RBI's rules on dark patterns in banking and lending apply from 1 January 2027. See the dates

ConductLens Get a free snapshot

Prove your digital journeys are free of dark patterns.

ConductLens walks your loan, card and onboarding journeys like a customer, flags pre-ticked consents, forced add-ons and late-revealed fees, and hands you reviewed evidence for every requirement.

  • A findings register mapped to the RBI conduct directions
  • Hash-chained evidence your auditor can check offline
  • Re-checked after every release
Get a free snapshot See how it works

No access or data needed for a snapshot. Every finding is confirmed by a person before you see it.

As shipped
Fixed
The same offer screen of a fictional lender, as shipped and after the fixes.What a customer sees on the shipped screen: nothing looks wrong at a glance.

Three findings on that one screen

  1. False urgencyHigh

    A countdown pushes the customer to accept before reading the terms.

    DP-01 RBI conduct directions from 1 Jan 2027; CCPA guidelines already apply
  2. Pre-ticked add-onCritical

    Insurance starts switched on. Consent to each product has to start at "No".

    CON-01 RBI conduct directions from 1 Jan 2027
  3. Confirm shamingHigh

    Saying no is framed as risking your family, in faint small print.

    DP-03, DP-06 RBI conduct directions from 1 Jan 2027; CCPA guidelines already apply
Captured 6 Oct 2026, 11:11 IST, step 4 of 9Reviewed all three findings confirmed by an analystEvidence hash sha256 8c1fa0…d2e7

We walk the whole journey, not one page

Dark patterns hide between screens: a fee that shows up late, a consent that was bundled three steps back. ConductLens follows the customer from offer to decision and marks what it finds where it happens.

  • OfferStep 1 of 5
  • Add-onsStep 2 of 5
  • ConsentStep 3 of 5
  • ChargesStep 4 of 5
  • DecisionStep 5 of 5

Select a numbered pin to see what ConductLens found on that screen.

Illustration of a journey on a fictional lender. Findings are examples, not a real institution.

How ConductLens works

Loan applications, card sign-ups, insurance add-ons, cancellations and consent withdrawal. Each journey is written down once as a plain, versioned file, so every re-test follows exactly the same route.

journey: personal-loan
environment: uat
persona: synthetic, generated
steps:
  - open: /apply
  - capture: offer
  - capture: add-ons
  - capture: consent
  - capture: charges
  • Loan application
  • Card sign-up
  • Insurance add-on
  • Cancellation
  • Consent withdrawal

The rules your journeys are measured against

  1. 30 Nov 2023CCPA's dark-pattern guidelines apply to every platform selling in India, fintech included.
  2. 15 Jun 2026RBI issues conduct directions for every category of regulated entity: no dark patterns, consent that defaults to "No", no compulsory bundling.
  3. 1 Jan 2027The directions apply, including regular testing and audits of digital interfaces, for banks, NBFCs and their sales agents.
  4. 13 May 2027DPDP notice and consent duties become enforceable, including withdrawal that is as easy as giving consent.

A declaration isn't evidence.

In November 2025, 26 e-commerce platforms told the consumer regulator (CCPA) that they had audited themselves and found no dark patterns. A self-declaration says a check was done. It does not show what the screens looked like on the day.

RBI's conduct directions now expect banks and NBFCs to test and audit their digital interfaces periodically. Your screens change every sprint, so your evidence has to keep up.

Source: Inc42, on the Ministry of Consumer Affairs announcement of 20 November 2025.

26 platforms declared themselves free of dark patternsEach square is one platform that submitted a self-declaration. A declaration is a statement, not evidence.

What ConductLens checks

Every check maps to a written requirement and the date it takes effect, so a finding is never a matter of taste.

Dark patterns

  • DP-01False urgencyCountdowns and scarcity claims that rush a decision.
  • DP-02Basket sneakingProducts or charges added without the customer choosing them.
  • DP-03Confirm shamingDecline options that guilt or frighten.
  • DP-04Forced actionUnrelated steps required before the customer can continue.
  • DP-05Subscription trapsCancelling made harder than signing up.
  • DP-06Interface interferenceOne choice made loud, the other made faint.
  • DP-07Bait and switchThe offer delivered differs from the one advertised.
  • DP-08Drip pricingMandatory fees revealed late in the journey.
  • DP-10NaggingPrompts that come back after being dismissed.
  • DP-11Trick wordingDouble negatives and confusing choices.

