RBI merges cyber rules for non-bank payment firms into one direction

RBI merges cyber rules for non-bank payment firms into one direction

9 November 2026: The Reserve Bank of India has folded its cyber security rules for non-bank payment operators into a single master direction, which takes effect at once for large and medium firms and from 1 April 2028 for small ones. Six circulars on system audits and ATM switch controls, issued between 2009 and 2020, are repealed, so compliance teams need to re-map their controls to the new document.

Not yet independently verified. RBI's notification list confirms the title and the 5 November date, but the text of the direction could not be opened. The rule details come from MediaNama's summary of 9 November 2026, which quotes it. We will update this when it can be confirmed, and remove this note.

Which firms fall into which tier

Large operators are NPCI, NPCI Bharat BillPay, card networks, payment aggregators, large prepaid wallet issuers, non-bank ATM networks, white label ATM operators, the Clearing Corporation of India, Bharat Bill Payment operating units and TReDS invoice discounting platforms. Medium covers inbound cross-border money transfer operators and medium prepaid issuers. Small covers small prepaid issuers and instant money transfer operators.

The direction builds on the rules of July 2024, under which large firms had to comply by April 2025 and medium firms by April 2026. To those it adds the 2019 controls for third-party ATM switch providers and the 2020 rules on what an annual system audit must cover.

Its reach goes past the regulated firm. Unregulated partners in the payment chain, among them gateways, vendors and ATM switch providers, must follow the rules "subject to mutual agreement", under a board-approved policy. A software supplier to an Indian payment company should expect that clause to arrive in its contract.

What payment apps must now show and block

A change of the mobile number or email linked to a payment instrument triggers a cooling period of at least 12 hours before online payments. Apps must detect remote access tools "to the extent possible" and block access while a session is live. They must bind to the user's device and SIM, and bind again after a set period of disuse.

Alerts for online payments must name the merchant and the amount, not the gateway or aggregator. A one-time password goes at the end of the message, and account and card numbers are masked as far as possible. Each electronic debit needs more than one authentication check unless explicitly relaxed, and users must be able to mark a transaction as fraudulent from within the app or website.

Six hours to tell the regulator

Cyber attacks, critical system outages, internal fraud and settlement delays must be reported to RBI within 6 hours of detection, with security incidents also going to CERT-In. Operators need a security operations centre, real-time or near real-time fraud monitoring, and a manned desk open round the clock for fraud complaints and law enforcement.

Boards carry responsibility for cyber risk and may delegate oversight to a committee, led by a member with security experience, which meets at least quarterly. Firms must appoint a senior security head, keep system activity records for at least five years, and secure access to the source code of critical software bought from vendors. The backup site must sit in a different seismic zone, with recovery drills at least every six months.

IT audits are yearly and cover 20 areas. Firms on an April to March financial year must file the report with RBI by 1 June and fix any problems within three months.

Where this touches our catalogue

Our payment processing category holds 14 products, including Razorpay Payment Gateway and PayStand.

Sources

• Reserve Bank of India: notifications list, Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators, 5 November 2026
• MediaNama: What RBI's consolidated cyber security rules mean for payment apps and users, 9 November 2026