I. RBI FRAMEWORK

A. DBU Governance - 2022 Guidelines

Announced in Union Budget 2022-23 - 75 DBUs in 75 districts. RBI issued guidelines April 7, 2022.

What is DBU? "Specialised fixed point business unit / hub housing certain minimum digital infrastructure for delivering digital banking products & services." It is a Banking Outlet, needs separate entry/exit, distinct branding.

Who can open? All scheduled commercial banks (except RRBs, Payments Banks, LABs) with past digital banking experience, without prior RBI permission, in Tier 1 to Tier 6 centres.

Mandatory Minimum Products:

• Cash deposit/withdrawal via ATM + Cash Recycler
• Interactive Teller Machines (ITM)
• Video KYC, Video Conferencing, Call with bank officers
• Passbook printing, fund transfer via internet/mobile
• Digital onboarding for loans, account opening
• Grievance redressal digitally + in-person

Governance Structure:

• Aligned with Digital Banking Segment of bank, not traditional branch vertical.
• Headed by senior executive - Scale III or above in PSBs or equivalent - designated Chief Operating Officer of DBU.
• Must report to Digital Banking Head at Board level.
• Cyber Security, IT audit, and Customer Protection policies of bank apply mutatis mutandis.
• Must maintain audit trail, CCTV for cash area, and follow Branch Authorisation Policy + Business Continuity Plan.

B. Digital Channel Governance - 2025/2026 Overhaul - THE BIG CHANGE

RBI released Draft Master Directions on Digital Banking Channels Authorisation, 2025 on July 21, 2025 for comments, final instructions issued in early 2026.

This is the Digital Branch Governance Code:

1. Authorisation Regime:

• Classification: View-Only Facility (balance, statement) and Transactional Facility (fund transfer, loan disbursement). Transactional requires prior RBI approval + capital adequacy + net worth + IT compliance.
• Must have IPv6-enabled infrastructure, submit GAICA (Generic Architecture and IT Controls Assessment) report, SOC, CERT-IN empanelled audit.

2. Customer Consent Governance - Game Changer:

• Explicit consent mandatory for registration to any digital banking channel. Bank cannot make digital banking mandatory to get debit card, cheque book, or other service. Choice lies solely with customer.
• Consent must be separate, not bundled in account opening form.

3. Ring-Fencing & Third-Party Display Ban:

• Most important clause: "Third-party products and services, including those of promoter groups or bank group entities (subsidiaries/JVs/associates), shall not be displayed on banks' digital banking channels except as specifically permitted by RBI from time to time."
• This kills cross-selling of insurance, mutual funds, own NBFC loans on internet banking homepage. Purpose: to prevent digital branch being used as marketplace without governance.

4. Group Governance - Jan 2026 Overhaul:

• Banks and group entities enter stricter framework from Jan 2026 - fresh authorisation for digital channels, stricter rules on group entity businesses, ring-fencing of core banking, enhanced liquidity assumptions for digital deposits (LCR outflow factor increased from 10% to 20% for digital savings), upgraded authentication standards.

5. Operational Governance:

• Network independence: Digital channel must work even if third-party network fails.
• Explicit customer protection, risk mitigation, adherence to IT Act, Cyber Resilience directions 2024.
• Ban on pre-ticked consents, dark patterns.

II. PILLARS OF DIGITAL BRANCH GOVERNANCE

III. CASE LAWS - WHERE GOVERNANCE FAILED

1. Paytm Payments Bank Ltd. - RBI Action under Sec 35A BR Act, Jan 31, 2024

RBI found Paytm Payments Bank failed DBU / digital branch governance: No arm's length with parent One97, data sharing with Chinese entities, persistent KYC/AML failure, outsourcing of core decisions to group.

Action: Barred fresh deposits, UPI credits, PPI top-ups after Feb 29, 2024. This is the first case where RBI used digital branch governance failure as ground for 35A action.

Lesson: Digital branch cannot operate as shadow entity of tech parent. Governance must be at regulated bank level.

2. Jupiter / Amica Technologies v. Federal Bank - Consumer Forum / Outsourcing Liability 2023-24

Customer of Jupiter neobank (digital front-end, Federal Bank backend) faced failed refund. Jupiter said "bank issue", Federal Bank said "tech issue". Consumer Commission held: Under RBI Outsourcing Guidelines, regulated entity is liable for acts of its service provider. DBU/digital branch governance cannot be delegated.

Applied to DBUs: If video KYC vendor fails, bank liable.

3. Suresh Chandra Singh Negi v. Bank of Baroda, Allahabad HC July 17, 2025 - Burden of Proof in Digital Branch

Court held burden of proving customer's liability in unauthorised electronic banking lies upon bank under RBI Circular July 6, 2017. Bank must produce device binding logs, IP logs, consent logs.

If DBU / digital branch fails to maintain logs per GAICA, bank cannot discharge burden = zero liability for customer.

4. Jaiprakash Kulkarni v. Banking Ombudsman, Bombay HC 2024 - Beneficiary Addition without Alert

Court held customer has zero liability if bank's digital channel did not give alert for addition of new beneficiary. This is governance failure of digital branch notification system.

5. Kerala HC - Banks Liable Even If Customers Did Not Respond to SMS Alerts - 2023 LiveLaw

Kerala HC observed bank cannot exonerate from loss due to unauthorised withdrawals merely because customer did not respond promptly to SMS alerts. Bank must create safe electronic environment - includes DBU governance controls like cooling period.

6. Maharashtra IT Dept v. Axis Bank - Sec 43A IT Act Order Jan 21, 2024 - Rs.1.76 Crore + Rs.50 Lakh

Axis Bank's digital banking security lapses led to fraud on cooperative bank. Adjudicating Officer held failure to maintain reasonable security practices under Sec 43A IT Act = liable for compensation. Applied to digital branch: If DBU's video KYC, ITM not maintaining ISO 27001 controls, Sec 43A triggers.

7. Supreme Court - Canara Bank v. NCDRC Appeals 2026 - System Migration Defence Rejected

SC held delay in presenting cheques due to system migration / CBS upgrade can be deficiency if bank failed to have alternate clearing mechanism. Governance requires BCP for digital branches.

8. NCDRC - RBL Bank Noida Commission - Rs.25,000 for Harassment Due to System Flaw 2024

Where system flaw shows withdrawal customer never made, bank cannot harass. Digital branch must have reconciliation within 24 hrs per 2026 directions.

IV. COMPLIANCE CHECKLIST FOR BANK BOARD - DIGITAL BRANCH GOVERNANCE AUDIT

1. Authorisation: Do we have RBI approval for Transactional Facility? GAICA submitted?
2. Consent Logs: Separate e-consent with timestamp, IP, device ID for each digital channel? Can customer opt-out without losing debit card?
3. DBU Physical Governance: Separate entry/exit? Senior Scale III head appointed? CCTV + Audit trail retained 8 years?
4. Third-Party Display: Have we removed insurance/MF banners from internet banking homepage unless RBI permitted? Group entity ring-fenced?
5. Outsourcing Register: List of all LSPs / fintechs providing DBU tech - contract has right to audit, right to kill-switch, data localization clause?
6. Customer Protection: In-app fraud reporting button + beneficiary addition alert + cooling period 12 hrs + facility to disable device?
7. IT Governance: IPv6, CERT-IN audit, SOC 2, backup test every 6 months, RTO <2 hrs?

Failure of any = RBI penalty under Sec 46 BR Act + consumer case under deficiency + Sec 43A IT Act compensation.