Fintech Deep Dive — Saturday | October 10, 2026

Coverage window: October 3–10, 2026 (IST). Saturday’s consumer-rights lens asks a practical question: when a payment fee, bank restriction, investment risk or data-sharing tool changes, can people understand the change before it costs them money or control?

This week’s developments were not one new consumer-protection law. They were five tests of whether existing financial systems make rights usable: UPI’s proposed merchant fee remained in limbo; the RBI restricted withdrawals at two urban co-operative banks; SEBI ordered a colour-coded debt-risk disclosure; the RBI announced account-aggregator interoperability; and stockbrokers began a new investor-awareness display phase.

1. UPI MDR: the date is a consumer issue, even if the bill is addressed to merchants

An announced fee is scheduled to take effect on October 15 for specified UPI person-to-merchant transactions above ₹2,000. The reported framework uses a 0.4% MDR for eligible transactions, with category-specific treatment and exclusions; it is not a fee on person-to-person transfers. During October 8–9, merchant bodies and payment firms sought more time, with January 2027 reported as a possible revised start. On October 9, Moneycontrol reported that the NPCI UPI Steering Committee meeting expected to consider postponement was called off. As of the end of this coverage window, there was no confirmed change to the announced date. NPCI’s FAQ and the latest reporting on the stalled decision should be read together: a possible postponement is not a postponement until NPCI confirms it.

MDR is charged on the merchant side, but merchants may respond through prices, acceptance choices or add-on charges. The first two effects are hard to separate from ordinary pricing; any explicit fee should be itemised, not presented as a universal UPI rule. Scope matters: an eligible high-value merchant payment is not a small QR payment, a transfer to a friend or a recurring UPI AutoPay mandate, which Zee Business reports is exempt.

The problem is timing and legibility: businesses face a scheduled launch days away, while a committee expected to consider delay did not meet. That uncertainty reaches shop staff and customers. Any notice should identify the transaction category, threshold, amount, recurring-payment status and whether the buyer is charged. Keep the itemised bill and payment record if a separate fee appears. Never approve a “refund” that asks for a UPI PIN; query the merchant and use official bank or app dispute channels.

2. Two co-operative banks: “insured” is not the same as “available today”

On October 8, the RBI imposed directions on Tiruvalla Urban Co-operative Bank in Kerala and Sri Mahatma Basaveshwar Co-operative Bank in Afzalpur, Karnataka. Effective from the close of business that day, both were barred from accepting fresh deposits and from allowing withdrawals from savings, current or other depositor accounts without RBI’s written approval. The restrictions are for six months, subject to review. The RBI said the directions do not, by themselves, cancel either bank’s licence; the banks continue operating within the restrictions. (Tiruvalla order; Afzalpur order.)

The RBI notice says eligible depositors may claim up to ₹5 lakh from DICGC in the same capacity and same right, after submitting willingness and undergoing verification. This is a safety net, not a promise that every account balance can be withdrawn immediately. DICGC aggregates a person’s savings, current, recurring and fixed deposits across branches of the same bank when held in the same capacity and right; principal and interest together count towards the ₹5 lakh ceiling. Splitting money among multiple accounts at that one bank does not multiply the cover. DICGC’s FAQ on deposit insurance and claims explains the aggregation rule and, for banks under All-Inclusive Directions, the claim-list and verification process.

Insurance is not liquidity: a depositor within the ceiling may still lack access while claims are prepared and verified; amounts above it remain exposed. Check that accounts are with the same legal bank, preserve statements and passbooks, and use the bank’s official willingness process. The RBI also permits loan set-off against deposits under stated conditions, so borrowers should not assume those balances remain separate.

Deposit insurance limits harm; it does not prevent a liquidity crisis or ensure immediate access. Restricted-bank customers need clear instructions on blocked transactions, essential exceptions, claim submission and progress tracking. The RBI sets the restriction and ceiling; DICGC’s verification process determines payment.

