The Reserve Bank of India has issued a consolidated framework for cyber resilience and digital payment security controls covering authorised non-bank payment system operators. The directions include six-hour reporting of specified unusual incidents and stronger governance, audit and third-party controls.
The Reserve Bank of India (RBI) issued its Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators (PSOs) on 5 November 2026. The framework updates and consolidates requirements intended to strengthen the security and resilience of India’s non-bank digital payments ecosystem.
Under the directions, unusual incidents—including cyberattacks, outages of critical systems or infrastructure, internal fraud and settlement delays—must be reported to the RBI within six hours of detection. Cybersecurity incidents must also be reported to CERT-In.
The directions strengthen board-level oversight of information and cyber risks, incident response arrangements, security testing, system audits and controls over third-party service providers. They also address risks arising from technology partners and other entities connected to payment operators’ digital ecosystems.
The directions apply to authorised non-bank PSOs. They take effect upon publication for large and medium PSOs, while small PSOs have a later compliance date of 1 April 2028.
Primary source — Reserve Bank of India, Master Directions dated 5 November 2026: Read original report / announcement
Additional coverage — ETBFSI, 6 November 2026: Read original report / announcement
Editorial attribution: Independently written and edited by the BFSI NXT News Desk based on the source material linked above. Company statements, targets and forward-looking estimates are attributed to the respective organisation and are not presented as guaranteed outcomes.
