The single biggest change is one almost nobody has noticed: the Master Direction everyone still quotes — "Credit Card and Debit Card – Issuance and Conduct Directions, 2022" — was repealed on 28 November 2025 and replaced by the Reserve Bank of India (Commercial Banks – Credit Cards and Debit Cards: Issuance and Conduct) Directions, 2025. The protections survived the rewrite. Their paragraph numbers did not.
That matters because paragraph numbers are how you cite a rule to a bank's grievance desk, and every article, forum post and template complaint letter written before December 2025 now points at a paragraph that no longer exists.
| Rule | What it gives you | Instrument | In force from |
|---|---|---|---|
| Closure in 7 working days, ₹500/day penalty after | Compensation for a card the bank will not close | 2025 Directions, para 19 | 28 November 2025 |
| Unactivated card: OTP consent after 30 days, then closure | An unwanted card cannot sit on your file | 2025 Directions, para 11(6) | 28 November 2025 |
| No credit-bureau reporting before activation | An unactivated card cannot hurt your score | 2025 Directions, para 11(7) | 28 November 2025 |
| Unsolicited card: charges reversed plus a penalty of twice the charges | A real, priced deterrent | 2025 Directions, para 11(4) | 28 November 2025 |
| No negative amortisation, no interest on unpaid taxes and charges | Your balance cannot grow while you pay the minimum | 2025 Directions, para 23(2) | 28 November 2025 |
| Billing dispute answered within 30 days | A deadline you can hold the issuer to | 2025 Directions, para 25 | 28 November 2025 |
| Two-factor authentication, one factor dynamic | Static card details alone cannot authorise a payment | Authentication Directions, 2025 | 1 April 2026 |
| Cross-border card-not-present validation | Foreign online misuse gets a validation layer | Authentication Directions, 2025 | 1 October 2026 |
| Compulsory bundling and dark patterns banned | No insurance forced onto a card sale | Responsible Business Conduct 2nd Amendment, 2026 | 1 January 2027 |
| 3-day grace before "past due"; late fee on the overdue amount only | Fewer late fees, smaller late fees | Amendment Directions, 2026 | 1 April 2027 |
The rest of this guide takes the dated changes one at a time, because those are the ones that alter what you pay, and then the standing rules you will actually use.
The rule that already changed how you pay: two-factor authentication, from 1 April 2026
The Reserve Bank of India (Authentication mechanisms for digital payment transactions) Directions, 2025 (RBI/2025-26/79, issued 25 September 2025) came into force on 1 April 2026. The requirement is short: "All digital payment transactions shall be authenticated by at least two distinct factors of authentication … unless exempted", and "at least one of the factors of authentication is dynamically created or proven … unique to that transaction".
Read that second clause carefully, because it is the substance. A card number, expiry date and CVV are three pieces of information, but none of them is dynamic — they are the same on Monday as on Friday, which is exactly why a leaked card file is worth money. The direction does not mandate OTP; it mandates that one factor must be generated fresh for each transaction. OTP satisfies it. So does a passkey, an in-app approval or a device-bound token, and RBI framed it that way deliberately so that the ecosystem is not permanently welded to SMS.
Six categories are exempted, among them small-value contactless payments, e-mandate recurring debits after the first one, and small-value offline digital payments. If you have wondered why a ₹4,000 tap-to-pay goes through without a PIN while a ₹6,000 one does not, that is the exemption, not a fault in the terminal.
From 1 October 2026 the same directions require card issuers to have a validation mechanism for non-recurring cross-border card-not-present transactions, and risk-based handling procedures. That is the deadline aimed squarely at the fraud pattern where an Indian card is charged by an overseas merchant with no OTP step, because the merchant sits outside the Indian AFA perimeter.
The rule that will cut your late fee: three days, and only on what is overdue
This is the change worth planning around, and it does not land yet.
The Reserve Bank of India (Commercial Banks – Credit Cards and Debit Cards: Issuance and Conduct) – Amendment Directions, 2026 (RBI/2026-27/29) were issued on 27 April 2026 and commence on 1 April 2027. They replace paragraph 23(5) with this:
"Card-issuers shall report a credit card account as 'past due' to credit information companies (CICs) or levy penal charges, viz. late payment charges and other related charges, if any, only when a credit card account remains 'past due' for more than three days. The number of 'days past due' and late payment charges shall, however, be computed from the payment due date mentioned in the credit card statement … Late payment charges and other related charges shall be levied, only on the outstanding amount after the due date, and not on the total amount due."
