Financial regulators moved in opposite directions on the same problem this year: who bears the risk when a fintech app sits between a customer and their money. India's central bank spent 2026 tightening the rules around prepaid wallets while loosening them for digital lending. In the US, a rule meant to force banks to open up customer data has been stuck in court since before it ever took effect, leaving embedded finance firms guessing at what comes next.
RBI moves to lock down prepaid wallets
On April 22, 2026, the Reserve Bank of India released a draft Master Direction on Prepaid Payment Instruments, 2026, proposing to replace the master direction that has governed digital wallets since August 2021 (Business Standard, Medianama).
The draft caps outstanding balances on full-KYC PPIs at ₹2 lakh, with a matching monthly debit limit, and holds minimal-KYC "small PPIs" to a ₹10,000 balance with no fund transfer or cash withdrawal facility and a two-year validity window (Medianama, Business Today). Non-bank issuers would need a minimum net worth of ₹5 crore at authorization, rising to ₹15 crore within three years. They would also have to hold customer float in a separate escrow account at a scheduled commercial bank, certified by an auditor every quarter (Medianama).
The draft also mandates interoperability for all full-KYC PPIs with UPI and card networks, closing off the closed-loop wallet model that some issuers have relied on (Business Standard). Taken together, the draft treats non-bank wallet issuers closer to how RBI already treats banks: higher capital, segregated funds, and less room to operate as a closed system. The comment window closed May 22, 2026, and RBI has not yet published a final version.
RBI loosens the other side: lending guarantees
While tightening wallets, RBI moved to ease a rule that had constrained fintech-NBFC lending partnerships. The central bank's amended Non-Banking Financial Companies (Income Recognition, Asset Classification and Provisioning) Directions restore recognition of Default Loss Guarantee arrangements in expected credit loss provisioning for co-lending and digital lending books. That reverses restrictions that had been in place since March 2025 (Enterslice, Angel One).
A Default Loss Guarantee is typically capped at 5% of a loan pool and backed by a fixed deposit that a fintech lending partner places with the NBFC. Under the restored framework, an NBFC can only count that cover toward its provisioning if the guarantee is an integral, contractually embedded part of the loan arrangement, not a side agreement. It must also recompute its expected loss estimate every time the guarantee is invoked and the available cover shrinks (Enterslice, CAalley).
The two moves are not contradictory so much as targeted. RBI tightened the part of the market handling customer float directly, prepaid wallets, and loosened the part where a regulated NBFC still holds the loan and the credit risk. It is a bet that a fintech-NBFC lending partnership with a guarantee written into the contract is a manageable risk, while an under-capitalized wallet holding customer money in a co-mingled account is not.
US embedded finance still waiting on open banking
In the US, the Consumer Financial Protection Bureau's Personal Financial Data Rights rule, known as Section 1033, targets the largest depository institutions and non-bank data holders. It was set to require them to give customers free access to their own financial data for use with third-party apps. The first compliance deadline, April 1, 2026, applied to institutions holding at least $250 billion in assets and non-depository firms with at least $10 billion in revenue (Moody's).
That deadline never took effect. A federal court in the Eastern District of Kentucky enjoined enforcement of the rule after the CFPB itself asked the court to reconsider it. The agency opened a new rulemaking process in August 2025 that, as of this writing, has not produced a replacement (Cozen O'Connor, American Banker).
That leaves embedded finance firms, the companies that plug banking, lending or payments features into non-financial apps, without the data-portability rule they had been building toward. At the same time, bank regulators are sharpening their focus elsewhere in the embedded finance stack. Sponsor banks, the licensed institutions that stand behind these partnerships and hold the regulatory obligation for consumer funds, are drawing more FDIC enforcement attention as scrutiny of fintech oversight increases (Fintech.Global).
Most embedded finance products run on the same basic structure. A platform, an e-commerce site or an app, owns the customer relationship, while a banking-as-a-service provider manages the API connections and ledgering behind the scenes. The sponsor bank, named on the charter, carries the regulatory liability for the funds involved (Fintech.Global). Regulators in India and the US are converging on the same underlying question from different angles: when something goes wrong in that chain, which layer answers for it.
What to watch
RBI has not said when it will issue a final Master Direction on Prepaid Payment Instruments. Whether the ₹2 lakh full-KYC cap and mandatory interoperability requirements survive industry comment intact will show how much weight RBI is willing to put behind the draft's toughest provisions. In the US, the CFPB's next move on Section 1033 is still pending. Until it issues a revised proposal, embedded finance firms have no compliance date to build toward.