Digital Banking Regulatory Framework - The Complete Architecture

Digital Banking Regulatory Framework is not ONE law. It is a stack of 7 regulations that apply simultaneously. If you miss one layer, your digital bank licence can be cancelled even if other 6 are compliant.

This is the framework regulators worldwide - RBI, ECB, OCC, FCA, MAS - use in 2026.

I. THE 7-LAYER REGULATORY STACK

Think of Digital Banking Regulation as a building:

Layer 1: Licensing Layer - WHO can be a Digital Bank?
Layer 2: Prudential Layer - How much Capital & Liquidity?
Layer 3: Conduct Layer - How to treat Customer?
Layer 4: Technology & Cyber Layer - How secure is the App?
Layer 5: Data & Privacy Layer - Where is Data stored?
Layer 6: Financial Crime Layer - AML / KYC / Fraud
Layer 7: Market Infrastructure Layer - How payments settled?

Every case law failure comes from one of these layers.

LAYER 1: LICENSING FRAMEWORK

Already explained in last message - brief recap for completeness:

India - RBI:

• Universal Bank Licence on Tap 2016 - Rs 1000 Cr capital, full banking
• Small Finance Bank 2014 - Rs 500 Cr, inclusion focused
• Payments Bank 2014 - Rs 500 Cr, deposits up to Rs 2L, no lending
• Digital Banking Unit Circular 7 April 2022 - DBU is hub for digital services
• Co-operative Banks can also offer internet banking after RBI approval

No independent Digital-only Full Bank Licence in India yet. NITI Aayog proposed it in 2021 - RBI has not accepted. So you must use existing licences and make them digital.

Global:

• EU: Full Banking Licence under ECB SSM - €5M minimum - N26, Revolut Bank UAB
• UK: PRA New Bank Start-up Unit - Mobilisation Licence - Monzo, Starling
• Singapore: MAS Digital Full Bank - GXS, SeaBank
• US: OCC National Bank Charter - Varo first fintech - 2020

Case Law - Licensing:

Paytm Payments Bank Ltd. - RBI Action Jan-Mar 2024 - Most Important Indian Case
RBI under Section 35A BR Act imposed business restrictions - No fresh deposits, no top-ups, no credit transactions after 15 March 2024.
Grounds: Persistent non-compliance, material supervisory concerns in KYC/AML, IT outsourcing, non-arm's length transactions between Paytm Payments Bank and parent One97 Communications, breach of licensing conditions.
Ratio: Digital banking licence is conditional licence. RBI can kill business without cancelling licence if IT and data governance fails. First time Section 35A used so aggressively for digital bank.

Varo Bank N.A. v. OCC - US 2020 - First Fintech National Bank
Varo got full national bank charter after 3 years. Showed fintech can meet same capital, governance as JPMorgan. Set precedent.

LAYER 2: PRUDENTIAL REGULATION - CAPITAL, LIQUIDITY, EXPOSURE

Digital bank has same prudential rules as traditional bank - RBI does not relax because you are digital.

Law:

• Basel III - Capital Adequacy 11.5% (9% + buffers) in India
• Liquidity Coverage Ratio (LCR) - 100% - Digital banks more risky due to instant withdrawal via app - called Digital Bank Run risk
• Large Exposure Framework - No more than 25% of capital to one group
• CRR, SLR applicable

Unique Digital Risk - RBI Financial Stability Report 2023:
RBI noted digital banks face higher LCR outflow factor - 40% run-off for digital deposits vs 10% for sticky branch deposits. So digital bank needs more liquid assets.

Case Law:

Silicon Valley Bank (SVB) Collapse - US 2023 - Digital Bank Run Case
SVB had $209B assets, but $175B deposits were uninsured and mobile. In 48 hours, $42B withdrawn via app/online - fastest bank run in history. No prudential breach on paper, but interest rate risk on HTM portfolio not managed.
Regulatory Change After: Fed, ECB, RBI increased LCR outflow assumptions for digital channels. RBI Circular April 2024 - Digital deposits to be treated as less stable.

RBI v. Yes Bank Reconstruction 2020
Yes Bank collapsed due to NPAs and governance. RBI superseded board under Sec 36ACA BR Act, reconstructed via SBI.
Ratio for Digital Banks: Even if you are digital, exposure norms apply - Yes Bank had huge exposure to single groups. Digital lending via algorithms does not exempt from exposure limits.

LAYER 3: CONDUCT REGULATION - CUSTOMER PROTECTION

Most litigation in digital banking is here.

