Two regulators on opposite sides of the world sent the same message to lenders this spring: fintech partnerships do not transfer the compliance burden, they concentrate it. The Reserve Bank of India published draft rules on May 20 that would ban remote device locking as a debt collection tool. Weeks later, the US Office of the Comptroller of the Currency made public an April consent order against a one-branch bank that had let its fintech sponsorships outrun its anti-money-laundering controls. Neither story is really about a single lender. Both are about supervisors deciding that speed of partnership growth is no longer an excuse.
India draws a line around recovery tactics
The RBI's draft directions, open for comment through May 31, target how banks, NBFCs, housing finance companies and cooperative banks collect on loans once a borrower falls behind. The most consequential provision addresses device locking: some digital lenders have used software to disable a borrower's phone or tablet until a payment clears. Under the draft, that practice would be banned outright, with one narrow exception for a device purchased using a loan from that same lender. Even then, any restriction has to be graduated rather than immediate, essential functions like calls to emergency services have to stay open, and a full lockout is off the table.
The draft also puts hours around recovery contact: agents and staff can only call or visit a borrower between 8 a.m. and 7 p.m. unless the borrower has asked otherwise, and borrowers gain the right to request blackout windows. Recovery agents will need Indian Institute of Banking and Finance certification and are bound by new conduct norms. The rules are scheduled to take effect October 1, 2026, giving lenders roughly four months to rebuild collection workflows that, for some digital lenders, were built around exactly the tactics now being outlawed.
This follows, rather than starts, a tightening cycle. India's consolidated Digital Lending Directions became fully enforceable in April, covering registration of lending apps, standardized Key Fact Statements before a loan is sanctioned, and mandatory membership in a Reserve Bank-recognized self-regulatory organization. The Fintech Association for Consumer Empowerment, the RBI-recognized SRO for the sector, said its membership had grown roughly fourfold to 275 firms in the year since recognition. Read together, the sequence is: register the lender, standardize the disclosure, and now, regulate the collection. Each stage closes a different gap that digital lending opened.
A US sponsor bank pays for growth it could not monitor
The parallel American story involves Community Federal Savings Bank, a single-branch federal savings association in Woodhaven, New York. The OCC's consent order, dated April 2026 and made public May 21, found that CFSB had expanded its payment processing business well beyond what its size could support, driven by its role as a sponsor bank for a roster of well-known fintechs including Wise, Crypto.com, Airwallex, ChipperCash and LemFi. The bank's wire and ACH volume, including cross-border activity, grew substantially since 2020 without a matching build-out of its Bank Secrecy Act and anti-money-laundering program. The order requires the bank to fix those deficiencies.
The timing is notable because it sits next to open encouragement from the same regulator. Acting Comptroller Jonathan Hood has said publicly that bank-fintech partnerships are "critically important" for banks trying to keep serving customers, and has urged banks to bring their examiners into partnership discussions early rather than after the fact. The CFSB order shows what the OCC does when that advice goes unheeded: sponsor banks remain liable for AML controls at the volume their fintech partners generate, not the volume their own branch network would suggest.
This is not an isolated action. More than one in five OCC enforcement actions in 2024 targeted sponsor banks, and legal commentary since the CFSB order has flagged it as a template for how examiners will treat community banks that scaled a fintech book faster than their compliance headcount.
The open banking rule stays frozen
A third thread sits underneath both stories: in the US, the CFPB's Section 1033 open banking rule, which would have set consumer rights to move their own financial data between institutions, remains blocked. A federal judge in the Eastern District of Kentucky enjoined the rule in late 2025, and the CFPB's own April 2026 compliance deadline passed without becoming a binding trigger while the agency reconsiders the rule. Data-sharing rulemaking is stalled even as enforcement of existing partnership and lending obligations gets sharper, an asymmetry that leaves US fintechs with less regulatory clarity on the upside and more scrutiny on the downside.
What to watch next
India's comment period closed May 31, and the RBI is expected to finalize the recovery conduct directions before the October 1 effective date. Any changes between the draft and the final rule, particularly around the device-locking exception, will matter to NBFCs that built collections around device-based leverage. In the US, watch whether the CFSB order becomes a template applied to other small sponsor banks carrying outsized fintech books, and whether the CFPB's Section 1033 reconsideration produces a narrower rule or is abandoned. Neither regulator is signaling that fintech partnerships should stop. Both are signaling that the institution holding the license, not the fintech at the other end of the API, still owns the risk.
Sources: RBI's Digital Lending Guidelines and Device Locking — Tech Wonders · RBI May 2026 draft on loan recovery — Signzy · Critical Analysis Of RBI Draft Revised Loan Recovery Ethics — ABC Live · RBI Proposes Uniform Recovery Norms Across All Lenders — Vinod Kothari Consultants · Device Locking in Digital Lending — Cyril Amarchand Mangaldas · OCC issues consent order to Community Federal Savings Bank — FinTech Futures · Sponsor bank for Wise, Crypto.com told to fix AML program — American Banker · The OCC's Recent Consent Order Is a Warning for Community Banks — National Law Review · Community Bank Order Signals Fintech Partnership Scrutiny — Law360 · Court Halts CFPB's Open Banking Rule — PYMNTS · Section 1033 Compliance Date: Open Banking Rule Enjoined — Cozen O'Connor · Kentucky federal court enjoins CFPB — ABA Banking Journal