Non-bank payment system operators will have just six hours to report cyberattacks, critical infrastructure outages, internal fraud and settlement delays to the Reserve Bank of India (RBI) under a new cybersecurity framework.
The central bank has also introduced a 12-hour cooling period for online transactions after customers change the mobile number or email ID linked to their payment instruments.
-
Indian Markets Turning Corner After Two Tough Years, Says Sandeep Tandon -
NDTV Profit Ignite 2026: Experts See Opportunity In Equities, Stay Bullish For Long-Term -
Buy Right, Sit Tight Does Not Work for Individual Stocks, Says Dinshaw Irani -
'Worst Is Behind': Quant MF Sees Market Bottom, Flags 'Extreme Euphoria' In Midcaps -
India's Mutual Fund Industry Could Become A $1 Trillion Opportunity, Say Fund Managers -
'Foreign Investors Are Baraatis': Raamdeo Agrawal's Take On LTCG Tax -
Stay Invested Through Market Cycles: Raamdeo Agrawal at NDTV Profit Ignite -
Ramesh Damani Remains Bullish On India For Next 20-30 Years, Sees Bargains Amid Market Weakness -
CAS Came After A Long Consultation Process: SEBI Chairman Tuhin Kanta Pandey AT NDTV PROFIT IGNITE -
Aim To Cut FPI Onboarding Time From Mth To Five Days: SEBI Chairman Tuhin Kanta Pandey AT NDTV PROFI
The requirements form part of a consolidated Master Direction dated November 5, 2026, covering cyber resilience and digital payment security controls for non-bank payment system operators (PSOs).
RBI has combined its earlier instructions on cybersecurity controls for third-party ATM switch application service providers and system audits of payment systems into a single regulatory framework.
The directions cover all authorised non-bank PSOs, including payment aggregators, prepaid payment instrument (PPI) issuers, card networks, non-bank ATM networks and white-label ATM operators.
Large and medium operators must comply from the date the directions are published on RBI's website. Small non-bank PSOs have until April 1, 2028, to meet the requirements.
Six-Hour Reporting Deadline And Mobile Payment Safeguards
The six-hour reporting window places a tighter timeline on operators to identify, assess and escalate serious disruptions. They must also report cybersecurity incidents to the Indian Computer Emergency Response Team (CERT-In).
The RBI has separately focused on risks associated with mobile payments. Operators must introduce device binding, automatically end inactive sessions and detect or block remote-access applications while payment services are in use.
Customers will also receive an additional safeguard when they update their registered mobile number or email ID. Operators must enforce a minimum 12-hour cooling period before allowing online transactions linked to the payment instrument.
Fraud monitoring requirements will also become more demanding. Operators must implement multi-factor authentication for electronic transactions and establish real-time or near-real-time systems to detect suspicious activity.
They must maintain round-the-clock facilities to handle customer complaints involving unauthorised transactions and preserve audit logs for at least five years.
Also Read | SEBI Eases Currency Derivatives Rules, Sets $5 Million Limit
Board-Level Oversight And Disaster Recovery Requirements
Beyond transaction security, the framework places responsibility for cybersecurity oversight at the board level. Operators must have board-approved information security policies, conduct regular risk assessments and maintain a Cyber Crisis Management Plan.
A board-level committee responsible for technology risks must meet at least once every quarter. A senior executive with cybersecurity expertise will oversee implementation of the security framework.
The RBI has also prescribed stricter business continuity arrangements. Operators must maintain disaster recovery facilities in a different seismic zone from their primary data centres and conduct recovery drills at least twice a year.
They must work towards achieving near-zero Recovery Point Objectives, which measure the amount of data that could be lost following a disruption.
Annual system audit reports must be submitted within two months of the financial year-end. Operators must also address open audit observations within specified timelines, with corrective action periods capped at three months.
Also Read | RBI To Set Up Financial Markets Committee, To Focus On Critical Policy And Operational Matters
Essential Business Intelligence, Sharp Market Insights, Practical Personal Finance Advice, Daily Fuel, Gold and Silver Prices and Latest Stories — On NDTV Profit.