RBI Credit Card Rules Every Indian Should Know in 2026
February 21, 2026 | by Amit Sharma

Over the last few years the Reserve Bank of India has quietly rewritten the rules of credit cards in the cardholder’s favour — from how often your credit score updates to how interest can be charged and how your card is secured. Here’s a plain-English guide to the RBI credit card rules that shape 2026, what each one actually means for you, and when it came into force.
Quick reference
| Rule | What it means for you | In effect since |
|---|---|---|
| Fortnightly credit reporting | Your credit score updates every 15 days, not monthly | 1 Jan 2025 |
| No “interest on interest” | Fairer interest and charge calculation on dues | RBI Master Direction (2022) |
| 30-day activation consent | Unactivated cards need your OTP consent or must be closed | 2022 |
| Credit-limit protection | Limit can’t be breached without your explicit consent | 2022 |
| Card-on-file tokenization | Merchants store a token, not your real card number | 1 Oct 2022 |
1. Fortnightly credit reporting (not weekly)
Since 1 January 2025, RBI requires lenders to report your credit information to bureaus every 15 days rather than once a month. (You may see this loosely called “weekly” — the mandate is fortnightly.) The upside: pay down a balance or clear a default and your score reflects it far sooner. The flip side: a missed payment also shows up faster. In practice it rewards people who manage dues promptly.
2. Fairer billing: the end of “interest on interest”
RBI’s Master Direction tightened how issuers calculate interest and charges, curbing the compounding of interest on unpaid interest and penal amounts. Combined with clearer Minimum Amount Due (MAD) disclosure, it’s harder for a small unpaid balance to quietly snowball. The lesson hasn’t changed though: paying only the MAD keeps you in expensive revolving debt — clear the full statement whenever you can.
3. Activation consent and credit-limit protection
Two strong consumer safeguards:
- 30-day activation rule: if you don’t activate a newly issued card within 30 days, the issuer must obtain your OTP consent to activate it — and if you decline, close the account at no cost. No more silently active cards you never asked to use.
- Credit-limit protection: issuers cannot let you breach the sanctioned credit limit without your explicit consent. Over-limit charges can’t be sprung on you by default.
4. Security: tokenization and dynamic 2FA
Since 1 October 2022, Card-on-File (CoF) tokenization means merchants and apps store a unique token instead of your actual 16-digit card number, sharply reducing the damage from a data breach. Alongside strong two-factor authentication on transactions, your card data is far better protected than a few years ago — though you should still guard OTPs and never share them.
What all this means for you
The direction of travel is clear: more transparency, faster score updates, fewer nasty surprises, and better security. To make the rules work for you — pay in full and on time (your score now reflects it within days), activate only cards you intend to use, and keep your spending inside your sanctioned limit.
Frequently asked questions
Is credit reporting now weekly or fortnightly?
It is fortnightly. Since 1 January 2025, RBI requires lenders to update your credit information with bureaus every 15 days, not monthly. It is sometimes loosely described as “weekly”, but the official mandate is once every 15 days.
Does faster credit reporting mean my score drops faster if I miss a payment?
Yes — a missed payment can reflect within about 15 days rather than up to a month. The same speed works in your favour: clearing a balance or default updates your score sooner too.
How does the 30-day activation rule protect me?
If you do not activate a newly issued card within 30 days, the issuer must get your OTP consent to activate it, and must close the account free of charge if you decline. It prevents unwanted cards from staying active.
What is card-on-file tokenization?
Since 1 October 2022, merchants store a unique token instead of your actual card number. If that merchant is breached, your real card details are not exposed — a major security upgrade.
Can my credit limit be exceeded without my consent?
No. RBI rules require your explicit consent before the sanctioned credit limit is breached, so over-limit usage and charges cannot be applied by default.
The bottom line
The RBI framework governing credit cards in 2026 has shifted real power back to the consumer — fortnightly credit updates, fairer interest, activation and limit consent, and token-based security. None of it replaces good habits, but it does mean disciplined cardholders are rewarded faster and protected better than ever.
Explore card-specific guides on Invest With Bull.
Regulations evolve — confirm the latest directions on the official RBI website. Sources: Business Standard, Reserve Bank of India.
RELATED POSTS
View all

