RBI Fines Ola Financial Services ₹3.10 Lakh After Finding Some Customers Were Not Risk-Categorised Under KYC Rules

The Reserve Bank of India has imposed a monetary penalty of ₹3.10 lakh on Ola Financial Services Private Limited after finding that the company failed to carry out risk categorisation of certain customers under RBI's Know Your Customer framework. The penalty was imposed by an order dated 24 September 2026 under section 30(1) read with section 26(6) of the Payment and Settlement Systems Act, 2007.

According to RBI's September 24 enforcement release, the statutory inspection covered the company's operations from January 2025 to November 2025. RBI issued a show-cause notice after its supervisory findings and then considered the company's reply, additional submissions and oral submissions at a personal hearing before sustaining the charge.

RBI's finding was specific: some customers had no risk category

The release does not describe a broad failure of every KYC process at the company. The sustained charge is narrower: Ola Financial Services failed to carry out risk categorisation of certain customers. RBI does not state in the release how many customers were affected, how long the gap persisted, or whether any customer suffered a financial loss.

That limitation matters. The order should therefore be read as a regulatory-compliance finding about a defined KYC control, not as evidence of fraud, invalid customer transactions or a wider failure that the release does not establish.

Risk categorisation is a core part of RBI's KYC framework

RBI's Master Direction - Know Your Customer (KYC) Direction, 2016 requires regulated entities to categorise customers as low, medium or high risk based on their own assessment and risk perception. The direction says the assessment can consider factors such as customer identity, social and financial status, nature and location of business, geographical risk, products and delivery channels, and transaction types.

The category is not meant to be a label applied mechanically from one data field. It sits inside the regulated entity's wider risk-management process and determines how the institution thinks about customer due diligence and ongoing monitoring. RBI also requires the customer's risk category and the reasons for it to remain confidential to avoid tipping off the customer.

This is different from a periodic risk-review lapse

CA Samaaj has previously reported an RBI penalty where an NBFC failed to put in place the required periodic review of customer risk categorisation. That Progfin enforcement action concerned the review cycle after categorisation.

The Ola Financial Services release is different on the facts available: RBI says the company failed to carry out risk categorisation for certain customers. Compliance teams should not collapse the two controls into one. An institution can have a periodic review schedule on paper and still have an initial or migrated customer population with missing risk categories; conversely, it can classify customers initially but fail to review those classifications when required.

The inspection covered January to November 2025 operations

The stated supervisory reference period is January 2025 to November 2025. After the inspection and related correspondence, RBI issued a notice asking the company to explain why a penalty should not be imposed. The regulator says it considered the written response, additional submissions and oral submissions made during a personal hearing before concluding that the risk-categorisation charge was sustained.

The legal basis is also specific to the company's role in the payments framework. RBI invoked section 30(1) read with section 26(6) of the Payment and Settlement Systems Act, 2007, rather than the penalty provisions commonly seen in bank or NBFC orders under the Banking Regulation Act or RBI Act.

The penalty does not invalidate customer transactions

RBI expressly says the action is based on deficiencies in regulatory compliance and is not intended to pronounce on the validity of any transaction or agreement entered into by Ola Financial Services with its customers. It also says the monetary penalty is without prejudice to any other action that RBI may initiate against the company.

That wording is important for readers assessing the consequence of the order. The release establishes a KYC-control failure and a monetary penalty; it does not state that customer agreements are void, that customer funds were lost, or that criminal misconduct occurred.

A 2022 Ola penalty was a separate RBI action

RBI had also penalised Ola Financial Services in July 2022 for non-compliance with certain provisions of the PPI Master Directions and KYC Directions. Contemporary reporting on that earlier order recorded a penalty of ₹1.67 crore. The 2026 action should not be treated as the same proceeding: it relates to a later inspection period and the current release identifies a specific failure to risk-categorise certain customers.

What payments and compliance teams should test after this order

RBI's release does not prescribe a public remediation checklist for Ola Financial Services. The practical control implication for other payment-system and KYC teams is therefore an editorial interpretation of the identified failure, not an additional RBI direction.

• Check whether every in-scope customer record has a valid risk category rather than a blank, default or unmapped field.
• Confirm that the category is supported by the institution's approved risk parameters instead of being assigned only from one attribute such as account value or occupation.
• Review legacy, migrated and manually onboarded customer populations separately, because missing classifications can sit outside newer automated workflows.
• Test exception reports and manual overrides so unresolved records are visible to compliance and operational owners.
• Keep the periodic review of risk categories as a separate control from the initial categorisation step, with evidence that both processes are operating.

The immediate lesson from the September 24 order is narrow but useful: KYC risk classification is not complete merely because customer identity documents were collected. The regulated entity must actually assign the customer to its risk framework and be able to demonstrate that control during supervisory review.

Official source: View the official source document