惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

B
Blog
Attack and Defense Labs
Attack and Defense Labs
大猫的无限游戏
大猫的无限游戏
爱范儿
爱范儿
MongoDB | Blog
MongoDB | Blog
Last Week in AI
Last Week in AI
Engineering at Meta
Engineering at Meta
让小产品的独立变现更简单 - ezindie.com
让小产品的独立变现更简单 - ezindie.com
月光博客
月光博客
IT之家
IT之家
D
Docker
L
LangChain Blog
奇客Solidot–传递最新科技情报
奇客Solidot–传递最新科技情报
S
SegmentFault 最新的问题
Martin Fowler
Martin Fowler
Recorded Future
Recorded Future
C
CERT Recently Published Vulnerability Notes
H
Hackread – Cybersecurity News, Data Breaches, AI and More
P
Privacy International News Feed
博客园 - 三生石上(FineUI控件)
博客园 - Franky
Cisco Talos Blog
Cisco Talos Blog
C
Cyber Attacks, Cyber Crime and Cyber Security
A
About on SuperTechFans
Recent Announcements
Recent Announcements
云风的 BLOG
云风的 BLOG
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
博客园 - 聂微东
酷 壳 – CoolShell
酷 壳 – CoolShell
G
GRAHAM CLULEY
P
Proofpoint News Feed
L
Lohrmann on Cybersecurity
T
The Blog of Author Tim Ferriss
T
Threat Research - Cisco Blogs
GbyAI
GbyAI
P
Palo Alto Networks Blog
Cyberwarzone
Cyberwarzone
cs.AI updates on arXiv.org
cs.AI updates on arXiv.org
SecWiki News
SecWiki News
Help Net Security
Help Net Security
有赞技术团队
有赞技术团队
Blog — PlanetScale
Blog — PlanetScale
Cloudbric
Cloudbric
C
Cybersecurity and Infrastructure Security Agency CISA
量子位
CTFtime.org: upcoming CTF events
CTFtime.org: upcoming CTF events
I
Intezer
C
Cisco Blogs
The Cloudflare Blog
S
Securelist

