RBI Framework on Customer Liability

RBI's framework determines who bears the financial loss when an unauthorised electronic banking transaction occurs in a customer's account. Liability depends principally on whose fault caused the transaction and how quickly the customer reports it after receiving the bank's communication, rather than merely on the amount stolen.

Allocation of liability according to fault

The Reserve Bank of India (RBI) distinguishes between failures attributable to the bank, negligence by the customer, and breaches attributable to neither.

• The customer has zero liability where the transaction results from contributory fraud, negligence or deficiency on the bank's part, irrespective of whether the customer reports it.
• Where the loss results from customer negligence, such as sharing payment credentials, the customer bears the loss occurring before reporting the transaction; losses occurring after reporting are borne by the bank.
• For a third-party breach, where the deficiency lies neither with the bank nor with the customer, liability depends on the reporting period.

Reporting deadlines and liability limits

For third-party breaches, the reporting period runs from receipt of the bank's communication about the transaction. Working days are counted according to the customer's home branch schedule, excluding the date of receipt.

• Reporting within three working days gives the customer zero liability.
• Reporting within four to seven working days limits liability to the transaction value or the applicable monetary ceiling, whichever is lower.
• The ceiling is ₹5,000 for Basic Savings Bank Deposit accounts and ₹10,000 for other savings bank accounts; specified other account categories also fall within the ₹10,000 ceiling, while the remaining categories have a ₹25,000 ceiling.
• For reporting beyond seven working days, liability is determined under the bank's Board-approved policy, which must be communicated to customers.

Bank responsibilities and customer protection

Banks must provide accessible reporting channels and acknowledge complaints. The burden of proving customer liability rests with the bank.

• After notification, the bank must credit the disputed amount through a shadow reversal within 10 working days, without waiting for an insurance settlement.
• The credit must be value-dated to the date of the unauthorised transaction, so the customer does not lose interest because of the reversal date.
• The complaint must be resolved and liability established within the bank's prescribed period, which cannot exceed 90 days; if this cannot be done, compensation prescribed by the framework must be paid.
• Customers must promptly report unauthorised transactions, while banks must prevent further unauthorised transactions after receiving the report.