RBI Consolidates Cybersecurity Rules for Non-Bank Payment Operators; What Banks Should Check

What the RBI published

On 5 November 2026, the Reserve Bank of India (RBI) listed Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators (PSOs). The stated purpose is to bring payment-system cyber controls, annual system audits and requirements concerning third-party ATM switch service providers into one reference framework. The circular has been reported as RBI/DPSS/2026-27/475. The official RBI notifications page confirms the publication and title; detailed provisions below are drawn from reporting by Business Standard and ETBFSI because a complete original RBI direction text was not independently retrieved during this review.

This is a consolidation with revised provisions, not a statement that every clause was newly introduced in November. Earlier RBI requirements on security governance, payment-transaction protection and incident reporting predate this consolidation. Banks should separate what is new in a partner’s obligation from controls that were already effective.

Which payment entities are covered?

The published reports identify authorised non-bank PSOs such as the National Payments Corporation of India (NPCI), card networks, payment aggregators, certain prepaid payment instrument issuers and white-label ATM operators. Although these organisations interact with banks and bank customers, the category is not identical to a scheduled commercial bank or a regional rural bank.

According to the reported commencement provisions, large and medium non-bank PSOs come under the consolidated Directions from their publication on the RBI website on 5 November 2026. The commencement for small PSOs is 1 April 2028. A bank should not assume that the small-PSO transition date changes its own existing cyber obligations.

Key operational requirements described in the reports

• Annual audit: the operator must arrange a system audit and furnish the resulting report within two months after its financial year closes, with timely remediation of audit observations. Business Standard reports a three-month maximum for unresolved observations.
• Vendor and application security: critical applications acquired from third parties require source-code access, or an escrow arrangement where access is not possible, alongside safeguards for code updates and vulnerabilities.
• ATM switching: white-label ATM operators using outside switch providers are expected to maintain contractual security assurance, monitoring and supervisory access arrangements.
• Incident and continuity controls: the framework covers incident escalation, access management, monitoring, recovery arrangements and cybersecurity governance.
• Payment safeguards: incident reporting within six hours and a minimum 12-hour cooling-off period following certain registered mobile-number or email changes are reported as continuing controls, not necessarily freshly introduced thresholds.

The exact clauses and defined operator categories should be verified against the official RBI text before a compliance team changes its regulatory checklist or asserts that a previously valid control has become mandatory for the first time.

What this means for bankers

Payment operations, card, ATM, digital banking, vendor-management and information-security teams depend on interfaces with non-bank PSOs. They may need to check that partner contracts, incident contacts, audit assurance, reconciliation records and business-continuity procedures align with the revised framework. Branch personnel should continue to follow bank-approved customer dispute and fraud escalation procedures; this notification does not direct each branch to file a separate PSO audit.

There is an important difference between direct regulatory applicability to the non-bank operator and operational implications for a bank that participates in its payment network. Each bank’s own binding RBI instructions continue to apply independently.

Document status and verification limits

The RBI notification listing and two directly inspected news reports support the existence, date and broad coverage of these Directions. However, the complete original instrument was not available for clause-by-clause inspection in this run. The summary is therefore a source-attributed account rather than a legal compliance opinion or a claim to reproduce the full Master Direction.

Sources and References

1. Reserve Bank of India — official notification listing — Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators
2. Business Standard — RBI tightens cyber oversight of non-bank payment system operators
3. ETBFSI — RBI tightens cybersecurity norms for non-bank payment operators, mandates six-hour incident reporting