Follow us on Google News
The Reserve Bank of India (RBI) has tightened regulatory oversight and accountability for non-banking payment firms to combat cyber fraud and digital payment disruptions. Under revised cybersecurity guidelines, non-banking payment system operators (PSOs) must now report any unusual incident, cyberattack, major technical disruption, or settlement delay to the central bank within six hours of detection. Cybersecurity incidents must also be reported to the Indian Computer Emergency Response Team (CERT-In) within the same six-hour window.
Stricter Controls on Vendors and Annual Audits
The RBI’s revised Master Directions apply to non-banking PSOs, including the National Payments Corporation of India (NPCI), card networks, payment aggregators, prepaid payment instrument (PPI) issuers, and white-label ATM operators. These entities must adhere to stricter standards covering digital transaction security, software management, system audits, and third-party vendor risks.
Srinivas L, Joint Managing Director and Chief Executive Officer of 63SATS Cybertech, noted that the central bank has consolidated previously issued directives into a unified framework. He highlighted the requirement for companies to either possess the source code of critical third-party applications or secure it under an escrow arrangement, enabling better oversight of vendor-operated software. According to Srinivas, many security breaches in the payments sector originate from vendor software rather than internal systems, making source code access, regular audits, and board-level governance essential.
The guidelines also mandate every PSO to submit an annual system audit report within two months of the close of the financial year. Additionally, the existing 12-hour cooling-off period following any change in a customer’s registered mobile number or email address has been retained to prevent unauthorised transactions and account misuse immediately after contact details are modified.
Industry Backs Faster Incident Reporting
Industry executives view the six-hour reporting mandate as a major shift toward proactive cyber defence. Ravi Prakash, Founder and Chief Executive Officer of Apollo Infoways, said cybersecurity can no longer remain restricted to post-incident reactions or routine compliance, adding that firms must build continuous monitoring and rapid response capabilities to protect India’s digital financial infrastructure.
Subhasis Majumdar, Chief Executive Officer of Nerix Technoserve, observed that the strict six-hour deadline will compel payment operators to invest further in monitoring and incident management systems. Analysts believe timely reporting will enable regulators to assess emerging threats, monitor affected systems, and intervene before technical glitches or cyberattacks spill over to other financial institutions.
Disaster Recovery Norms and Compliance Timelines
To ensure business continuity, the RBI has directed payment companies to establish disaster recovery facilities in a seismic zone distinct from their primary data centres. Operators are also required to conduct recovery drills at least twice a year so that critical payment services can be restored swiftly during major technical outages, natural disasters, or cyberattacks.
While the new rules have already come into effect for large and medium-sized payment system operators, smaller operators have been granted time until April 1, 2028, to achieve full compliance. Experts noted that safeguarding India’s vast digital payments ecosystem depends on every participating entity enforcing strong security protocols, with the real impact of the six-hour reporting rule resting on technical readiness and effective implementation.
