The Reserve Bank of India has issued master directions on cyber resilience and digital payment security controls for non-bank payment system operators, effective November 2026. The framework mandates robust cyber risk management, incident reporting, and system audits.
RBI Issues Cyber Resilience Directions for Payment Operators
The Reserve Bank of India (RBI) issued Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators (PSOs) on November 7, 2026. These directions aim to strengthen the cybersecurity posture of entities operating in India’s digital payments ecosystem.
The framework mandates PSOs to establish a Board-approved cyber resilience policy, implement secure by design principles, conduct regular penetration testing, and ensure real-time monitoring of networks. Critical systems must adhere to defined availability, integrity, and confidentiality standards. PSOs are also required to report significant cyber incidents to the RBI within six hours of detection.
Implications for practitioners: Legal advisors must ensure compliance of client PSOs with these binding directions, particularly in drafting cybersecurity policies, incident response plans, and third-party audit mechanisms. Non-compliance may attract supervisory action under the Payment and Settlement Systems Act, 2007.
