Regulators Are Cracking Down on BFSI — Is Your Contact Centre Ready?

Author

Reji Adithian

Sr. Marketing Manager

April 1, 2026

The Regulatory Storm: BFSI Is Under the Microscope

If you lead compliance, risk, or contact centre operations at a bank, NBFC, insurance company, or fintech in India, 2025-26 has been a wake-up call. The regulatory environment has shifted from periodic oversight to continuous, enforcement-heavy scrutiny across every major financial regulator.

This isn't speculation — the data is unambiguous. In FY 2024-25, the Reserve Bank of India imposed 353 penalties totalling ₹54.78 crore across banks, NBFCs, housing finance companies, and cooperative banks, according to data published by the Business Standard citing RBI's annual enforcement report. The violations spanned KYC/AML lapses, cybersecurity framework failures, fraud reporting delays, exposure norm breaches, and customer protection violations.

And the momentum hasn't slowed. As recently as March 27, 2026, the RBI imposed fresh penalties on Union Bank of India (₹95.40 lakh), Central Bank of India (₹63.60 lakh), Bank of India (₹58.50 lakh), and Pine Labs (₹3.10 lakh) for violations ranging from delayed customer refunds to issuing KYC-less prepaid payment instruments (Business Standard, March 2026).

A Regulatory Timeline: What's Changed in 2025-26

The pace of regulatory change in the last 18 months has been relentless. Here is a snapshot of what BFSI institutions are now expected to comply with.

Reserve Bank of India (RBI)

The RBI has been the most active enforcer. Beyond the 353 penalties in FY25, several structural regulatory changes demand attention:

Master Directions on Fraud Risk Management (July 2024): Banks must report fraud cases within 14 days of classification. For major frauds involving ₹50 million or more, a flash report must be submitted within one week of detection. The RBI backed these rules with financial penalties for compliance failures.
KYC Master Direction Amendment (August 2025): The most significant KYC update since 2016. Key changes include expanded digital identity documents, mandatory deepfake detection in Video KYC sessions, and stricter CKYC upload timelines — 3 working days, with penalties up to ₹1 lakh/day.
Group-Level Regulation (December 2025): New restrictions on bank group entities require board-level action plans by March 2026.
Penalty Scope Expansion: A Probe42 analysis notes that penalties now extend to regional and cooperative entities. ICICI Bank was fined ₹75 lakh in August 2025; Deutsche Bank was fined ₹50 lakh for CRILC reporting failures.

Securities and Exchange Board of India (SEBI)

SEBI approved the SEBI (Stock Brokers) Regulations, 2026, notified on January 7, 2026. Key changes include mandatory whistleblower policies, record retention extended to 8 years, internal surveillance systems, and domestic residency requirements for directors.

IRDAI and TRAI

IRDAI mandated DPDP Act compliance through its Information and Cyber Security Guidelines. TRAI issued a Direction mandating all BFSI entities adopt 1600-series numbers for service calls — with over 485 entities already onboarded.

DPDP Act: The Cross-Sector Multiplier

The DPDP Act introduces fines of up to ₹250 crore for non-compliance. As documented by Consent.in, all major financial regulators have issued directives folding DPDP into their frameworks.

The Real Compliance Battleground: Your Contact Centre

Most compliance conversations focus on back-office processes. But the bulk of your regulatory risk sits in customer-facing conversations — mandatory disclosures, KYC and consent management, mis-selling prevention, PII handling over voice calls, and collections practices governed by strict RBI guidelines.

Why Manual QA Is a Liability

A mid-sized BFSI contact centre handles 50,000+ calls per month. Manual QA covers 2-3% at best. The remaining 97% is a compliance blind spot — with scale, consistency, speed, language, and evidence gaps that traditional auditing simply cannot address.

How AI-Powered Conversation Intelligence Changes the Equation

Platforms like Mihup analyse 100% of customer interactions across every language and channel.

Automated Compliance Monitoring: Scans every interaction for mandatory disclosures, script adherence, and regulatory keywords in real time.

Multilingual Intelligence: 120+ languages and dialects, handling code-switching and regional accents accurately.

Real-Time Agent Assist: Live guidance prompting agents for mandatory disclaimers and compliance scripts.

PII Redaction: Automatic masking of Aadhaar, PAN, and account numbers in transcripts and recordings.

Audit-Ready Reporting: Timestamped compliance reports for every interaction.

The Cost of Inaction

₹54.78 crore in FY25 penalties represents direct financial cost. The DPDP Act's ₹250 crore ceiling raises the stakes further. And reputational damage from published penalty notices can erode years of brand-building overnight.