RBI consolidates cyber resilience and digital payment security rules for non-bank payment operators into one Master Direction

In short

The Reserve Bank of India has issued the Reserve Bank of India (Cyber Resilience and Digital Payment Security Controls for non-bank PSOs) Master Directions, 2026. They bring the July 2024 Master Directions together with earlier instructions on ATM switch providers and on system audit into one text. The Directions apply to large and medium non-bank payment system operators from the day they were placed on the RBI website, and to small operators from 1 April 2028.

Authority

Reserve Bank of India, Department of Payment and Settlement Systems

Reference

RBI/DPSS/2026-27/475, CO.DPSS.CSD.No.S825/01-01-078/2026-2027, dated 5 November 2026

Type

Master Directions

Issued under

Section 10(2) read with section 18 of the Payment and Settlement Systems Act, 2007

Effective from

Day of placement on the RBI website (large and medium non-bank PSOs); 1 April 2028 (small non-bank PSOs)

Applies to

All authorised non-bank payment system operators (PSOs)

System audit report due

1 June (April–March year) or 1 March of the next year (calendar-year entities)

What changed

Existing instructions on security and risk mitigation for payments using cards, prepaid payment instruments and mobile banking continue to apply, and where there is a discrepancy the Master Direction prevails. Which paragraphs are new rather than carried over from the 2024 Directions is not marked in the document.

Who it applies to

• Authorised non-bank PSOs: payment aggregators, card networks, non-bank ATM networks and white label ATM operators, prepaid payment instrument issuers, TReDS operators, bill payment operating units, cross-border money transfer operators and the clearing and payment infrastructure bodies named in the Directions
• Third-party ATM switch application service providers working for white label ATM operators
• Chartered accountants and system auditors (CERT-In empanelled auditors, CISAs, and DISA holders of ICAI) who prepare PSO system audit reports
• Customers of payment apps and prepaid wallets, who will see more alerts, cooling periods and fraud-marking facilities

What to do

1. Large and medium PSOs: map existing controls against the Directions now; they are already in effect.
2. Keep a Board-approved information security policy (reviewed yearly) and a Cyber Crisis Management Plan, with a Board sub-committee meeting at least quarterly.
3. Test applications for vulnerabilities and penetration at least once a year, and run disaster recovery drills at least half-yearly.
4. Preserve audit logs for at least five years and run a 24x7x365 desk to resolve unauthorised transaction complaints.
5. File the system audit report within two months of year end: 1 June for April–March entities, 1 March for calendar-year entities; close each open observation within a maximum of 3 months.
6. Small PSOs: be compliant by 1 April 2028.

Reference

RBI Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank PSOs, RBI/DPSS/2026-27/475, 5 November 2026.

Written by TaxByKK from the official notification. Check the official text before you act on it.

Related