3. SEBI’s Credit Risk-o-Meter: useful warning label, not a safety certificate

SEBI’s October 7 circular introduced a mandatory, colour-coded Credit Risk-o-Meter for debt securities. The six levels map the existing standardized rating symbols from AAA to D and must appear in offer documents and specified advertising and online bond-platform materials. Exchanges and depositories have 45 days to put the systems in place. The rule covers listed and proposed-to-be-listed non-convertible securities, commercial paper, securitised debt instruments, security receipts, and structured or market-linked debentures. (SEBI circular; see also the Financial Express report.)

A colour scale may help first-time investors compare bonds, especially on online platforms where retail users encounter them. Its concrete benefit is moving a standardized risk cue closer to the purchase decision, rather than leaving it only in a long offer document.

The label still answers only one question: how the instrument’s credit rating maps to a level of credit risk. It does not promise repayment, insure the investment, or explain how quickly an investor can sell. It is not a measure of price volatility, market liquidity, concentration risk or whether a bond suits someone’s needs. The circular’s own framing—an additional disclosure mechanism—should be preserved. A red or high-risk label is not a forecast of default; a low-risk colour is not a government guarantee. Investors still need the rating rationale, issuer’s financials, maturity, security and redemption terms.

As platforms compress products into attractive cards, the meter could be mistaken for an overall safety score. It should sit beside yield and the purchase control, with plain-language limits. SEBI has standardized a signal, not a sales promise.

The RBI’s October 7 policy statement announced interoperability among NBFC-Account Aggregators. Customers are to be able to access and share financial information across different Financial Information Providers through any NBFC-AA of their choice. The RBI also said SEBI-regulated depositories would be enabled to include bank-deposit information in a Consolidated Account Statement through the AA framework, bringing demat holdings and bank deposits together in one view. The measures are targeted for implementation by December 31, 2026. (RBI policy statement; Financial Express explainer.)

Interoperability could end the “wrong app” problem: people need not select an aggregator only because a provider works with it. A consolidated view could help customers see fragmented deposits or share records, but convenience becomes a consumer right only when choice and consent work in practice.

The announcement is a policy direction, not a user-interface specification. At launch, customers need to see which institutions and accounts are included, the purpose and duration of each request, how to refuse or withdraw consent, and what was shared. More routes for data also make authentication, security and complaint handling more important. A consolidated statement must not become a pretext for continuous profiling or a condition for unrelated services.

For consumers, the sensible rule remains purpose-first sharing: read the consent screen, check the requesting entity and purpose, and do not treat a one-time request as permission for indefinite access. For the RBI and participating platforms, the task is to make those choices as visible as the convenience headline. The December deadline should be judged not only by whether systems connect, but by whether customers can understand and control the connection.

5. Project Jagrook moves from awareness campaign to app real estate

SEBI’s October 1 circular under Project Jagrook began its first display phase on October 5. Through October 31, brokers must display SEBI’s investor-awareness messages and risk disclosures on their websites; showing those messages in trading apps is voluntary during this initial period. From November 1, the specified messages and risk disclosures must appear on broker websites’ landing pages and, on alternate days, on trading-app landing pages. The circular is a small operational rule with a consumer-facing purpose: put warnings where people make investment decisions, not only in regulator campaigns.

Placement matters: a message hidden in menus or shown after order entry is formally present but practically weak. Landing pages can reach users before a trade, while rotation may reduce banner blindness. But awareness cannot replace clear design, suitability checks or platform accountability.

From November, investors should see the messages on landing pages without hunting. SEBI should make missing or unreadable disclosures easy to report and explain enforcement; brokers should keep messages legible across screens and visible beside promotions.

What consumers should watch next

Three tests remain: will NPCI settle the MDR date and explain buyer charges before implementation; will RBI and DICGC make deposit claims trackable; and will SEBI’s risk meter and Jagrook messages appear at the decision point without being sold as guarantees?

Keep the receipt, statement or consent record that shows what you were told and authorised. For an unexplained UPI fee, request an itemised bill and complain through official channels. For a restricted-bank deposit, follow the documented DICGC process; do not give account credentials to intermediaries. Treat a bond label or one-tap data consent as the start of a decision, not the whole decision.

Protection depends on price, access, risk and data use being understandable before consent. The test is whether an ordinary customer can see the rule, grasp its limits, challenge an error and obtain a remedy.

Sources