RBI consolidates cyber rules for non-bank payment operators, with source code and audit mandates

The Reserve Bank of India on 5 November 2026 issued consolidated Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank payment system operators, published on the RBI website and reported the same day by Business Standard. The Directions apply to authorised non-bank PSOs including NPCI, card networks, payment aggregators, prepaid payment instrument issuers and white-label ATM operators. They take effect immediately for large and medium PSOs. Small PSOs have until 1 April 2028.

Business Standard, citing the notification, said PSOs must obtain the source code of critical applications bought from third-party vendors, or put an escrow arrangement in place so services can continue if the vendor fails. Where a PSO does not own the code, it must get a developer certificate that the application is free of vulnerabilities, malware and covert channels, and renew that certificate after every change. Critical patches for well-known or reported attacks must be applied immediately.

Annual system audit reports must be filed within two months of the financial year end, which means by 1 June for entities on an April to March year. Auditors and their sister concerns must not have provided any service to the entity in the previous two financial years, and open audit observations must be fixed within a maximum of three months. White-label ATM operators that use shared ATM switch services must contractually bind those providers to cyber controls and to RBI access for on-site or off-site supervision, including blocking remote and potential backdoor connections.

The Directions keep the six-hour cyber incident reporting window to RBI for attacks, critical outages, internal fraud and settlement delays, and a minimum 12-hour cooling-off period after a customer changes a registered mobile number or email before online payment transactions are allowed. RBI said the 2026 Master Directions consolidate the July 2024 cyber framework with earlier instructions on third-party ATM switch providers and system audits of payment systems, giving operators a single rulebook as AI-linked payment risks rise.