MEDIANAMA

India in talks with US, Anthropic for Mythos access; no Indian firms in Project Glasswing yet Eternal Q4FY26: All Users Pay Higher Platform Fee, Only Some Get Discounts Amazon, Meta to challenge PhonePe-Google Pay dominance as UPI cap delayed since 2020 Meta failed to protect the safety of under-13s: European Commission If markets and regulators are ready for network slicing, we are ready: JIO Why defining ‘news’ won’t fix the free speech problems of draft IT Rules? #NAMA Eternal Q4FY26: Goyal Dismisses AI Disruption Risk as Zomato Quietly Builds Agentic Commerce Infrastructure Karnataka files appeal challenging the bike taxi ban lift in the Supreme Court How did WhatsApp turn 17 govt. flags into 9,400 digital arrest scam bans? Google Wallet integrates Aadhaar as digital ID, expands India’s mobile identity ecosystem Kerala HC issues notice on MediaOne’s Facebook page block in India MeitY warns VPN providers against enabling access to blocked betting platforms Shreya Singhal targeted private censorship. Today’s threat is the State #NAMA Amazon scales its quick delivery service ‘Amazon Now’ in 100 cities Can MeitY issue binding rules via advisories? Experts raise alarm over draft IT Rules #NAMA How 2019 election code of ethics became India’s three-hour content takedown mandate #NAMA Australia proposes new levy on big tech to fund news, opens draft law for consultation ‘judge, jury, executioner’: experts warn of Inter-Departmental Committee (IDC) overreach under New draft IT Rules Lowdown: TRAI flags low deployment under PM-WANI in public Wi-Fi consultation paper Why the NBFC licence matters for MobiKwik China blocks Meta-Manus deal, asserts origin-country jurisdiction: what this means for India ‘No transparency’: experts warn of expanding powers to block online speech in India #NAMA X launches standalone iOS messaging app XChat with encryption in India How India’s content takedown framework was built and where It has gone wrong #NAMA Claude Mythos puts India on alert: CERT-In, telcos, banks assess unprecedented cyber risks Explained: why did the RBI cancel Paytm’s banking licence? Meta now instantly blocks content in India Govt. asks ZEE5 to halt ‘Lawrence of Punjab’ web series release Online Gaming Rules notified, to be in effect from May 1, what are the major changes? RBI mandates additional factor authentication for e-mandates No notice, no explanation, no recourse: how content creators experience censorship in India #NAMA Telangana Police invokes UAPA to demand TeluguScribe’s user data from X Lowdown: RBI releases draft PPI rules covering capital requirements, wallet limits & escrow norms MeitY tightens AI label rules, mandates continuous disclosure Watch Live: IT Rules and the Future of Online Speech in India, Delhi April 23, #NAMA Govt. defends 4 PM YouTube ban, cites foreign influence and ‘digital lobbying’ in Delhi HC Anthropic’s Mythos AI accessed without approval via third-party vendor route: Report YouTube expands AI likeness detection tool to celebrities amid deepfake surge ECI orders 3-hour takedown rule for AI and fake content in elections Final Call: IT Rules and the Future of Online Speech in India, Delhi April 23, #NAMA Announcing Speakers: Victims of Censorship | IT Rules and the Future of Online Speech in India, Delhi April 23, #NAMA Apple withholds financial data as India App Store antitrust case heads to final hearing Sony rolls out age checks in Playstation in the UK, users to prove age to access chat Vercel confirms hack via third-party AI tool, says sensitive data safe Karnataka High Court stays blocking orders against Proton Mail J&K DMs impose sweeping 60-day social media curbs; IFF calls them “illegal, overbroad” Flipkart plans ticketing entry, food delivery pilot in May ahead of IPO ANI v OpenAI: Not Everything an LLM Does is Copyright Infringement EU’s “safe by design” age-verification app cracked in minutes, raising data security fears Molitics’ Instagram suspended days after Facebook ban Speaker Announcement: IT Rules and the Future of Online Speech in India, April 23, 2026, Delhi X has only responded to 13 out of 94 takedown notices since 2024: Centre tells Gujarat HC Jio Financial Services Q4FY26 profit declines 14% to Rs 272 crore Bombay HC cracks down on fake ‘NSE’ social media handles amid rising impersonation fraud Government drops proposal to mandate Aadhaar app on smartphones Ola’s Krutrim quietly shuts down its agentic AI assistant ‘Kruti’ Anthropic taps Peter Thiel-backed Persona for Claude ID checks, raising DPDP concerns YouTube rolls out option to turn off Shorts, expands time controls Amnesty calls for ‘immediate withdrawal’ of India’s 2026 IT Amendment Rules, cites threat to free speech and privacy Lowdown: Insurers have to comply with DPDP as IRDAI updates Cyber Security Guidelines European Commission proposes Google have to share search data with rivals under the DMA AIGEG: MeitY’s new AI governance body excludes regulators recommended by its own AI guidelines Amazon acquires Globalstar for $11.57 Billion: What it means for India European Commission rolls out privacy-focused age verification app for child safety Reading List: IT Rules and the future of online speech in India, April 23, Delhi #NAMA Digital rule, colonial echo – India’s IT Rules 2021 amendments Agenda: IT Rules and the future of online speech in India, Delhi, April 23 #NAMA Motorola gets court order to block YouTube videos critical of its phones in India Apple and Google promote ‘nudify’ apps despite policy bans, report finds National security could be used to mandate registration of online games HBO Max enters India via JioHotstar partnership Andhra Pradesh police detain stand-up comedian Anudeep Katikala over YouTube video jokes Aptoide sues Google for app store monopoly, alleges ‘anticompetitive chokehold’ HBO Pushes X to Unmask User Behind Euphoria Season 3 Spoilers Delhi HC directs DoT, MeitY to take action against Tucows for failing to take down infringing URLs in Premier League case Claude users say accounts suspended after being incorrectly flagged as minors MeitY may let users, intermediaries join content-blocking hearings Sucheta Dalal challenges Delhi Court order using ‘Right to Be Forgotten’ in Sterling Biotech case Govt launches Rs 10,000 Cr Startup India Fund of Funds 2.0 to bridge early-stage funding gap in deep tech Advisories as Law? Panelists Debate Legal Sanctity Under Draft IT Rules Amendments Independent journalists in Punjab allege censorship by ruling AAP using copyright strikes, IT act Supreme Court Issues Notice on PIL Seeking Biometric Verification of Voters Fact-check: MP Nishikant Dubey’s claim on X community notes & Australian tax is false “No scientific evidence”: 438 scientists call for pause on age-based controls until benefits and risks understood Developer partially bypasses Google’s AI watermark, undermining detection India’s deepfake rules rely on Event Announcement: IT Rules and the Future of Online Speech in India, April 23, #NAMA UK plans jail risk for tech executives over failure to remove intimate images Press bodies demand ‘unconditional withdrawal’ of draft amendment to IT Rules, warns of free speech threat Zoho revenue crosses Rs 12,000 crore in FY25, but profit slips 3% YouTube’s AI avatar tool for Shorts raises questions around India’s deepfake rules, personality rights Instagram expands safety settings on teen accounts with 13+ content ratings Digi Yatra is eyeing international travel roll-out with passport-based enrolment Meta’s new AI model Muse Spark is coming to WhatsApp. Here is what that means for Indian users Andhra Pradesh explores DigiLocker age tokens for social media curbs on children aged 13-16 Kunal Kamra tells Bombay HC police sent “thousands” of takedown notices via Sahyog portal Extra safeguard for the elderly: RBI suggests trusted person approval for high-value digital payments Delhi court orders Google to remove Sterling Biotech case links, cites ‘right to be forgotten’ RBI Proposes 1-hour delay, customer controls for digital payments as frauds surge Should only MIB-authorised apps be allowed to stream free TV on Smart TVs? TRAI Seeks Inputs OpenAI releases child safety policy framework recommendations to combat AI-enabled CSAM
RBI tightens norms for bundled products, bans dark patterns
Amit Singh · 2026-06-17 · via MEDIANAMA
  • Download the draft amendment directions from the RBI here