Indian Laws:

1. RBI Master Direction on Customer Service 2022
2. RBI Integrated Ombudsman Scheme 2021 - One Ombudsman for all - Banking, NBFC, Digital Lending
3. RBI Digital Lending Guidelines 2 Sep 2022 + 2023 FLDG Circular
4. Consumer Protection Act 2019 + E-Commerce Rules 2020

Key Rules:

Digital Lending - The Most Detailed:

• Loan must be disbursed directly from Bank/NBFC account to borrower account - No pass-through via fintech pool account
• Loan must be repaid directly to Bank/NBFC - Fintech cannot touch money
• All fees, APR, KFS - Key Fact Statement mandatory before consent
• First Loss Default Guarantee (FLDG) capped at 5% of portfolio
• Cooling off period - Borrower can exit within 3 days for loans >7 days, 1 day for <7 days
• No auto-increase of credit limit without consent

Case Laws - Conduct:

Google Pay, PhonePe, Paytm - PPI Mis-selling - RBI 2020-21
RBI found wallets were charging customers without clear disclosure. Mandated KFS.

RBI Digital Lending Enforcement - 2023 - LendingKart, LazyPay, Kissht, etc.
RBI penalized 4 NBFCs and 1 Bank for violating digital lending norms - Disbursing via fintech's account, not direct; not providing KFS; charging exorbitant penal interest via auto-debit.
Penalty: Rs 1 Cr to Rs 5 Cr + Direction to stop new digital loans via that LSP.

UK: FCA v. Starling Bank - £29M Fine 2024 - Conduct + AML
FCA fined Starling for failing to have adequate financial sanctions screening - Automated system failed. Also for opening accounts for high-risk customers via digital onboarding without enhanced due diligence.
This is direct precedent for Indian neo-banks - Automated KYC must be tested.

EU: BaFin v. N26 - €9.2M cumulative 2021-2022
N26 ordered to limit new customers to 50,000 per month due to weak AML and customer service - Could not handle complaints digitally. EBA Guideline says digital bank must have human complaint handling, not only chatbot.

Indian Consumer Court - SBI】 v. P. Rajesh - App Fraud Case (NCDRC 2022)
Customer lost Rs 1.5L via phishing on SBI YONO app. SBI argued customer shared OTP. NCDRC held bank liable because app did not have additional authentication for adding new beneficiary + amount > Rs 50k. Applied RBI Circular on Limiting Liability of Customers in Unauthorised Transactions 2017 - Zero liability if reported within 3 days and bank's system at fault.

LAYER 4: TECHNOLOGY & CYBER SECURITY REGULATION

This is where digital bank differs from traditional bank - Most important layer for licence.

India - RBI:

Master Direction on IT Governance, Risk, Controls and Business Continuity 2023 (Effective 1 April 2024) - Replaces old IT outsourcing circular. Most stringent IT law for banks globally.

• Banks must have IT Strategy Committee of Board
• Cannot outsource core IT - CBS, Risk Management, KYC to fintech
• Cloud outsourcing only after risk assessment + audit right + data in India
• Vulnerability Assessment every 6 months

Cyber Security Framework for Banks 2016 + Digital Payment Security Controls 2020

• Mandatory 2FA, PCI-DSS, Cyber Incident reporting to RBI CSITE within 6 hours
• App must have device binding, app hardening

Business Continuity - DR must be tested

Global:

• EU: DORA - Digital Operational Resilience Act - Effective 17 Jan 2025 - ICT risk management, incident reporting within 24 hours, third-party risk - Applies to all banks including N26, Revolut
• US: OCC Heightened Standards + Fed SR 11-7 Model Risk - Algorithmic lending models must be validated

Case Laws - Tech:

RBI Penalty on SBI】, ICICI, HDFC, Axis - 2022-24 - IT Governance
RBI imposed Rs 50 lakh to Rs 2 Cr penalties on major banks for:

• Non-compliance with cyber security framework - No log of privileged access
• Outsourcing IT without audit rights
• Downtime of internet banking > 2 hours without reporting to RBI

FCA v. TSB Bank - UK - £48.65M Fine 2022 - Biggest IT Failure Case
TSB migrated CBS to new platform - 1.9M customers locked out for weeks, data corrupted. FCA found failure in outsourcing oversight, inadequate testing.
Ratio: Board personally responsible for IT migration risk. Applies directly to digital banks - You cannot outsource responsibility to Infosys/TCS or cloud vendor.

RBI v. HDFC Bank - Internet Banking Outage 2020-21 - The Licence Restriction Case
HDFC Bank's internet banking, mobile banking, UPI down for 3 days Dec 2020 due to power failure in data centre. RBI under Sec 35A barred HDFC from launching new digital business activities and sourcing new credit card customers for 9 months.
This is India's TSB equivalent - Digital banking depends on IT resilience - RBI will stop business if IT fails.

