Follow us on Google News
The Reserve Bank of India (RBI) has issued a consolidated cybersecurity framework for non-bank payment system operators, bringing requirements for software security, independent audits, cyberattack reporting and third-party technology providers under a single regulatory document.
The Master Directions, issued on November 5, 2026, apply to authorised non-bank payment system operators, including payment aggregators, card networks, prepaid payment instrument issuers and white-label ATM operators.
The framework takes effect immediately for large and medium operators. Smaller operators have until April 1, 2028, to comply.
The central bank has combined its July 2024 cybersecurity directions with earlier instructions governing payment-system audits and third-party ATM switch services.
While several requirements already existed, their consolidation creates a single reference point for companies responsible for processing and supporting digital payments.
Payment Operators Must Secure Third-Party Software
One of the key provisions concerns software supplied by outside technology vendors.
Payment system operators must obtain the source code of critical applications purchased from third parties. Where obtaining the code is not possible, they must establish an escrow arrangement.
Source code contains the instructions used to build and operate software. An escrow arrangement allows access to those instructions under agreed conditions, helping maintain services if a vendor becomes unable to support its product.
The directions also require payment operators to obtain certification from developers when they do not own an application’s source code.
The certificate must state that the software is free of known vulnerabilities, malware and concealed communication channels. A fresh certificate is required after changes to the code.
These safeguards are intended to reduce dependence on external suppliers whose software may be difficult for payment operators to inspect or maintain.
However, certification alone cannot guarantee that software will remain free of vulnerabilities. Newly discovered weaknesses, configuration errors and compromised credentials can still create security risks.
The framework therefore also requires regular security testing, including vulnerability assessments, penetration testing and source-code reviews.
Operators must have mechanisms to apply critical security patches immediately when those updates address known or reported attacks.
The requirements extend to unregulated technology providers connected to the payments ecosystem, subject to mutual agreements.
These may include payment gateways, vendors and other third-party service providers whose systems interact with regulated payment infrastructure.
Annual System Audits Bring Independent Scrutiny
The consolidated directions also establish detailed requirements for system audits.
Authorised payment operators must conduct annual audits and submit reports to the RBI within two months of the end of their financial year.
For organisations following the April-to-March accounting cycle, this generally means submission by June 1.
The audit must examine whether the operator’s systems, security controls and processes meet applicable regulatory expectations.
The RBI has introduced safeguards intended to protect auditor independence.
An auditor, including its sister concerns, must not have provided other services to the payment operator during the preceding two financial years.
This requirement aims to reduce conflicts of interest that could arise when a firm evaluates systems it previously developed, managed or advised on.
Auditors must also identify deviations from the processes originally submitted to the RBI when the operator sought authorisation.
Unresolved observations must be addressed within a maximum period of three months.
These provisions create a mechanism for identifying security weaknesses and ensuring that operators take corrective action rather than merely documenting the problems.
The directions also place responsibility on company boards to oversee cybersecurity risks and maintain approved information-security policies.
Payment operators must assess risks when introducing new products, services or major technology changes.
ATM Technology Providers Face Tighter Oversight
Another significant part of the framework concerns third-party ATM switch application service providers.
An ATM switch is a technology system that routes transaction requests between automated teller machines, banks and payment networks.
White-label ATM operators that depend on shared switch services must ensure that their technology providers follow prescribed cybersecurity controls.
The operators must include appropriate obligations in their contracts with these providers.
The RBI also requires arrangements that allow regulators to conduct on-site and off-site supervision of outsourced switch infrastructure.
The safeguards include restrictions on remote connections from external machines and measures to prevent unauthorised backdoor access.
Third-party providers must also maintain controls covering system configuration, user access, software security, vulnerability testing and incident response.
The rules reflect a broader concern that security weaknesses may arise outside the organisation directly responsible for providing a payment service.
A compromised vendor or connected infrastructure provider can potentially expose several financial institutions or payment services to the same threat.
Consequently, cybersecurity oversight must extend beyond a payment operator’s own employees and servers.
Six-Hour Reporting And Customer Safeguards Retained
The consolidated framework retains the requirement for payment operators to report specified cybersecurity incidents to the RBI within six hours of detection.
Reportable incidents include cyberattacks, disruptions affecting critical systems, internal fraud and certain payment-settlement failures.
Relevant cybersecurity incidents must also be reported to CERT-In in accordance with applicable requirements.
The six-hour deadline is not a new reporting obligation introduced on November 5. It forms part of existing security requirements brought together in the updated directions.
The framework also retains a minimum 12-hour cooling-off period before online payments can be made following changes to a customer’s registered mobile number or email address linked to a payment instrument.
This safeguard is designed to make it harder for criminals to immediately exploit unauthorised changes to customer contact details.
Operators must also facilitate monitoring for suspicious transaction patterns, including unusual transaction speeds, geographical anomalies and activity associated with known fraud indicators.
Additional protections cover access to payment applications when remote-access software is active, secure customer notifications and stronger authentication.
These measures are particularly relevant as fraudsters increasingly target payment systems through compromised software, stolen credentials and weaknesses in connected technology infrastructure.
The directions do not announce changes to UPI transaction limits or require ordinary customers to register for a new payment service.
Instead, they strengthen the regulatory framework governing companies and technology providers that operate essential parts of India’s digital payment infrastructure.
What This Means For You:
Customers should continue monitoring transaction alerts and report unauthorised payments promptly. Payment companies must ensure that their own systems and outsourced technology providers meet applicable security requirements, rather than treating cybersecurity as solely a vendor responsibility.