Banks and NBFCs can no longer engage in “compulsory bundling,” where buying one product means inadvertently buying another. Banks will now be required to get “explicit consent” from users before selling any financial product or service, whether their own or offered through a third party. The changes are part of the Reserve Bank of India’s (RBI) new framework governing the advertising, marketing, and sale of financial products and services by banks.

What is compulsory bundling, and why has the RBI banned it?

The latest directions of the RBI define “compulsory bundling” as the practice by a bank of making the availability of one product or service conditional upon purchase of another product or service.

For instance, when you apply for a home loan, banks and NBFCs often push an insurance policy alongside it. Their reasoning: an extra insurance policy protects the family if the borrower defaults or dies.

However, this practice was recently called out by Finance Minister Nirmala Sitharaman. She argues that if a home loan is already backed by the house itself, why is an unwarranted insurance policy being forced on customers? She is not saying that insurance itself is redundant. However, the problem is when an insurance policy becomes a near-default part of the loan process. When a borrower is unaware of what extra protection the policy actually offers, the practice stops being advice and starts being mis-selling.

Who should be held accountable when the customer does not fully understand what they’ve signed? This is exactly why the RBI has banned compulsory bundling. Even if a product is mandatory and part of a larger service, the person does not need to buy it from the bank or its preferred partner. They must be given an option to buy it elsewhere, the new rules mandate.

Voluntary product packages and complimentary offerings without additional cost will not be labeled as compulsory bundling.

How would consent work under the new RBI framework?

Banks will now be required to get “explicit consent” from users before selling any financial product or service, whether their own or through a third party. Consent may be obtained through:

  • physical or digital signatures;
  • OTP-based approvals;
  • digitally recorded confirmations; or
  • clearly demarcated consent sections within agreements

If an application form includes multiple products or services, the nature and features of each product must be laid out very clearly, and consent must be obtained for each product.

The new rules also mandate that customers must have an option to choose which of these products they want to buy and which they want to ignore.

The default consent option must be “No” or “I do not agree.”

Even if consent has been obtained, a product can still be treated as mis-sold if it is not suitable for the customer. The liability shifts from “Did you sign?” to “Why was this sold at all?”

