Mumbai: The Reserve Bank of India (RBI) has consolidated its cybersecurity regulations for non-bank payment system operators, introducing stricter safeguards for digital transactions, fraud monitoring, mobile payments and the reporting of cyber incidents.

In its Master Directions issued on November 5, 2026, the central bank prescribed a six-hour deadline for reporting specified cyber incidents and operational disruptions. It also introduced a minimum 12-hour cooling period for online payments after customers change the mobile number or email address linked to their payment instruments.

The revised framework aims to strengthen the security and resilience of India’s digital payment ecosystem as online transactions become increasingly important to consumers and businesses.

The directions apply to all authorised non-bank payment system operators (PSOs), including payment aggregators, prepaid payment instrument issuers, card networks and non-bank ATM operators. Large and medium-sized operators must comply from the date the directions were published on the RBI website, while small operators have until April 1, 2028.

Six-hour deadline for reporting cyber incidents

One of the significant requirements in the new framework is the six-hour reporting deadline for unusual incidents.

Non-bank payment operators must report events such as cyberattacks, outages involving critical systems or infrastructure, internal fraud and settlement delays to the RBI within six hours of detection.

The reporting requirement is intended to help the regulator receive timely information about disruptions that could affect payment services and customer funds.

Payment operators must also report cybersecurity incidents to the Indian Computer Emergency Response Team (CERT-In). They are expected to maintain incident-response arrangements covering detection, containment, investigation and recovery.

The RBI has also called for post-incident analysis, including forensic examination wherever necessary, to identify the cause of an incident and prevent similar problems from recurring.

12-hour cooling period after mobile number or email changes

The RBI has introduced an additional safeguard against fraud involving changes to customers’ registered contact details.

Whenever a mobile number or email address linked to a payment instrument is changed, the payment operator must enforce a minimum cooling period of 12 hours before allowing online transactions through the relevant channels.

The measure is intended to reduce the risk of criminals taking control of payment accounts after changing a customer’s registered contact information.

For example, if a fraudster gains access to an account and attempts to replace the registered mobile number or email address, the cooling period creates a delay before online payments can resume through the affected payment instrument.

The directions also require payment operators providing mobile payment services to implement device binding or device fingerprinting. This links the payment application to the customer’s device and SIM.

Applications must automatically terminate inactive sessions and require customers to log in again. Operators must also establish controls to identify remote-access applications and prevent access to mobile payment services while such applications are active, wherever technically possible.

Multi-factor authentication and real-time fraud monitoring

The RBI has reinforced authentication requirements for electronic payments.

Payment operators must ensure that electronic transactions involving debits to bank accounts, debit cards, credit cards and prepaid payment instruments are validated through multi-factor authentication, except where specific regulatory exemptions or relaxations apply.

The framework also requires real-time or near-real-time fraud monitoring systems to identify suspicious transaction patterns and generate alerts.

Operators must establish round-the-clock facilities to handle complaints involving unauthorised or fraudulent transactions. These facilities should also enable prompt responses to requests from law enforcement agencies.

The RBI has prescribed additional monitoring mechanisms for payment participants. Alerts may be based on factors such as repeated failed transactions, unusual transaction frequency, changes in account activity, geographical location, IP addresses, behavioural patterns and transactions involving identifiers associated with reported fraud.

Customers must also have a facility on the payment operator’s website or mobile application to identify and report fraudulent transactions, enabling immediate notification to the relevant payment instrument issuer.

Stronger responsibility for boards and senior management

The new directions place cybersecurity oversight firmly within the responsibility of the board of directors.

Every authorised payment operator must have a board-approved Information Security Policy covering its applications, products, systems and information-security risks. The policy must be reviewed annually.

A board-level committee may be assigned primary oversight of cybersecurity and technology risks. The committee must be headed by a member with relevant information-security or cybersecurity experience and meet at least once every quarter.

The RBI has also asked operators to prepare a separate Cyber Crisis Management Plan. It should explain how the organisation will detect, contain, respond to and recover from cyber threats and attacks.

A senior executive with cybersecurity expertise, such as a Chief Information Security Officer, must be made responsible for implementing the information-security policy and continuously assessing the organisation’s security position.

These requirements make cybersecurity a board-level governance issue rather than a responsibility limited to technical teams.

Disaster recovery and data protection requirements

The framework also strengthens business continuity and disaster recovery arrangements.

Payment operators must maintain a business continuity plan covering different cyberattack scenarios, including severe but plausible disruptions. The plan must be reviewed at least once a year.

The RBI has directed operators to establish disaster recovery facilities in a different seismic zone from their primary data centres. This is intended to reduce the risk of both facilities being affected by the same geographical disaster.

Disaster recovery drills must be conducted at least twice a year. Operators must also work towards achieving a near-zero Recovery Point Objective, which measures the amount of data that could be lost following a disruption.

Data security requirements include encryption of information in transit and at rest, controls to prevent data leakage and safeguards for personally identifiable information.

Payment operators must preserve audit logs for at least five years. These records should help identify the user who initiated an action, the action performed and the relevant parameters.

Annual system audits and vendor security

The RBI has also consolidated requirements relating to system audits of authorised payment operators.

Entities must submit their annual System Audit Report within two months of the end of their financial year. The audit must be conducted by eligible professionals, including CERT-In-empanelled auditors, qualified Certified Information Systems Auditors or holders of the relevant ICAI information systems audit qualification.

The audit must examine areas such as information-security governance, access controls, network security, data protection, business continuity, vendor management, incident response and security testing.

Any open audit observations must be addressed through time-bound corrective action, with the prescribed period capped at three months. The audit findings and compliance status must also be placed before the entity’s board.

The directions extend cybersecurity expectations to third-party service providers involved in payment operations. Operators must establish appropriate contractual and organisational arrangements to manage risks arising from vendors, payment gateways and other external technology partners.

Which payment companies must comply and when?

The revised framework covers all authorised non-bank payment system operators. The RBI has provided different implementation timelines based on the size of the operator.

  • Large non-bank PSOs: Directions effective from November 5, 2026, when published on the RBI website.
  • Medium non-bank PSOs: Directions effective from November 5, 2026.
  • Small non-bank PSOs: Compliance required from April 1, 2028.

The RBI has consolidated its earlier cybersecurity directions, including instructions relating to third-party ATM switch application service providers and the scope of system audits. Existing instructions governing security and risk mitigation for card payments, prepaid payment instruments and mobile banking continue to apply. Where there is a discrepancy in applicability, the new Master Direction will prevail.

What the new RBI rules mean for digital payments

The revised framework comes at a time when digital payment services are widely used for everyday purchases, money transfers and business transactions. Payment operators increasingly depend on mobile applications, technology vendors, cloud infrastructure and interconnected systems, making cybersecurity an important part of financial stability.

The six-hour incident-reporting requirement, 12-hour cooling period after contact-detail changes, multi-factor authentication and real-time fraud monitoring are intended to strengthen protection against digital payment risks.

For payment companies, the directions mean greater responsibility for technology security, vendor oversight, audits and business continuity. For customers, the measures add safeguards around account access and suspicious transactions, although they cannot eliminate every form of online fraud.

By bringing multiple instructions into a consolidated framework, the RBI is seeking to establish more consistent cybersecurity standards across India’s non-bank payment sector.