Three separate things happen in that paragraph.
One: a three-day buffer. Miss the due date by a day or two and there is no late fee and no "past due" flag at the bureau.
Two: the clock still starts at the due date. This is the part people will get wrong. The buffer is not four free days added to your due date. Cross day three and your days-past-due are counted from the payment due date, not from day four. The grace is all-or-nothing.
Three — and this is the money — the charge attaches to what is still owed, not to the size of the bill. Late-payment fees in India are slab-based on the total payment due. On RBI's wording, from 1 April 2027 the slab has to be struck on the residue instead.
What that is worth, on a real fee table
Take a published slab table. Axis Bank's revision notice for the Axis Bank MY ZONE, effective 28 August 2026, sets late-payment fees at nil below ₹500; ₹500 from ₹501 to ₹5,000; ₹750 from ₹5,001 to ₹10,000; ₹1,200 from ₹10,001 to ₹50,000; and ₹1,300 above ₹50,000 — struck, like every Indian slab table, on the total payment due. Now take a ₹60,000 statement and pay all but a stub of it on time:
| You paid by the due date | Still outstanding | Fee on ₹60,000 total due | Fee from 1 Apr 2027, on the residue | Difference |
|---|---|---|---|---|
| ₹59,700 | ₹300 | ₹1,300 | Nil | ₹1,300 |
| ₹58,000 | ₹2,000 | ₹1,300 | ₹500 | ₹800 |
| ₹52,000 | ₹8,000 | ₹1,300 | ₹750 | ₹550 |
| ₹15,000 | ₹45,000 | ₹1,300 | ₹1,200 | ₹100 |
| Nothing | ₹60,000 | ₹1,300 | ₹1,300 | Nil |
The pattern is the point. The reform is worth almost nothing to somebody who missed the payment entirely, and worth the whole fee to somebody who paid 99.5% of the bill and was charged as though they had paid none of it. Add 18% GST to each figure in the last column for the actual cash difference.
Two honest caveats. Issuers have until 1 April 2027 and none has published a restated slab table yet, so the fourth column above is RBI's wording applied to a table that exists today, not a schedule any bank has announced. And the amendment governs late-payment charges; interest on the revolving balance is a separate mechanism and is untouched — that is the minimum amount due trap, and it is where the real cost of paying late lives.
The rule that stops the insurance being attached to your card: 1 January 2027
The Reserve Bank of India (Commercial Banks – Responsible Business Conduct) Second Amendment Directions, 2026 (RBI/2026-27/115), issued 15 June 2026 and effective 1 January 2027, state that "a bank shall not resort to compulsory bundling of any TPPS with any of its own product / service", and where a third-party product is genuinely needed as a risk mitigant, "the customer shall be provided the option to purchase the same from any TPPS Provider".
Alongside it: user interfaces "shall not deploy any dark pattern", the pre-ticked box is gone because "the default choice for the customer to give consent shall be 'No' / 'I do not agree'", and where mis-selling is established the bank "shall refund the entire amount paid by the customer" and compensate any loss under its approved policy. We covered the direction when it was issued, in RBI bans compulsory bundling and dark patterns.
The rules that did not change, and are the ones you will actually use
These carried over from 2022 into the 2025 Directions untouched in substance. The paragraph numbers below are the current ones — use these when you complain.
Closure in seven working days (para 19). "Any request for closure of a credit card shall be honoured within seven working days", and failure "shall result in a penalty of ₹500 per calendar day of delay payable to the cardholder", provided there are no outstanding dues. This is the single most useful sentence in the entire instrument, because it is self-executing: you do not argue about fairness, you count days and quote the number.
The unactivated card (paras 11(6) and 11(7)). If a card is not activated for more than 30 days from issuance, the issuer must seek OTP-based consent; without consent it "shall close the credit card account without any cost to the customer within seven working days". And no credit information on a new card account goes to the bureaus before activation — so a card you never switched on cannot quietly sit in your report.
