If a Credit Information Company rejects a complaint, say, a disputed entry on someone's credit report that the bureau declines to correct, that rejection must be reviewed by an independent Internal Ombudsman inside the CIC before the complainant is told to approach the RBI Ombudsman.
On 14 January 2026 the RBI replaced its single 2023 Internal Ombudsman Master Direction with six entity-class-specific Directions. This one applies to Credit Information Companies, and unlike the bank and NBFC directions, it carries no size threshold: every registered CIC is in scope.
Who it applies to
The simplest scope in the 2026 suite, all of them.
- Every Credit Information Company registered under the Credit Information Companies (Regulation) Act, 2005, with no size or volume threshold.
- The number of IOs and Deputy IOs is determined annually by the CIC's Consumer Protection Committee, based on complaint volume and complexity.
- Note the terminology trap: "CIC" here means Credit Information Company, not Core Investment Company (which is an NBFC category excluded from the NBFC IO Direction).
What it requires
Grouped by what each obligation is about. Described in plain terms; verify the exact clause text against the source before acting.
The office
An independent Internal Ombudsman
An IO appointed for a fixed contractual term, independent of the CIC, sitting at the apex of the grievance-redress mechanism and reporting functionally to the Board. IO/Deputy IO headcount is reviewed annually by the Consumer Protection Committee.
How complaints reach the IO
Board-approved SOP + automated escalation
A Board-approved Standard Operating Procedure and an automated complaints-management system that auto-escalates every partly or wholly rejected complaint to the IO within 20 days, or, where a prescribed timeline applies, sufficiently in advance that the IO gets at least 10 days to review.
30-day final decision
The final decision must reach the complainant within 30 days of the CIC first receiving the complaint.
Binding decisions & the complainant's next step
The IO's decision binds the CIC unless the competent authority formally disagrees through a narrow Board-level route. Where a complaint is still rejected after IO review, the CIC must inform the complainant of their right to approach the RBI Ombudsman. Statutory disputes under section 18 of CICRA 2005 follow that route, not the IO.
Governance, staff awareness & reporting
Disseminate across all offices & train
Widely disseminate the IO guidelines among staff across all offices when communicating the appointment, especially consumer-dispute and data-correction teams, and feed analysis of complaints handled by the IO into staff training.
Board oversight & supervisory review
Periodic reporting to the Board committee handling consumer protection; implementation forms part of RBI's supervisory review.
Reporting to RBI
Notify any IO/Deputy IO appointment to RBI's Consumer Education and Protection Department within 5 working days, and file the prescribed quarterly returns by the 15th of the month following the quarter.
What changed from the 2023 Direction
If your framework was built on the 2023 Master Direction (or the 2022 CIC Direction before it), these are the moves that matter:
- The single 2023 Master Direction was repealed and split into six entity-class Directions; CICs now have their own again, as they did in 2022. Existing IO appointments continue under it.
- Scope stays all CICs, no threshold was introduced, with IO headcount set annually by the Consumer Protection Committee.
- The quarterly return due date moved from the 10th to the 15th of the following month.
- Certain provisions are given a transition runway to 30 June 2026.
What RBI has penalised under the IO framework
No FY25-26 action in our tracker cites a Credit Information Company's Internal Ombudsman framework so far, the IO-related penalties this year landed on commercial banks and NBFCs. The obligation set is the same, which makes their cited failures the playbook of what supervisors check.
Background & lineage
CICs are the one class that already had a standalone IO Direction before the 2023 consolidation, so the 2026 split is, for them, a return to form.
- 3 Sep 2018Internal Ombudsman Scheme, for banks.
- 22 Oct 2019IO Scheme for Non-Bank System Participants.
- 15 Nov 2021Appointment of IO by NBFCs.
- 6 Oct 2022RBI (CIC - Internal Ombudsman) Direction, 2022, the first standalone CIC IO Direction.
- 29 Dec 2023RBI (Internal Ombudsman for Regulated Entities) Directions, 2023, consolidated all of the above; repealed 14 Jan 2026.
- 14 Jan 2026Six entity-class Directions, 2026, this CIC Direction is one of them.
Knowing the rule is step one
See how institutions distribute the IO SOP across every office and prove who acknowledged it.