge me for a card I never activated?

No. If you don't activate within 30 days and don't give OTP consent, the bank must close it free within 7 working days.

How many days do I get to pay my credit card bill?

At least 14 days between statement generation and the due date, per RBI.

Are late fees compounded with interest?

No. Unpaid charges, fees and taxes cannot be capitalised for interest — only the unpaid principal accrues interest.

Is tokenisation mandatory and does it cost anything?

It's free and consent-based. Merchants must tokenise saved cards, but you can decline and enter details manually, or de-register tokens.

What if my bank delays closing my card?

It owes you ₹500 per day of delay beyond 7 working days, provided dues are cleared.

Where do I complain if the bank ignores these rules?

Complain to the bank first; if unresolved in 30 days, file free with the RBI Ombudsman at cms.rbi.org.in.

This is an educational summary of RBI's Master Direction and related directions, not legal advice; refer to the official RBI text for the binding wording and verify current terms with your issuer. Browse cards on InvestingPro and see our methodology.