The unsolicited card (para 11(4)). If a card you did not ask for gets issued, activated and billed, the issuer must reverse the charges and "pay a penalty without demur to the recipient amounting to twice the value of the charges reversed".
No negative amortisation (para 23(2)). The minimum amount due must be set "so as to ensure there is no negative amortization", and issuers "shall not capitalize i.e., levy interest or any other charges, on the unpaid taxes/levies/charges" — no interest on your GST, no interest on your late fee.
The interest-free period is conditional (para 23(3)). The MITC must explain that the interest-free credit period "is suspended if any balance of the previous month's bill is outstanding". Carry ₹1 and today's grocery bill starts accruing interest from the transaction date.
Billing disputes in 30 days (para 25). Protest a charge and the issuer must provide an explanation and, where applicable, documentary evidence "within a maximum period of 30 days from the date of complaint".
What the interest rate you carry does to all of this
Nothing in the directions caps the finance charge, which is why the rate on your specific card matters more than any of the rules above. The spread is enormous. The HDFC Infinia charges 1.99% a month — 23.88% a year. The Axis Atlas charges 3.75% a month — 55.55% a year. On a ₹1,00,000 balance carried for a full year that is roughly ₹23,880 against ₹55,550, before GST, for the identical borrowing. RBI requires the number to be disclosed; it does not require it to be reasonable. How we source and compare these figures is set out in our methodology.
What these rules do not do
Being precise about the limits matters more than listing the wins.
- They do not cap fees or interest. No ceiling on joining fees, annual fees, forex markup or finance charges. Every one of those is priced by the issuer. Our guide to credit card fees in India covers what each of them actually is.
- They do not stop devaluations. An issuer may cut a lounge allowance, gate a benefit behind a spend threshold or raise a markup, with notice. Most of what changes on an Indian credit card in a given year is contractual, not regulatory.
- They do not entitle you to a card. Approval remains at the issuer's discretion against its own criteria, and no rule here changes that.
- The 3-day rule is not live. It commences 1 April 2027. Until then, one day late is a full late fee, struck on your total bill.
- They do not reach every issuer identically. The 2025 Directions are the commercial-bank instrument; the corresponding rules for other regulated entities sit in their own directions.
Frequently asked questions
Which RBI direction governs credit cards in 2026?
The Reserve Bank of India (Commercial Banks – Credit Cards and Debit Cards: Issuance and Conduct) Directions, 2025, reference RBI/DOR/2025-26/155, issued 28 November 2025 with immediate effect. They repealed the 2022 Master Direction that most published articles still cite. One amendment has been made since, in April 2026, and it commences on 1 April 2027.
How many days does a bank have to close my credit card?
Seven working days from your request, provided there are no outstanding dues. Beyond that the issuer owes you ₹500 for every calendar day of delay, under paragraph 19 of the 2025 Directions. The penalty is automatic in the text — you do not have to prove loss, only that the request was made and the days elapsed.
From when can I be three days late without a late fee?
From 1 April 2027, not before. The Amendment Directions, 2026 were issued on 27 April 2026 but commence on that date. And the buffer is all-or-nothing: once you pass three days, both the late charge and your days-past-due count are computed back from the original payment due date, not from day four.
Will late payment fees get smaller under the new rule?
For most people, yes, and often dramatically. From 1 April 2027 the charge is levied only on the amount still outstanding after the due date, not on the total bill. Somebody who leaves ₹2,000 unpaid on a ₹60,000 statement drops from the top fee slab to a much lower one. Somebody who pays nothing at all sees no change.
Does an unactivated credit card affect my credit score?
No. A card-issuer may not report any credit information on a new credit card account to the credit information companies before the card is activated, under paragraph 11(7). If it was reported in error, the issuer must withdraw it. Separately, a card left unactivated for more than 30 days must be closed at no cost unless you give OTP consent.
Can a bank make me buy insurance with my credit card?
Not from 1 January 2027. The Responsible Business Conduct Second Amendment Directions, 2026 prohibit compulsory bundling of a third-party product with the bank's own product. Where a third-party product is genuinely required as a risk mitigant, you must be given the option to buy it from any provider, and consent screens must default to "No".