RBI Consolidates Cybersecurity, Payment Fraud Monitoring, Incident Reporting and System Audit Requirements Under a Single Regulatory Framework
The Reserve Bank of India (RBI) has issued the Reserve Bank of India (Cyber Resilience and Digital Payment Security Controls for non-bank PSOs) Master Directions, 2026, strengthening the regulatory framework governing the security and operational resilience of India’s digital payment ecosystem.
Issued on 5 November 2026, the Directions apply to authorised non-bank Payment System Operators (PSOs), including payment aggregators, prepaid payment instrument issuers, card networks, White Label ATM Operators and other covered payment institutions.
The framework consolidates RBI’s July 2024 cybersecurity directions with existing requirements relating to system audits and third-party ATM switch service providers.
For regulated payment operators, the implications extend beyond cybersecurity departments. The Directions place significant responsibilities on Boards, senior management, compliance professionals, technology risk teams, payment operations and internal auditors.
1. RBI’s 2026 Master Directions: Key Regulatory Details
| Particulars | Regulatory details |
| Date issued | 5 November 2026 |
| Circular number | RBI/DPSS/2026-27/475 |
| Regulator | Reserve Bank of India |
| Applicability | All authorised non-bank PSOs |
| Large and medium PSOs | Effective immediately |
| Small PSOs | Effective from 1 April 2028 |
| Legal basis | Payment and Settlement Systems Act, 2007 |
| Key requirements | Cyber governance, incident reporting, payment security, system audits and third-party risk |
An important point is that several underlying cybersecurity requirements were already established under RBI’s 30 July 2024 framework. The 2026 Master Directions consolidate these requirements and related instructions into a common regulatory reference.
2. Why Has RBI Strengthened the Framework?
India’s payment ecosystem increasingly depends on interconnected technology infrastructure, real-time transactions, payment applications, APIs, cloud services and external technology providers.
While these technologies support efficient payments, they also create risks involving unauthorised access, system disruption, fraudulent transactions, information leakage and third-party vulnerabilities.
Cybersecurity failures within a payment operator can affect customers, participating institutions and other entities connected to the payment network.
Consequently, RBI’s framework emphasises a more integrated approach combining preventive security controls, transaction monitoring, operational resilience and independent assurance.
3. Board Accountability for Cybersecurity and Technology Risk
The Directions assign the Board responsibility for adequate oversight of information security risks, including cybersecurity and cyber resilience.
Primary oversight may be delegated to a Board subcommittee headed by a member with relevant information or cybersecurity experience.
The subcommittee must meet at least once every quarter.
PSOs must also maintain:
- A Board-approved Information Security Policy, reviewed annually.
- A distinct Board-approved Cyber Crisis Management Plan.
- Clearly assigned senior-management accountability for information security.
- Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) for security controls.
- Cyber risk assessments before launching new products or introducing significant technology changes.
For risk management professionals, this reinforces the importance of treating cybersecurity as an enterprise governance responsibility rather than a purely technical function.
4. Six-Hour Reporting Requirement for Cyber Incidents
One of the most important requirements concerns the reporting of unusual incidents.
Under the Directions, PSOs must report specified incidents to RBI within six hours of detection.
Reportable incidents include cyberattacks, outages of critical systems or infrastructure, internal fraud and settlement delays.
Cybersecurity incidents must also be reported to CERT-In in accordance with applicable requirements.
This requires institutions to maintain effective incident identification, escalation and reporting processes.
Practical implication: A payment operator detecting suspicious payment-system activity should be able to escalate the matter quickly, assess the reporting obligation, initiate containment and submit the required notification without waiting for a complete forensic investigation.
The six-hour timeline makes clearly defined reporting responsibilities and tested incident-response procedures particularly important.
5. Stronger Digital Payment Security and Fraud Monitoring
RBI’s Directions emphasise real-time or near-real-time monitoring to identify suspicious payment activity.
PSOs must maintain appropriate mechanisms for monitoring transaction patterns and generating alerts.
These may include:
- Unusual transaction velocity.
- Suspicious payment locations or IP addresses.
- Unexpected activity involving newly opened accounts.
- Transactions involving known suspicious beneficiaries.
- Repeated failed or declined transactions.
- Abnormal device or customer behaviour.
The framework also requires a 24×7×365 manned facility for facilitating the prompt resolution of unauthorised or fraudulent transactions and responding to law enforcement agencies.
An additional requirement concerns customer contact-detail changes.
For relevant online transactions, a minimum 12-hour cooling period applies after a change to the registered mobile number or email address linked to a payment instrument.
These safeguards are intended to reduce opportunities for unauthorised payments and improve the speed of fraud identification.
6. Application Security, APIs and Third-Party Technology Risk
Payment operators increasingly rely on outsourced technology services, external applications and cloud-based infrastructure.
The Directions address several important security measures:
Secure Application Development: PSOs must follow secure software development practices and incorporate security controls throughout the application lifecycle.
Security Testing: Applications must undergo appropriate testing, including vulnerability assessments, penetration testing and source-code reviews, at least annually.
