The RBI has introduced new 2026 cyber security and digital payment guidelines for non-bank PSOs, covering cyber risk management, incident reporting, system audits and third-party security. Large and medium PSOs must comply immediately, while small PSOs have until April 1, 2028.
The Reserve Bank of India (RBI), through its notification dated November 5, 2026, has issued the Reserve Bank of India (Cyber Resilience and Digital Payment Security Controls for Non-Bank Payment System Operators) Master Directions, 2026.
The revised framework aims to strengthen the safety, security and resilience of payment systems operated by authorised non-bank Payment System Operators (PSOs) by establishing comprehensive requirements for managing existing and emerging information technology and cyber security risks.
The revised Master Directions consolidate the earlier RBI instructions on cyber security controls for third-party ATM Switch Application Service Providers, issued on December 31, 2019, and system audits of payment systems under the Payment and Settlement Systems Act, 2007, issued on January 10, 2020.
1. Applicability and Effective Date
The directions are applicable to all authorised non-bank Payment System Operators.
The implementation timelines are as follows:
-
Large and Medium Non-Bank PSOs: Effective from the date the directions are placed on the official RBI website.
-
Small Non-Bank PSOs: Effective from April 1, 2028.
The directions also require PSOs to ensure appropriate adherence by unregulated entities forming part of their digital payments ecosystem, including payment gateways, vendors and third-party service providers, subject to mutual agreement.
2. Strengthened Cyber Security Governance
The RBI has placed responsibility on the Board of Directors for overseeing information security risks, cyber risks and cyber resilience.
Key requirements include:
-
Board-approved Information Security (IS) Policy, reviewed annually.
-
Establishment of a Board-approved Cyber Crisis Management Plan (CCMP).
-
Appointment of a senior-level executive with expertise in information and cyber security, such as a Chief Information Security Officer (CISO).
-
Continuous monitoring of Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs).
-
Cyber risk assessments before launching new products, services or technologies and undertaking major infrastructure changes.
3. Baseline Information Security Measures
The revised directions prescribe comprehensive security controls covering:
-
Inventory and asset management.
-
Identity and access management.
-
Network security and monitoring.
-
Secure application development and lifecycle management.
-
Periodic vulnerability assessment and penetration testing.
-
Vendor and third-party risk management.
-
Data security and encryption.
-
Patch and change management.
-
Cyber incident response.
-
Business continuity and disaster recovery.
-
API security.
-
Employee cyber security awareness and training.
-
Cloud security.
PSOs are required to conduct security testing of applications at least annually through qualified professionals.
4. Cyber Incident Reporting Within Six Hours
One of the important requirements under the revised framework relates to reporting unusual incidents.
PSOs must report incidents such as cyber-attacks, outages of critical systems or infrastructure, internal fraud and settlement delays to RBI within six hours of detection, using the prescribed Incident Reporting Format.
Additionally, cyber security incidents must also be reported to CERT-In.
5. Business Continuity and Disaster Recovery
The directions require PSOs to establish a comprehensive Business Continuity Plan (BCP) covering different cyber threat scenarios.
Important requirements include:
-
Annual review of the Business Continuity Plan.
-
Establishment of a Disaster Recovery (DR) facility in a different seismic zone from the Primary Data Centre (PDC).
-
Conducting DR drills at least half-yearly.
-
Ensuring recovery in accordance with defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).
-
Striving to achieve near-zero RPO.
6. Enhanced Digital Payment Security Requirements
The RBI has introduced additional security requirements for digital payment transactions, including mobile payments, card payments and Prepaid Payment Instruments (PPIs).
Some important provisions include:
Customer Transaction Alerts
-
Confidential information, including bank account and card numbers, must be masked to the extent possible.
-
Transaction alerts must mention the merchant's name and transaction amount.
-
Fund transfer notifications must mention the beneficiary's name and debit amount.
-
Where OTP is used as an authentication factor, the OTP must appear at the end of the notification message, along with reference to the specific transaction.
Fraud Reporting Facility
PSOs must provide a facility on their mobile applications or websites enabling customers to identify or mark fraudulent transactions for immediate notification to the issuer.
Mobile Payment Security
-
Device binding and device fingerprinting.
-
Automatic termination of inactive sessions.
-
Controls against remote access applications.
-
Customer notifications for failed authentication attempts.
-
A minimum cooling period of 12 hours following a change in the registered mobile number or email ID before allowing online payment transactions.
Card Payment Security
Card payment terminals must comply with applicable PCI-P2PE and PCI-PTS requirements. Card networks must also facilitate transaction limits and maintain round-the-clock alert mechanisms for suspicious incidents.
Prepaid Payment Instruments
PPI issuers are encouraged to communicate OTPs and transaction alerts in the language of the user's choice, including vernacular languages. They must also establish suitable cooling periods for fund transfers and cash withdrawals following electronic loading of funds.
7. Mandatory Annual System Audit
Authorised entities must submit their System Audit Report (SAR) annually, within two months of the close of their respective financial year.
The audit must be conducted by eligible auditors, including CERT-In empanelled auditors, CISA-qualified professionals or DISA-qualified professionals, as prescribed.
Further:
-
The audit must cover information security governance, access control, network security, data security, business continuity, vendor risk management, incident management and other prescribed areas.
-
The System Audit Report and compliance status must be placed before the Board.
-
Corrective action for each open audit observation must be completed within a maximum period of three months and reported to RBI.
-
Audit observations can be closed only after acceptance from the auditor.
8. Additional Cyber Security Controls for Third-Party ATM Switch ASPs
The revised directions also prescribe specific cyber security requirements for third-party ATM Switch Application Service Providers (ASPs) engaged by White Label ATM Operators (WLAOs).
These include:
-
Prevention of unauthorised software installation.
-
Network security and secure configuration.
-
User access management and multi-factor authentication.
-
Data leakage prevention.
-
Audit log management.
-
Incident response and disaster recovery.
-
Advanced real-time threat defence.
-
Periodic vulnerability assessment and penetration testing.
-
Establishment of a Cyber Security Operations Centre (C-SOC).
ASPs must also provide RBI access for on-site and off-site supervision as stipulated in the directions.
9. Repeal of Earlier RBI Instructions
With the issuance of the revised Master Directions, RBI has consolidated and repealed specified earlier circulars and instructions relating to system audits of payment systems and cyber security controls for third-party ATM Switch Application Service Providers.
The revised directions will serve as a consolidated regulatory framework for cyber resilience and digital payment security controls applicable to non-bank PSOs.
Conclusion
The revised RBI Master Directions, 2026, represent an important step towards strengthening cyber resilience, operational security and consumer protection in India's digital payment ecosystem.
Authorised non-bank Payment System Operators, including relevant third-party service providers and ATM Switch ASPs, should review the revised requirements, assess existing security frameworks and implement the necessary measures within the applicable timelines.
Reference: RBI Notification No. RBI/DPSS/2026-27/475 dated November 5, 2026 – Master Directions on Cyber Resilience and Digital Payment Security Controls for Non-Bank Payment System Operators.
Source: Reserve Bank of India – www.rbi.org.in
Source: CA Sansaar