LAYER 5: DATA PROTECTION & LOCALISATION

India:

RBI Data Localisation Circular 6 April 2018 - All payment data - full end-to-end transaction details, customer data - must be stored in India. Can copy outside for processing but must delete abroad within 24 hours and keep in India.
Applies to all digital banks, UPI apps, card networks.

Digital Personal Data Protection Act 2023 (DPDPA)

• Consent for data processing
• Data fiduciary obligations for banks - Purpose limitation, retention
• Data breach notification to Data Protection Board within 72 hours

Global:

• EU: GDPR - €20M or 4% turnover
• UK: UK GDPR
• US: No federal but state laws - CCPA

Case Laws:

RBI v. Mastercard, American Express, Diners - 2021 - Data Localisation Enforcement
RBI banned Mastercard, Amex, Diners from onboarding new domestic customers for 3-6 months for not complying with data localisation - Storing data outside India.
Ratio: Data localisation is licence condition - Non-compliance = business ban. Same applies to digital banks using AWS/ Google Cloud outside India.

AEPD Spain v. BBVA - €5M 2020 + 2022 - Data for Digital Banking
BBVA fined for using customer data for digital profiling without valid consent and for not allowing opt-out of algorithmic credit scoring.
Applied in India under DPDPA - Profiling for loan eligibility needs explicit consent.

WhatsApp Pay - NPCI / Supreme Court Data Localisation Case (2020)
Supreme Court directed WhatsApp to comply with RBI data localisation before UPI launch. WhatsApp had to create India data centre.

LAYER 6: AML / KYC / FRAUD - FINANCIAL CRIME

India:

• Master Direction - KYC 2016 amended 2023 - Video KYC permitted
• PMLA 2002 - Reporting Entity - Banks must file STR, CTR to FIU-IND
• RBI Master Direction on Fraud Risk Management 2024

Video KYC Requirements - Very specific:

• Live video, not recorded
• Geo-tagging, PAN verification via NSDL, Aadhaar OTP or Offline Verification
• Video to be kept for 5 years
• Face match with 90% accuracy

Case Laws:

RBI Penalty on Paytm Payments Bank - KYC Failure (2024)
Found thousands of accounts opened with same PAN, no Video KYC, no CDD.

US: OCC v. Blue Ridge Bank - Fintech Partnership AML Failure 2024
Blue Ridge Bank partnered with 15 fintechs - Chose, etc. - Outsourced KYC to fintechs. OCC found 350k accounts opened without proper CIP, BSA violations. Consent Order - Must get OCC non-objection before new fintech partner.

UK: FCA v. Monzo - 2022 - Digital KYC Weakness
Monzo allowed customers to open account by entering postcode without verification - Postcode inconsistent. Shows digital KYC must have address verification.

LAYER 7: PAYMENT SYSTEMS REGULATION

Digital Banking cannot work without payment systems.

India:

• Payment and Settlement Systems Act 2007
• UPI Procedural Guidelines - NPCI - Third Party App Provider (TPAP) licence
• PPI Master Direction 2021 - Wallets
• Regulation of Payment Aggregators / Gateways 2020, 2021 - PA licence mandatory - Razorpay, Cashfree must have PA licence

Case Law:

RBI v. Razorpay, Cashfree, PayU - PA Licence 2022-23
RBI returned applications of 40+ payment aggregators for not meeting net worth Rs 25 Cr and escrow requirements. Ordered to stop onboarding new merchants until licence. Shows payment leg of digital banking needs separate licence.

NPCI v. WhatsApp Pay - 30% Volume Cap Case
NPCI imposed 30% cap on UPI market share for TPAPs to avoid monopoly - Google Pay and PhonePe had 80% market. Litigation pending.

VIII. SUMMARY - WHAT WILL GET YOUR DIGITAL BANKING LICENCE CANCELLED - TOP 5 REASONS FROM CASE LAWS

Based on Paytm, SVB, TSB, N26, Starling:

1. IT Outsourcing without Control - Paytm + TSB + HDFC - Board must have IT governance
2. KYC/AML via Fintech without Oversight - Blue Ridge + Paytm + Monzo
3. Data Localisation Breach - Mastercard + WhatsApp
4. Digital Lending via Pool Account - LazyPay, Kissht - Direct disbursal mandatory
5. Misrepresenting as Bank - Section 7 BR Act - Neo-banks cannot call themselves Bank