The Reserve Bank of India (RBI) on 5 November 2026 issued the Reserve Bank of India (Cyber Resilience and Digital Payment Security Controls for non-bank PSOs) Master Directions, 2026, consolidating earlier cyber and system-audit instructions for authorised non-bank Payment System Operators into one rulebook. Large and medium PSOs must comply from the date the directions appear on the RBI website; small PSOs have until 1 April 2028.
The framework covers the National Payments Corporation of India (NPCI), card payment networks, payment aggregators, prepaid payment instrument (PPI) issuers, white-label ATM operators (WLAOs) and other authorised non-bank PSOs. It is issued under Section 10(2) read with Section 18 of the Payment and Settlement Systems Act, 2007, and is listed on the RBI Master Directions page.
What the new PSO cyber directions require
Boards remain accountable for information-security and cyber resilience. Primary oversight may sit with an optional Board sub-committee chaired by a member with information or cyber security experience, meeting at least once a quarter. Each PSO must keep a Board-approved Information Security policy, reviewed annually, and a distinct Board-approved Cyber Crisis Management Plan. A senior executive with cyber expertise — typically the Chief Information Security Officer (CISO) — is accountable for implementing the framework.
Unusual incidents such as cyberattacks, critical system or infrastructure outages, internal fraud and settlement delays must be reported to the RBI within six hours of detection. Cyber security incidents must also be reported to CERT-In. Critical patches for well-known or reported attacks must be applied immediately.
- Source code of critical third-party applications, or escrow if the code cannot be obtained
- If the PSO does not own the code, a developer certificate that the app is free of vulnerabilities, malware and covert channels, renewed after every change
- Device and SIM binding for mobile payment apps, and a minimum 12-hour cooling-off after a registered mobile or email change before online transactions
- Card networks to set limits at card, BIN and issuer levels on the switch, run 24×7 issuer alerts, let customers flag fraud, and show merchant (not gateway) names — with beneficiary and amount on fund-transfer alerts
These controls sit alongside RBI’s wider technology-risk scrutiny, including recent cyber checks on banks and fintech and NBFC APIs.
Annual system audit and third-party ATM switches
Authorised PSOs must file an annual System Audit Report within two months of financial-year close — by 1 June for April–March entities. Audits may be done by CERT-In empanelled auditors, CISA-qualified ISACA-registered auditors, or DISA-qualified ICAI professionals. The auditor and sister concerns must not have served the entity in the previous two financial years. Open observations must be fixed within a maximum of three months, with auditor acceptance before closure.
WLAOs using shared third-party ATM switch application service providers must write cyber controls into contracts and give the RBI on-site and off-site supervisory access. Remote connections from outside machines into the switch network must be disabled, and potential backdoor connections blocked. Unregulated ecosystem entities such as payment gateways and vendors are to follow the directions subject to mutual agreement under a Board-approved policy.
Why it matters for non-bank payment operators
India’s digital payments stack depends heavily on non-bank rails. Partnerships such as the NPCI–IIIT Hyderabad cybersecurity MoU and the earlier NPCI–IDRBT cybersecurity partnership show how tightly payments technology and cyber defence are linked.
By folding the July 2024 Master Directions with the December 2019 ATM-switch ASP cyber controls and the January 2020 system-audit scope review — and repealing six circulars dating back to 2009 — the RBI gives non-bank PSOs one reference point. Existing card, PPI and mobile-banking security instructions continue to apply; where there is a conflict, this Master Direction prevails. For newly authorised operators, including aggregators with in-principle physical PA approval, the cyber and audit bar is now part of day-one compliance planning.
Key takeaways
- RBI’s 5 November 2026 Master Directions consolidate cyber resilience and digital payment security rules for all authorised non-bank PSOs.
- Large and medium PSOs comply immediately; small PSOs until 1 April 2028; cyberattacks and critical outages need six-hour reporting to RBI, and CERT-In for cyber incidents.
- Annual system audits, source-code or escrow safeguards, mobile device binding, and contractual controls on shared ATM switches are now hard requirements.
FAQ
When do the RBI PSO cyber directions take effect?
Immediately on website publication for large and medium non-bank PSOs, and from 1 April 2028 for small non-bank PSOs.
What must be reported to RBI within six hours?
Cyberattacks, critical system or infrastructure outages, internal fraud and settlement delays; cyber security incidents must also go to CERT-In.
Which older circulars does the Master Direction repeal?
Six circulars and directions from December 2009 through the 2019 ATM-switch ASP cyber controls and the January 2020 system-audit scope review.
Featured image: Tower and building of the Reserve Bank of India, Mumbai branch. Photo: Pinakpani via Wikimedia Commons (CC BY-SA 4.0).
