Introduction
At the Global Fintech Fest in Mumbai, Reserve Bank of India (“RBI”) Governor Sanjay Malhotra announced the recognition of the Unified Fintech Forum (‘UFF’) as the second self-regulatory organisation for the fintech sector (‘SRO-FT’). The step extends the RBI’s preference for industry-led standard-setting in a sector where many participants sit outside the formal regulatory perimeter, and it warrants attention from fintechs, their regulated partners and their counsel.
Overview of the Recognition
The RBI stated that it examined UFF’s application against the eligibility and other requirements prescribed under its framework before granting SRO-FT status. UFF is the rebranded Digital Lenders Association of India, and is reported to have a membership of over 200 fintech institutions, which it says extends across digital lenders, account aggregators, technology service providers, payment firms and other fintech segments. It follows the Fintech Association for Consumer Empowerment (‘FACE’), which the RBI recognised as the first SRO-FT in August 2024.
The Regulatory Framework for SRO-FTs
The recognition operates under the RBI’s Framework for Self-Regulatory Organisation(s) in the FinTech Sector, issued on 30 May 2024. The Framework describes an SRO-FT as an industry-led entity responsible for establishing and enforcing standards, promoting ethical conduct, ensuring market integrity, resolving disputes and fostering transparency and accountability among members.
An applicant must be a not-for-profit company and must have a minimum net worth of Rs. 2 crore, either within one year of recognition or before commencing operations, whichever is earlier. Membership is to be drawn primarily from Indian fintechs not regulated by any financial sector regulator, and the Framework contemplates that a fintech may belong to more than one SRO, and encourages participation in at least one.
The functions envisaged include a code of conduct, a dispute resolution and grievance framework for members, surveillance mechanisms to detect exceptions, and regular reporting to the RBI on sector developments, including notification of members’ violations of regulations and of systemic issues. The Framework also indicates that any consequences imposed on members, including monetary penalties, should be reasonable and not prohibitive.
Legal Character and Present Limits of the Recognition
An SRO-FT is not a statutory regulator. Its authority over members derives from voluntary membership and its own code and governance framework, and not from a statute or a power conferred by the RBI over fintechs generally. Public reporting indicates that UFF has not yet identified any enforcement power available to it, and that a new code of conduct, a strengthened membership framework and a formal grievance and dispute resolution mechanism are to be introduced over the coming months.
Two questions also remain open on the available reporting: how the RBI will demarcate oversight between the two recognised SROs, and whether UFF’s standards will operate only for its members or more widely.
Regulatory Context: The Governor’s Remarks on Regulatory Gaps and Data
The recognition should be read alongside the Governor’s address, in which he cautioned fintechs against structuring businesses around gaps between regulatory categories and scaling first while seeking clarity later, pointing instead to the RBI’s sandbox and pilot mechanisms. He acknowledged that many fintechs sit outside the prudential perimeter, appropriately so, but observed that a firm whose scale could affect the financial system carries responsibilities beyond its balance sheet. He also urged fintechs to treat customer data as a fiduciary responsibility and not as a business asset. An SRO-FT is one of the means by which such expectations can be translated into conduct standards for entities that the RBI does not license directly.
Data Protection Dimension
An SRO code is likely to address consent, data use, grievance handling and cybersecurity, particularly for digital lenders and account aggregators. Such a code would, however, operate alongside and not in place of binding law. The obligations of Data Fiduciaries under the Digital Personal Data Protection Act, 2023 apply from 13 May 2027, and RBI-regulated entities remain subject to instruments such as the RBI (Digital Lending) Directions, 2025, including as to fintech partners acting on their behalf. Membership of an SRO and adherence to its code would not displace these obligations, though it may usefully evidence a structured approach to compliance.
AMLEGALS Remarks
The recognition of a second SRO-FT indicates that the RBI is developing a calibrated model of co-regulation for fintechs: proportionate treatment for early-stage firms, with industry-led standards and supervisory expectations that tighten as scale grows. Its practical weight will depend on the content of UFF’s code, the enforcement mechanisms it adopts, and the allocation of roles between the two SROs.
Fintechs would be well advised to evaluate membership of a recognised SRO, to benchmark internal policies on consent, data use, grievance redressal and cybersecurity against emerging SRO standards, and to monitor the release of UFF’s code of conduct. Regulated entities engaging fintech partners may also expect SRO membership and code adherence to feature in due diligence and contractual undertakings, and should review vendor arrangements accordingly.
For any queries or feedback, feel free to connect with Hiteashi.desai@amlegals.com or Khilansha.mukhija@amlegals.com