IFSCA Prescribes Compliance Norms for Internet Banking by IBUs

Circular e.F.No. IFSCA-FMPP0BR/5/2024-Banking, Dated: 29.12.2025

Regulatory Background

The International Financial Services Centres Authority (IFSCA) has issued a circular laying down detailed compliance requirements for internet banking services offered by International Banking Units (IBUs) operating in IFSCs.

The framework aims to ensure secure, transparent, and customer-centric digital banking, while aligning internet banking operations with prudential and consumer protection standards.

Classification of Internet Banking Services

The circular categorises internet banking services into three distinct types, with differentiated compliance obligations:

1. Information Service

Provides static or general information to customers
Includes details such as:
- Product features
- Interest rates
- Charges and terms
No customer-specific interaction or transaction capability

2. Interactive Information Exchange Service

Enables two-way interaction between the IBU and customer
May include:
- Submission of requests
- Download of statements
- Queries or service requests
Does not permit execution of financial transactions

3. Transactional Service

Allows customers to initiate and execute financial transactions
Includes activities such as:
- Fund transfers
- Account operations
- Other liability-linked transactions

This category carries the highest compliance and risk management requirements.

Mandatory Customer Consent

IBUs offering internet banking services must:

Obtain explicit and informed consent from customers before providing such services
Ensure consent:
- Is clearly documented
- Covers the nature and scope of services offered
- Is auditable and verifiable

This requirement strengthens customer awareness and data protection.

Exemption for IBUs Not Offering Liability Products

The circular provides a specific exemption:

IBUs that do not offer liability products (such as deposits or other customer-funded instruments)
Are exempt from certain requirements applicable to internet banking services

This ensures proportional regulation based on the risk profile of the IBU’s business model.

Compliance Timelines for Existing IBUs

Existing IBUs are required to:
- Align their internet banking systems and processes with the prescribed framework
- Complete compliance within the timelines specified by IFSCA

The timelines provide a transition period to upgrade systems, controls, and governance structures.

Restrictions in Case of Non-Compliance

Where an existing IBU fails to comply within the prescribed timelines:

The IBU shall be restricted from onboarding new customers for:
- Liability products offered through internet banking
Existing customers may continue to be serviced, subject to IFSCA directions

This acts as a regulatory enforcement mechanism without immediate disruption to existing customers.

Regulatory Intent

The circular seeks to:

Ensure safe and reliable internet banking operations in IFSC
Protect customer interests in digital banking channels
Promote responsible adoption of technology
Maintain systemic stability while enabling innovation
Apply risk-based and proportionate regulation to IBUs

Implications for IBUs

IBUs should:

Review their internet banking offerings and categorise services correctly
Put in place:
- Robust consent mechanisms
- Information security and access controls
- Governance and audit trails
Assess applicability of exemptions based on liability products
Ensure timely compliance to avoid onboarding restrictions

Key Takeaway

IFSCA has introduced a structured compliance framework for internet banking services of IBUs, classifying services into information, interactive, and transactional categories, mandating explicit customer consent, providing exemptions for non-liability IBUs, and prescribing compliance timelines—non-compliance may result in restrictions on onboarding new liability-product customers.