RBI Issues Consolidated Cyber Security Rulebook for Non-Bank Payment Operators, Mandates Annual Audit Filings by June 1

The Reserve Bank of India (RBI) has issued a consolidated regulatory framework tightening cyber resilience and digital payment security controls for non-bank payment system operators (PSOs). Issued under Section 10(2) read with Section 18 of the Payment and Settlement Systems Act, 2007, the Reserve Bank of India (Cyber Resilience and Digital Payment Security Controls for non-bank PSOs) Master Directions, 2026 brings independent system audits, source code escrow requirements, third-party software risks, and shared ATM infrastructure oversight under a single directive.

The move consolidates previous instructions issued on July 30, 2024, alongside historic circulars concerning payment system audits and third-party ATM switch service providers, repealing six older regulatory notifications dating back to 2009.

The directions take effect immediately for large and medium non-bank PSOs, while smaller operators have been granted a transition runway until April 1, 2028, to achieve full compliance.

Entities Covered Under the New Framework

The consolidated Master Directions apply across authorized non-bank payment intermediaries and infrastructure entities operating in India's digital payment ecosystem. Key covered entities include:

• The National Payments Corporation of India (NPCI)
• Authorized card payment networks (such as Visa, Mastercard, and RuPay)
• Payment Aggregators (PAs) and payment gateways
• Prepaid Payment Instrument (PPI) issuers
• White-Label ATM Operators (WLAOs)

Strict Deadlines for System Audits and Observations

A core pillar of the updated directions is the introduction of a rigid system audit timeline designed to remove delays in regulatory reporting.

Authorized PSOs must commission an annual system audit covering the design and operating effectiveness of governance, access controls, incident response mechanisms, and business continuity setups. The System Audit Report (SAR) must be submitted to the RBI within two months of the close of the financial year. For entities observing an April-to-March financial year, this sets a hard deadline of June 1.

To eliminate conflicts of interest, the regulator mandated that the certifying auditor—including any of its sister concerns or network affiliates—must not have provided any other service to the entity during the preceding two financial years. Furthermore, any open observations, deficiencies, or gaps identified during the audit must be resolved and remediated within a maximum window of three months. Auditors are also tasked with verifying whether the entity’s existing architecture deviates from the process flows submitted when seeking original RBI authorization.

Mandatory Source Code Escrow and Vendor Scrutiny

Addressing growing vulnerabilities in third-party supply chains, the RBI has mandated that non-bank PSOs must obtain the complete source code for critical applications acquired from external technology vendors.

Where procuring direct ownership of the source code is unfeasible, entities must formally establish an escrow arrangement to guarantee continuous access and maintain operations if the vendor defaults or ceases operations. In cases where PSOs do not hold the underlying code, they must secure explicit developer certifications affirming that the application is free of known vulnerabilities, malicious software, and backdoor communication channels. A fresh verification certificate will be mandatory following every subsequent code update or patch.

Oversight of ATM Switches and Incident Reporting

The framework also brings third-party ATM Switch Application Service Providers engaged by White Label ATM Operators under direct regulatory scrutiny. WLAOs are required to enforce contractual clauses ensuring providers maintain baseline cyber controls, restrict all external remote access to the switch network, block covert connections, and grant RBI teams access for both on-site and off-site inspections.

Critical operational safeguards retained in the consolidated rules include:

• Six-Hour Incident Reporting: PSOs must report all cyberattacks, internal fraud, critical outages, and payment settlement disruptions to the RBI within six hours of detection, alongside statutory reporting to the Indian Computer Emergency Response Team (CERT-In).
• Cooling-Off Windows: Entities must enforce a minimum 12-hour cooling-off period on accounts following customer updates to registered contact credentials, such as mobile numbers or email IDs.
• Audit Trail Retention: Comprehensive audit logs across systems and payment access points must be preserved securely for at least five years.

Market and Industry Impact

For India's expanding fintech and digital payments sector, the consolidated rules establish board-level accountability for cybersecurity risk management. While the measures significantly bolster defense against AI-driven threats and external network incursions, they are expected to increase ongoing audit, legal escrow, and software-compliance expenses for payment aggregators and mid-tier digital payment operators. Analysts note that while large players already adhere to high-grade controls, smaller ecosystem participants will need to invest in infrastructure modernization before their 2028 compliance deadline kicks in.