The Reserve Bank of India issued a comprehensive Master Direction on November 5, 2026 (RBI/DPSS/2026-27/475), consolidating and updating rules on cyber resilience and digital payment security controls for authorised non-bank Payment System Operators (PSOs). This document replaces and unifies earlier guidance, including the July 30, 2024 Master Directions and subsequent circulars on system audits and third-party ATM switch providers, creating a single, authoritative reference for the sector.
Safety and security of payment systems remain a core RBI objective. Non-bank PSOs—including the National Payments Corporation of India (NPCI), card networks, payment aggregators, prepaid payment instrument issuers, white-label ATM operators, and others—face rising information-system and cyber risks. The 2026 Directions respond by requiring these entities to build resilience against both existing and emerging threats while ensuring the confidentiality, integrity, and availability of payment data and systems.
The Directions take effect immediately for large and medium non-bank PSOs upon placement on the RBI website. Small non-bank PSOs receive a longer transition window until April 1, 2028. This calibrated timeline balances the need for prompt strengthening of critical players with practical preparation time for smaller operators. Applicability covers the entire digital payment ecosystem of these PSOs, including payment gateways and third-party arrangements.
Governance sits at the foundation. Boards (or designated sub-committees) must actively oversee information security and cyber resilience. They are required to approve a formal Information Security policy and a Cyber Crisis Management Plan. These documents establish clear accountability, risk appetite, and response protocols, elevating cyber issues from operational concerns to board-level strategic priorities.
Risk identification, assessment, monitoring, and management form another central pillar. PSOs must maintain comprehensive inventories of critical assets and their interconnections, with special attention to end-of-life systems. Continuous monitoring, vulnerability assessments, penetration testing, configuration reviews, and source-code reviews are mandated to detect weaknesses before they can be exploited.
A major operational requirement is the annual System Audit Report. Large and medium PSOs must submit the report within two months of the close of their financial year (by June 1 for April–March entities). Auditors must be independent: neither they nor their sister concerns may have provided any services to the entity in the preceding two financial years. Open observations from prior audits must be tracked, and corrective actions for each must be time-bound (maximum three months) and reported to RBI. Observations close only after formal auditor acceptance. The Board must review both the SAR and compliance status.
Source-code control receives explicit attention. PSOs must obtain the source code of all critical applications procured from third-party vendors. Where this is not feasible, a formal escrow arrangement is required to ensure continuity of services if the vendor relationship ends or the vendor fails. This measure reduces dependence risk and supports forensic and recovery capabilities after incidents.
Third-party ATM Switch Application Service Providers face dedicated controls. White-label ATM Operators that rely on shared ATM-switch services must contractually bind these providers to ongoing cyber-security obligations and grant RBI access for on-site or off-site supervision. Contracts must embed continuous compliance expectations rather than one-time assurances.
Baseline security measures span technical, process, and organisational domains. These include secure system development and maintenance practices, real-time or near-real-time fraud monitoring, data-leak prevention policies covering both transit and rest states, 24×7 incident-response capability, and prompt reporting of cyber incidents, critical outages, internal fraud, or settlement delays to RBI and CERT-In. Online systems security assessments specifically address payment information processing systems and APIs.
Collectively, the 2026 Master Directions represent a maturation of India’s regulatory approach to digital payments. By consolidating fragmented guidance into a coherent framework, introducing stricter independence and accountability requirements for audits, and extending oversight to third-party infrastructure providers, RBI aims to raise the cyber-resilience baseline across the non-bank payment landscape. In an environment of growing transaction volumes and sophisticated threats—including those amplified by artificial intelligence—the Directions seek to protect the integrity of India’s rapidly expanding digital payment rails while preserving innovation and public trust.