On 5 November 2026, the Reserve Bank of India issued revised Master Directions on cyber resilience and digital-payment security for authorised non-bank Payment System Operators. The document is important not because every control is brand new, but because it replaces scattered instructions with one enforceable reference covering governance, technology, vendors, incident response, customer safeguards and system audit.
Who is covered—and from when?
| Category | Examples stated by RBI | Commencement |
|---|---|---|
| Large non-bank PSOs | CCIL, NPCI, NPCI Bharat BillPay, card networks, non-bank ATM networks, white-label ATM operators, large PPI issuers, TReDS operators, BBPOUs and payment aggregators | 5 November 2026 |
| Medium non-bank PSOs | Cross-border inbound money-transfer operators under MTSS and medium PPI issuers | 5 November 2026 |
| Small non-bank PSOs | Small PPI issuers and instant money-transfer operators | 1 April 2028 |
If a PPI issuer moves into a higher category, RBI says it must comply with the timeline for that category within one year of re-categorisation. Banks are not the direct addressees of this Master Direction; it applies to authorised non-bank PSOs.
What has RBI consolidated?
The 2026 directions carry forward the 2024 cyber-resilience framework and combine it with RBI’s earlier rules for third-party ATM Switch Application Service Providers and the system-audit scope for payment systems. Existing card, PPI and mobile-banking security instructions continue; where applicability conflicts, the new Master Direction prevails.
This distinction matters. Compliance teams should not treat 5 November as a clean-sheet implementation date. Large and medium operators were already subject to phased requirements under the 2024 directions. The immediate task is a clause-by-clause reconciliation against the new consolidated text, including the audit and ATM-switch sections now sitting in the same rulebook.
Board accountability is explicit
The Board remains responsible for oversight of information-security, cyber and resilience risks. Primary oversight may be delegated to a Board sub-committee headed by a member experienced in information or cyber security, but that committee must meet at least quarterly.
- Annual information-security policy. The Board-approved policy must cover payment applications and products, clear responsibilities, security controls and employee or stakeholder awareness.
- Cyber Crisis Management Plan. A distinct Board-approved plan must address detection, containment, response and recovery.
- Named senior accountability. Implementation and continuous assessment must be entrusted to a suitably experienced senior executive, such as a CISO.
- Continuous KRI and KPI monitoring. The Board sub-committee must monitor risk indicators and control effectiveness, and receive IT assessment reports at its next meeting.
The six-hour incident clock
Cyber-attacks, outages of critical systems or infrastructure, internal fraud, settlement delays and other unusual incidents must be reported to RBI in the prescribed Incident Reporting Format within six hours of detection. Cyber-security incidents must also be reported to CERT-In.
A Board-approved incident-response mechanism should therefore identify who decides reportability, who owns the six-hour clock, who contacts RBI and CERT-In, and how facts are updated after the initial report. Post-incident and forensic analysis must establish impact and root cause, followed by measures against recurrence.
Baseline technology and resilience controls
| Area | Minimum expectation highlighted by RBI |
|---|---|
| Security testing | Applications must undergo source-code review, vulnerability assessment and penetration testing by qualified professionals at least annually, and before deployment or redeployment of critical services. |
| Disaster recovery | The DR facility must be in a different seismic zone; the PSO should strive for near-zero RPO and conduct drills at least half-yearly. |
| Cloud services | A Board-approved cloud policy is required, with data localisation, segregation, protection and recoverability controls. Cloud providers must undergo an independent cyber-security audit at least annually. |
| Audit logs | Logs must identify the user, action and parameters and be preserved for at least five years. |
| Fraud response | Real-time or near-real-time monitoring and a manned 24×7×365 facility are required for fraudulent-transaction reports and law-enforcement response. |
Vendors are inside the control perimeter
PSOs must address risks created by payment gateways, third-party service providers, vendors and ATM-switch providers. RBI requires a Board-approved organisational policy and adherence by these unregulated entities through mutual agreement.
For vendors handling critical processes, the PSO must obtain independent certified assurance over cyber-resilience capability. Contracts should also support legal requirements on infrastructure location and data processing, storage and use. This makes vendor contracting, audit rights and assurance evidence a core regulatory control—not merely a procurement exercise.
Customer-facing safeguards
The Master Direction also prescribes controls customers will experience directly:
- Multi-factor authentication. Electronic debits and cash withdrawals require MFA unless RBI has expressly permitted or relaxed it.
- Fraud-marking facility. The website or mobile app must let an authenticated customer identify a fraudulent transaction for immediate notification to the instrument issuer.
- Clear alerts. Payment notifications must mask confidential information and show the merchant and amount, rather than only the gateway or aggregator.
- Mobile-app controls. Device or SIM binding, session timeouts and immediate failed-login alerts are required, together with safeguards against live remote-access applications.
- Cooling period. A change in the registered mobile number or email ID must be followed by at least a 12-hour wait before online payment transactions are allowed.
System audit deadline—and an opportunity for qualified CAs
Every authorised entity must submit an annual System Audit Report within two months of the end of its financial year. For an April–March year, RBI specifies 1 June; for a calendar year, it specifies 1 March of the following year.
The audit may be conducted by a CERT-In empanelled auditor, a CISA registered with ISACA, or a holder of ICAI’s DISA qualification. The auditor must test both the design and operating effectiveness of controls. The audit firm and its sister concerns must not have provided any service to the audited entity during the previous two financial years, preserving independence.
What should affected entities do now?
- Confirm the category and effective date. Document whether the entity is large, medium or small and monitor any re-categorisation.
- Build a control crosswalk. Map the 2024 directions, system-audit rules and ATM-switch controls to every clause of the 2026 consolidation.
- Refresh Board documents. Update the information-security policy, cyber crisis plan, incident-response mechanism, cloud policy and vendor policy.
- Test the six-hour workflow. Run a tabletop exercise covering detection, internal escalation, RBI reporting, CERT-In reporting, evidence preservation and later updates.
- Review contracts and assurance. Identify every material third party and close gaps in audit rights, incident notification, data location and independent assurance.
- Calendar audits and DR tests. Align annual security testing, half-yearly backup and DR exercises, cloud-provider audits and the SAR filing deadline.
- Verify customer journeys. Test fraud marking, alert content, MFA, remote-access detection, failed-login alerts and the 12-hour contact-change cooling period.
Reviewed on 8 November 2026. This article summarises the consolidated RBI framework; applicability and remediation should be assessed against the operator’s authorisation, category, products, outsourcing model and technology architecture.