Consent and disclosure

  • CON-01Consent defaults to "No"No pre-ticked boxes or switched-on toggles.
  • CON-02Explicit, specific consentOne choice per purpose. No "by continuing you agree".
  • CON-03No compulsory bundlingApproval never depends on buying an add-on.
  • DIS-01Key terms upfrontFees, charges and penalties shown before acceptance.
  • DIS-02KFS before acceptanceKey Facts Statement with APR before the borrower accepts.

DPDP, from 13 May 2027

  • DPDP-01Notice with every requestA clear notice before or with each consent request.
  • DPDP-02Data and purposes itemisedWhat is collected and why, item by item.
  • DPDP-03Easy withdrawalWithdrawing consent as easy as giving it.
  • DPDP-05The customer's languageNotice in English or an Eighth Schedule language.

Evidence your auditor can check for themselves

Every report comes with an evidence pack whose files are hashed and chained. Anyone can check it offline. If a single screenshot had been altered, the check would fail.

  • Timestamped screenshots with the element highlighted
  • The requirement, its source and the date it applies
  • An analyst's sign-off on every finding
  • A findings register you can load into your risk tools
Sample evidence pack from an audit of the fictional lender. Try the check below: it is an illustration, not a live verification.
pack-acme-finance-baseline.zip
manifest.json
report.pdf
findings.csv
evidence/ (148 files)
Verification result
Manifest hash valid
148 of 148 files match their hashes
Evidence chain unbroken since the first run

Checked again after every release

Connect your release pipeline once. When a new build ships, the journeys it touches run again. A pattern that comes back raises an alert, and a fix is only marked done when fresh evidence shows it.

Example release history for the fictional lender
  1. 6 findings confirmed across 8 journeys
  2. Regression alert: pre-ticked insurance is back on the offer screen
  3. Fix verified: consent starts at "No" and fees appear before acceptance

Start with a free snapshot

The snapshot is free. Audits and continuous assurance are priced to the journeys and releases you want covered, so our team will talk it through with you.

Snapshot

Free

  • One public journey
  • A one-page findings report
  • Delivered within five business days
  • No access or data needed from you
Get a free snapshot

Baseline audit

Pricing on request

  • Up to 8 journeys, fixed fee
  • Testing in your UAT or with test accounts
  • Findings register and an evidence pack
  • Readout with your compliance and digital teams
Contact our team

Continuous assurance

Pricing on request

  • Re-tests whenever you release
  • Regression alerts and verified fixes
  • A monthly assurance report
  • DPDP checks included from 13 May 2027
Contact our team

Larger teams can add single sign-on, a runner inside their own network and custom rules. Ask our team about enterprise options

Work with us as an early design partner

Hands-on onboarding and early access to new rules. In return we ask for regular feedback and, with your approval, an anonymised case study. Get in touch to talk it through.

Apply to be a design partner

Questions compliance teams ask

Is this legal advice?

No. ConductLens gives you findings and evidence mapped to written requirements. Your own counsel gives legal opinions.

Which institutions is it for?

Banks of every kind, NBFCs, housing finance companies and P2P lenders covered by RBI's conduct directions, and the fintech lenders and sales agents that work with them. Insurers and securities intermediaries are on our roadmap.

Do you need production access or customer data?

No. A snapshot looks only at public pages and never submits a form. Audits run in your test environment or with test accounts, using synthetic customers, within the scope and hours you authorise in writing.

Do you test mobile apps?

Web and mobile web today, with Android apps planned for 2027.

How long does a baseline audit take?

About two weeks from the day we receive test access, including a readout with your team.

Where is our data stored?

Our audit platform is being built to run in India, in AWS Mumbai. Our Trust centre lists what is live today and what is still planned. A free snapshot of a public page needs no data from you.

See one of your journeys the way an auditor would

Tell us which journey to look at. You'll get a one-page snapshot within five business days, and you don't need to give us any access or data.

  1. We confirm the journey with you.
  2. We capture its public screens only.
  3. You get the snapshot and a 20-minute walkthrough.

We use these details only to respond to this request and never share them. Privacy notice

Prefer to write? Email avinow@conductlens.in or visit our contact page.