To determine whether a product is suitable for a customer, banks must assess the following:

  • Product characteristics
  • Features and complexity
  • Risk-return profile
  • Fee structure
  • Investment horizon
  • Customer characteristics
  • Age
  • Income
  • Financial literacy
  • Risk tolerance

And accountability doesn’t stop at the point of sale. Banks will also be required to seek feedback from customers within 30 days of selling them any financial product or service to ensure they fully understand the features of the product and the risks accompanying it.

If a bank is found to be mis-selling a product, it must refund the entire amount paid by the customer and compensate the latter for any losses. Accountability is no longer optional.

What are the dark patterns identified by RBI, and are they prohibited?

India’s central bank has formally called out 11 dark patterns. It defines a dark pattern as follows:

“Any practice or deceptive design pattern using user interface or user experience interactions on any platform that is designed to mislead or trick users to do something they originally did not intend or want to do, by subverting or impairing the consumer autonomy, decision-making, or choice, amounting to misleading advertisement or unfair trade practice or violation of consumer rights.”

Banks and NBFCs are prohibited from deploying the following dark patterns in their digital interfaces, including apps and websites:

  • False urgency: Falsely stating or implying the sense of urgency or scarcity using countdown timers or phrases like “Offer Ends Soon” to trick users into making an immediate purchase.
  • Basket sneaking: Adding extra charges, such as payment to charity or donation at the time of checkout, without the consent of the user or pre-disclosing them.
  • Confirm shaming: Using text, video, audio or other means to induce a sense of fear or shame or guilt
  • Forced action: When users are required to sign up for an unrelated service or provide additional personal data to access a feature or complete a transaction
  • Subscription trap: When the option to cancel a subscription is hidden, or a user is forced to provide payment details or authorise auto debit to avail a free subscription, or cancelling a paid subscription requires the user to visit the branch physically or contact customer support.
  • Interface interference: Interface interference involves structuring visual elements to steer users toward a particular outcome. This includes highlighting preferred options in bold or bright colours while making alternatives less visible, or defaulting consent settings to “Yes.”
  • Bait and switch: Where the product or service served to the user at the end differs from what was initially presented.
  • Drip pricing: When prices are not revealed upfront. A loan may be advertised at an attractive rate, while processing fees or additional costs appear only after the user has progressed through multiple screens.
  • Disguised advertisement: A practice of posing or masking advertisements as other types of content, such as user-generated content, new articles, or false advertisements designed to blend in with the rest of an interface to trick customers into clicking on them.
  • Nagging: When online banking apps repeatedly send requests or notifications to users asking them to enable an additional service, despite the user previously declining them.
  • Trick wording: Deliberate use of vague or confusing language, including the use of double negatives in consent checkboxes.

What else has changed? Banks can no longer hide behind intermediaries. Whether a product is mis-sold by a relationship manager, a call-centre executive, or a third-party agent, the liability will be borne by the bank. 

Lenders will only be allowed to send promotional communications if the customer has explicitly consented to receive them. Banks and their partners will now be required to make sales calls and visits within a specific window, between 9 AM and 5 PM. Sales agents must be clearly identified, properly trained, and visibly separate from core bank staff.

Why this matters: The RBI’s directive is proof that dark patterns have emerged as a new form of mis-selling of financial products. Banks must now comply and stop engaging in deceptive marketing tactics. According to a recent Local Circle survey, 57% of the participants said they encountered basket sneaking on online banking platforms, and 51% were subjected to forced action, while 46% experienced nagging.

For customers, it means fewer surprise add-ons while buying a financial product, as well as fewer complaints about whether they understood what they actually bought. For banks, many of whom act as agents of insurance companies and earn a fee from that, the issue runs deeper. Over the last 10 years, for instance, SBI’s bancassurance revenue has jumped nearly 6x to Rs 2,766 crore. In comparison, its total interest income has only doubled to Rs 4.9 lakh crore over the same period. RBI’s directive may weigh on the sales of banks. But insurance companies will take an even bigger hit, as bancassurance contributes roughly half of the sector’s premiums on average and as much as 80% for some insurers. This could prompt insurtech companies to diversify revenue streams or even change their operating models.

Also read: