RBI Cyber Resilience and Digital Payment Security Controls Master Directions 2026 for Non-Bank Payment System Operators
RBI’s Master Directions of 5 November 2026 give non-bank payment operators one cyber-security rulebook. They carry over the 2024 controls, add system-audit and ATM-switch-provider rules, and bring large and medium operators in from the day of placement on RBI’s website. Small operators follow on 1 April 2028.
Take Kaveri Pay Services, an invented payment aggregator with an April to March financial year. At 2:20 pm on a working day its core payment switch goes down. What do the Directions ask of it?
| Which timeline? | Payment aggregators are listed as large operators, so the Directions apply from the day they are placed on RBI’s website (para 3 and footnote 1) |
|---|---|
| The outage | An outage of a critical system is a reportable “unusual incident”. Report to RBI in the Incident Reporting Format within 6 hours of detection, so by 8:20 pm if detected at 2:20 pm (para 22(d)); cyber incidents also go to CERT-In |
| The yearly audit | For the year ending 31 March 2027 the System Audit Report is due by 1 June 2027 (para 36) |
| The auditor | The firm, or a sister concern, must not have served Kaveri in the last two financial years (para 37) |
What are these Directions, and why were they issued?
The Directions are issued under Section 10(2) read with Section 18 of the Payment and Settlement Systems Act, 2007. RBI states that safety and security of payment systems is a key objective and that operators should be resilient to emerging cyber risks.
RBI first issued Master Directions on this subject on 30 July 2024 (RBI/DPSS/2024-25/123). The 5 November 2026 text (RBI/DPSS/2026-27/475) is, in RBI’s words, meant to give “a single reference point”. It consolidates two earlier sets of directions (ATM switch provider controls of 2019, system audit of 2020).
Payment System Operator (PSO)
A non-bank company authorised by RBI to run a payment system.
PPI issuer
Issuer of prepaid payment instruments such as digital wallets and prepaid cards.
System Audit Report (SAR)
An annual report by a qualified outside auditor on the operator’s IT systems and controls.
CERT-In
The Indian Computer Emergency Response Team, which also receives cyber incident reports.
What is new compared with the 2024 Directions?
Sections II to IV of the 2026 text (governance, baseline controls, digital payment controls) match the 2024 text, apart from footnote numbering and small wording changes. The new material sits in three places.
2024 DIRECTIONS
Large 1 April 2025, medium 1 April 2026, small 1 April 2028. A PPI issuer moving up a category had two or one year(s).
2026 DIRECTIONS
Large and medium: from the day placed on RBI’s website. Small: 1 April 2028. A PPI issuer moving up gets one year.
- System audit (Section V, paras 36 to 41). The annual report, auditor rules and a 20-item audit scope now sit in one place.
- ATM switch providers (Section VI, paras 42 to 57). A WLAO’s contract with the switch provider must require these controls and give RBI supervisory access.
- Wider ecosystem. Unregulated partners brought in by agreement now include third-party ATM Switch providers (para 5).
Who is covered, and from when?
The Directions apply to all authorised non-bank PSOs. The footnotes sort them by size.
| Size | Named in the Directions | In force from |
|---|---|---|
| Large | CCIL, NPCI, NPCI Bharat Bill Pay, card networks, non-bank ATM networks, White Label ATM Operators (WLAOs), large PPI issuers, TReDS operators, BBPOUs, payment aggregators | Day placed on RBI’s website |
| Medium | In-bound cross-border money transfer operators (MTSS), medium PPI issuers | Day placed on RBI’s website |
| Small | Small PPI issuers, instant money transfer operators | 1 April 2028 |
PPI issuers are sorted by RBI’s Oversight Framework. A small issuer that moves up to medium or large must comply within one year of the new categorisation.
How did the dates move?
-
30 July 20242024 text
First Master Directions: large operators due 1 April 2025, medium 1 April 2026.
-
5 November 2026date of the letter
Consolidated Master Direction issued; in force for large and medium operators once placed on RBI’s website.
-
Every yearpara 36
System Audit Report within two months of year end.
-
1 April 2028para 3
Small non-bank PSOs come under the Directions.
What do the main duties look like?
The Board owns the risk (para 7) and approves a yearly-reviewed Information Security policy and a separate Cyber Crisis Management Plan (paras 8, 9). Baseline controls include multi-factor authentication for privileged accounts, yearly security testing, half-yearly disaster recovery drills and five-year audit logs (paras 15 to 27). The system audit must be done by a CERT-In empanelled auditor, a CISA registered with ISACA, or an ICAI DISA holder (para 36). The report goes to the Board, and each open observation needs corrective action within a maximum of 3 months, reported to RBI (para 41).
Which earlier directions does it repeal?
Paragraph 58 lists six circulars as repealed. Two are the ones the covering letter says are consolidated.
| Date | Subject |
|---|---|
| 7 Dec 2009, 27 Dec 2010, 15 Apr 2011, 14 Jun 2011 | Four earlier system-audit circulars (system audit under the PSS Act, 2007; submission of audit reports from CISA qualified auditors) |
| 31 Dec 2019 | Cyber Security Controls for Third Party ATM Switch Application Service Providers |
| 10 Jan 2020 | System Audit of Payment Systems operated under the PSS Act, 2007: Review of Scope and Coverage |
The 2024 Master Directions are not in that list. Our reading: as the letter calls the 2026 text the single reference point, firms should work from it. Existing card, PPI and mobile banking security instructions continue, and where they differ the Master Direction prevails (letter, para 3).
What should operators do now?
- Large and medium operators: map today’s controls to the 2026 text and check the audit scope against the 20 areas in para 38.
- Test the 6-hour escalation path, with CERT-In alongside.
- WLAOs: review switch-provider contracts against Section VI.
- Small operators: plan to 1 April 2028.
Legal basis
- Power used
- Section 10(2) read with Section 18, Payment and Settlement Systems Act, 2007 (Act 51 of 2007)
- Instrument
- RBI/DPSS/2026-27/475, CO.DPSS.CSD.No.S825/01-01-078/2026-2027, 5 November 2026
- Repeals
- Six circulars listed in paragraph 58
Key facts
| Authority | Reserve Bank of India (RBI), Department of Payment and Settlement Systems |
|---|---|
| Instrument | Master Directions, Cyber Resilience and Digital Payment Security Controls |
| Reference | RBI/DPSS/2026-27/475 |
| Issue date | 5 November 2026 |
| Effective date | Large and medium non-bank PSOs: day placed on RBI website. Small: 1 April 2028 |
| Incident reporting | To RBI within 6 hours of detection; cyber incidents also to CERT-In |
| Last verified | 6 November 2026, against the RBI Master Directions pages (see Sources) |
Frequently asked questions
Does this apply to payment aggregators and PPI issuers?
Yes. The Directions apply to all authorised non-bank PSOs. Payment aggregators and large PPI issuers are large operators; medium and small PPI issuers are medium and small.
How fast must an incident be reported?
Unusual incidents such as cyber-attacks, critical system outage, internal fraud or settlement delay, within 6 hours of detection (para 22(d)). Cyber incidents also go to CERT-In.
When is the system audit report due?
Within two months of financial-year end: by 1 June for April to March entities, and by 1 March of the following year for calendar-year entities (para 36).
Do the 2024 Master Directions still matter?
The 2026 text carries the 2024 controls forward and calls itself the single reference point.
Sources (official)
- RBI Master Directions page: Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators, RBI/DPSS/2026-27/475, 5 November 2026 https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=13751
- RBI Master Directions page: same title, RBI/DPSS/2024-25/123, 30 July 2024 https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=12715
- RBI
- Banking Regulations
- Payments
- Cyber Security
- Payment System Operators
- System Audit
Want to track India banking changes as they are issued? Book a demo.