What the RBI Internal Ombudsman Directions, 2026 require, who they apply to, and what RBI has actually penalised banks and NBFCs for under their internal grievance-redress mechanisms, in plain language, linked to the source.
An independent, apex-level authority inside a regulated entity that reviews customer complaints the entity has already rejected, before the customer escalates to the RBI Ombudsman.
The Internal Ombudsman (IO) does not take complaints directly from customers. Every complaint that an entity's internal grievance machinery partly or wholly rejects must be auto-escalated to the IO for an independent, reasoned decision, to catch service deficiencies in-house and reduce the volume reaching the RBI Ombudsman. The IO sits at the apex of the grievance-redress mechanism and reports functionally to the Board.
A Board-approved SOP and an automated complaints system that auto-escalates every partly/wholly rejected complaint to the IO within 20 days, or ≥10 days before any RBI/NPCI-prescribed deadline.
The final decision must reach the complainant within 30 days of the entity first receiving the complaint.
The entity must widely disseminate the IO guidelines among its staff across all branches and administrative offices when communicating the appointment.
Analysis of complaints handled by the IO, patterns, root causes, remedial measures, must feed into staff training and conferences.
The IO furnishes periodic reports to the Board committee handling customer service and supports its oversight of grievance redress.
Notify the IO/Dy-IO appointment to RBI's CEPD within 5 working days, and file the prescribed quarterly returns by the 15th of the month following the quarter.
Across both banks and NBFCs, a recurring FY25-26 theme was shortcomings in how internal grievance-redress mechanisms connected to the Internal Ombudsman, complaints not escalated in time, or no system in place to escalate them at all. The actions below are drawn from the FACE compilation of RBI press releases.
Each entry states only the reason cited in the RBI press release. Where a penalty covered more than one issue, the amount shown is the total and is not attributable to any single reason.
Most of these aren't comprehension gaps, the obligation was known. The breakdown is downstream: the procedure didn't reach every relevant person, wasn't acknowledged, or wasn't reviewed on cadence. Here's an honest split of what a policy distribution-and-attestation layer like PolicyCentral does and does not address.
The "did everyone get it, read it, and can you show an auditor" layer around the IO framework.
We're explicit about scope, these are jobs for grievance-workflow and case-management tooling, not a policy platform.
Being clear about this is the point, sophisticated compliance teams trust a vendor that names its boundaries.
A practical checklist covering what your Board-approved SOP should contain, who across your branch network needs to acknowledge it, and the audit-trail evidence to keep ready for a supervisory review.
Request the checklistPolicyCentral shows you, live and branch-by-branch, exactly who has read and acknowledged each policy and SOP, with a tamper-evident trail you can export for an RBI review. Walk through it on your own data.
Book a walkthrough