RBI Grade B Current Affairs — 22 July 2026

In July 2026, the Reserve Bank of India proposed draft changes to Foreign Exchange Management Act rules, broadening the definition of foreign control over Indian firms. Under the proposal, an Indian entity would be deemed foreign-controlled if a foreign investor holds 10% or more voting rights, appoints a majority of directors, or influences management and policy. The RBI sought feedback by August 31, 2026. Legal experts warn the new 10% numerical threshold could expand compliance burdens for minority investors.

India's foreign investment architecture under FEMA distinguishes between foreign-controlled and domestically-controlled companies because the classification triggers different regulatory treatment — investment caps, sectoral restrictions, pricing guidelines, and reporting obligations differ significantly between the two. Currently, the determination of 'control' under FEMA is largely qualitative: whether an entity can direct management or policy decisions. The RBI's proposed 10% voting-rights threshold introduces a quantitative benchmark that doesn't exist today, creating a bright-line rule that lawyers fear will sweep in minority investors who hold merely protective rights — standard in private equity and joint venture deals — without actually controlling business decisions. This matters enormously for cross-border M&A and PE transactions structured around governance rights rather than outright ownership. India has been actively courting foreign capital through tax rationalisation and compliance simplification, so a rule that inadvertently treats passive minority shareholders as foreign controllers could produce the opposite effect — discouraging structured investment. The debate mirrors global regulatory tensions: clear bright-line rules reduce ambiguity but can over-capture. The RBI's intent appears to be closing loopholes where foreign entities wield effective control while staying just below definitional thresholds, but the calibration between a threshold alone versus threshold-plus-management-rights needs precise statutory drafting to avoid chilling legitimate minority investment.

The Reserve Bank of India imposed a total penalty of ₹17.30 lakh on three cooperative banks — two from Maharashtra and one from Odisha — for regulatory violations. Separately, RBI fined six NBFCs including Muthoot Finance ₹23.60 lakh for KYC and regulatory lapses. SEBI imposed ₹1 crore penalty on CDSL for cybersecurity failures linked to a 2022 malware attack. These actions reflect RBI's and SEBI's intensified enforcement against KYC non-compliance and cyber governance failures.

RBI's enforcement actions against cooperative banks and NBFCs are not routine housekeeping — they signal the regulator's zero-tolerance posture on KYC compliance and prudential norms. Cooperative banks occupy a unique regulatory space in India: they are licensed under the Banking Regulation Act, 1949, but administratively supervised by state governments and the Registrar of Cooperative Societies, creating a dual-control problem. This structural ambiguity historically allowed regulatory arbitrage. Post the PMC Bank crisis of 2019, RBI secured stronger supervisory powers over urban cooperative banks (UCBs) through the Banking Regulation (Amendment) Act, 2020, bringing them firmly under RBI's prudential oversight.

KYC violations are particularly serious because they enable money laundering, identity fraud, and terror financing. RBI's KYC Master Direction 2016 (updated periodically) mandates customer due diligence, periodic re-KYC, and risk-based profiling. NBFCs like Muthoot Finance, operating in gold lending where cash transactions dominate, are especially prone to KYC slippages.

The CDSL penalty by SEBI for a 2022 cyberattack highlights a different but equally critical dimension — market infrastructure institutions (MIIs) must meet SEBI's cybersecurity framework. Depositories holding demat accounts for crores of retail investors are systemically critical, and cybersecurity failures can undermine market integrity and investor confidence. These cases together demonstrate that regulatory enforcement is moving from entity-level warnings to financial penalties with named accountability.