NEW DELHI, NOVEMBER 15, 2026 : The Reserve Bank of India’s (RBI) stricter cybersecurity framework for non-bank payment operators is expected to strengthen digital payment security, improve incident response and help curb the growing threat of online financial fraud, industry experts have said.
Under the revised guidelines, non-bank Payment System Operators (PSOs) must report unusual incidents, including cyberattacks, critical system outages and settlement delays, to the RBI within six hours of detection. The framework also requires cybersecurity incidents to be reported to CERT-In within the stipulated six-hour window.
The move aims to ensure faster regulatory intervention, improve threat monitoring and strengthen the resilience of India’s rapidly expanding digital payments ecosystem.
🔐 WHO WILL BE COVERED?
The revised Master Directions on Cyber Resilience and Digital Payment Security Controls apply to a wide range of non-bank payment operators, including:
- National Payments Corporation of India (NPCI)
- Card networks
- Payment aggregators
- Prepaid Payment Instrument (PPI) issuers
- White-label ATM operators (WLAOs)
The RBI has introduced tighter safeguards covering digital transactions, software security, system audits and third-party service providers.
⚠️ SIX-HOUR REPORTING: A MAJOR COMPLIANCE SHIFT
Cybersecurity experts say the mandatory reporting window will push payment operators to detect threats earlier, strengthen internal monitoring and respond to incidents more quickly.
Srinivas L, Joint Managing Director and CEO of 63SATS Cybertech, said the RBI had consolidated earlier circulars into a clearer regulatory framework.
He highlighted the requirement concerning source code for critical third-party applications, which operators must hold or protect through an escrow arrangement.
According to him, security breaches can originate in external vendors’ software, making stronger oversight of third-party technology essential. He also welcomed annual system audits, incident reporting requirements and mobile-device binding measures.
📱 12-HOUR COOLING-OFF PERIOD RETAINED
The RBI has retained a mandatory 12-hour cooling-off period after a customer changes their registered mobile number or email address.
The measure is intended to add a layer of protection against potential misuse of updated contact details, which can be exploited in account-related fraud.
Payment System Operators must also submit an annual system audit report within two months of the end of their financial year.
🛡️ STRONGER DISASTER RECOVERY AND BUSINESS CONTINUITY
The revised framework also strengthens business continuity requirements for payment operators.
Key safeguards include:
- Maintaining disaster recovery facilities in a different seismic zone from the primary data centre.
- Conducting disaster recovery drills at least twice a year.
- Strengthening cybersecurity monitoring and incident-response capabilities.
- Improving oversight of third-party technology and service providers.
These measures are designed to help payment infrastructure withstand cyberattacks, technical failures and other disruptions while maintaining essential services.
📅 COMPLIANCE DEADLINE FOR SMALL OPERATORS
According to the report, the revised requirements are already in effect for large and medium-sized Payment System Operators. Small PSOs have been given until April 1, 2028, to comply.
Ravi Prakash, founder and CEO of Apollo Infoways, said the six-hour reporting requirement signalled a shift away from treating cybersecurity as merely a reactive compliance function.
Subhasis Majumdar, CEO of Nerix Technoserve, said the rules would encourage payment operators to invest in stronger monitoring, incident response and risk-management systems.
🇮🇳 TOWARDS A MORE RESILIENT DIGITAL PAYMENTS ECOSYSTEM
India’s expanding digital payments infrastructure requires robust protection against increasingly sophisticated cyber threats. The RBI’s revised framework seeks to strengthen accountability across the payment system by combining faster incident reporting with stricter security audits, vendor oversight and disaster recovery planning.
As experts emphasise, regulatory compliance is only the starting point. Sustained investment in cybersecurity, early threat detection and operational resilience will be essential to protecting consumers and maintaining confidence in digital transactions.
Truth Prevail | Bringing You the Headlines That Matter!
