RBI has issued comprehensive Master Directions on cyber resilience and digital payment security for authorised non-bank payment system operators, aiming to strengthen payment system safety.
Master Directions on Cyber Resilience for Non-Bank PSOs
The Reserve Bank of India (RBI) issued Master Directions on November 5, 2026, titled 'Cyber Resilience and Digital Payment Security Controls for Non-Bank Payment System Operators' (Notification No. RBI/DPSS/2026-27/475). These directions are designed to enhance the safety and security of digital payment systems operated by non-bank entities, reinforcing the resilience of India’s financial infrastructure.
The framework mandates standardised controls across cyber governance, risk assessment, secure system design, incident response, and third-party oversight. Operators are required to implement robust encryption, real-time monitoring, periodic audits, and employee training programmes. The directions also prescribe reporting timelines for cybersecurity incidents to the RBI, ensuring rapid regulatory response. Compliance is to be certified annually by designated senior management officials.
For legal practitioners advising fintech firms or payment operators, these directions form a binding compliance framework. Non-adherence may lead to supervisory action under Section 18 of the Payment and Settlement Systems Act, 2007. Lawyers should conduct gap analyses of their clients’ current practices against the new standards and recommend governance reforms to avoid regulatory penalties.