Access Management: Privileged accounts must be subject to multi-factor authentication and appropriate monitoring.
Security Operations Centre: PSOs must maintain centralised monitoring capabilities for relevant network and system logs.
API Security: Applications and payment interfaces require appropriate authentication, authorisation, confidentiality and integrity controls.
Third-Party Oversight: PSOs must assess risks associated with vendors and outsourced service providers and establish appropriate security arrangements.
For institutions using critical third-party applications, the Directions also address source-code availability or escrow arrangements where appropriate.
The overall objective is to ensure that weaknesses in external systems or integrated applications do not undermine the security of payment operations.
7. Business Continuity and Disaster Recovery
Cyber resilience requires institutions to maintain essential payment services during and after significant disruptions.
RBI’s framework requires Business Continuity Plans addressing relevant cyber-threat scenarios.
Important provisions include:
- Annual review of the Business Continuity Plan.
- Defined Recovery Time Objectives and Recovery Point Objectives.
- Efforts towards near-zero Recovery Point Objectives.
- Disaster Recovery facilities located in a different seismic zone from the primary data centre.
- Disaster Recovery drills at least every six months.
- Timely analysis and correction of deviations from recovery objectives.
For internal auditors, this creates a requirement to examine whether recovery arrangements have been tested effectively, rather than merely confirming the existence of documented procedures.
8. Annual System Audits and Remediation Requirements
The Master Directions prescribe annual system audits by eligible independent professionals.
System Audit Reports must be submitted within two months of the close of the financial year.
For institutions following an April–March financial year, the submission deadline is 1 June.
System audits must examine both the design and operating effectiveness of relevant controls.
Key areas include information security governance, access management, application security, network protection, payment security, third-party risk, business continuity and incident management.
The Directions also require:
- Board review of system audit reports and compliance status.
- Defined corrective actions for outstanding findings.
- A maximum three-month remediation period for open observations.
- Reporting of corrective action to RBI.
- Auditor acceptance before observations are treated as closed.
These provisions make independent assurance and audit-remediation tracking important components of PSO regulatory compliance.
9. Compliance Checklist for Non-Bank PSOs
The following questions can support an initial regulatory gap assessment.
| Compliance area | Key question |
| Board governance | Is cybersecurity oversight formally assigned and regularly reviewed? |
| Information Security Policy | Is the policy Board-approved and reviewed annually? |
| Cyber Crisis Management | Is there an approved and tested incident-response plan? |
| Incident reporting | Can reportable incidents be notified to RBI within six hours? |
| Security monitoring | Is an effective Security Operations Centre in place? |
| Payment fraud controls | Are suspicious transactions monitored in real time or near real time? |
| Application security | Are security testing and remediation performed at required intervals? |
| Privileged access | Are privileged accounts protected with MFA and monitoring? |
| Third-party risk | Are critical vendors and technology dependencies appropriately assessed? |
| Disaster recovery | Are recovery arrangements tested at least every six months? |
| System audit | Is an independent annual system audit conducted and submitted? |
| Audit remediation | Are open observations resolved within prescribed timelines? |
Institutions should supplement this high-level checklist with a provision-by-provision compliance matrix based on their authorisation category and operational activities.
10. What Should CISOs, CROs, Compliance Officers and Internal Auditors Prioritise?
The revised framework calls for coordinated action across multiple functions.
Chief Information Security Officers should review security monitoring, incident-response readiness, access controls, application testing and resilience arrangements.
Chief Risk Officers should evaluate cyber and technology risk exposures, third-party concentration, operational resilience and Board-level risk reporting.
Compliance Officers should map the applicable regulatory requirements, track reporting obligations and monitor corrective-action deadlines.
Internal Auditors should assess control design and operating effectiveness, test security processes and verify closure of significant audit observations.
Payment Operations and Fraud Risk Teams should review transaction-monitoring rules, suspicious-payment escalation processes and arrangements for customer fraud reporting.
A coordinated approach is essential because cyber incidents can simultaneously involve technology failure, payment fraud, operational disruption and regulatory reporting obligations.
11. Conclusion: Cyber Resilience Must Be Demonstrated Through Effective Controls
RBI’s Cyber Resilience and Digital Payment Security Controls for Non-Bank PSOs Master Directions, 2026 represent an important consolidation of the regulatory requirements governing India’s non-bank payment infrastructure.
The Directions place emphasis on Board accountability, continuous security monitoring, effective payment fraud controls, timely incident reporting, operational recovery and independent system audits.
For payment operators, the central challenge is not simply maintaining cybersecurity policies. Institutions must demonstrate that their controls operate effectively, vulnerabilities are addressed, incidents are reported promptly and payment services can be restored following disruptions.
The key lesson for financial institutions is that cybersecurity, fraud risk management, technology governance and operational resilience must operate as an integrated risk management framework.
As digital payment volumes and technological dependencies expand, this integrated approach will remain essential to safeguarding payment systems and maintaining confidence in financial services.
Official Reference and Further Reading
This article is a professional regulatory overview prepared for RMAI. Institutions should refer to the official RBI Directions for the full requirements and applicability.