RBI New Cyber Security Rules 2026: What Changes for Digital Payment Operators?

The Reserve Bank of India (RBI) has introduced stricter cyber security requirements for non-bank Payment System Operators (PSOs) through the Master Directions on Cyber Resilience and Digital Payment Security Controls, 2026, issued on 5 November 2026. The new framework focuses on strengthening digital payment infrastructure through tighter software security, regular system audits, improved fraud monitoring and stricter oversight of third-party service providers.

RBI New Cyber Security Rules 2026

RBI New Cyber Security Rules covers authorised non-bank payment operators, including the National Payments Corporation of India (NPCI), card networks, payment aggregators, prepaid payment instrument (PPI) issuers and white-label ATM operators. While large and medium PSOs must comply immediately, small PSOs have been given time until 1 April 2028 to implement the new requirements.

Which Digital Payment Operators Are Covered Under the New RBI Rules?

The new directions apply to authorised non-bank Payment System Operators and extend security expectations to entities connected to their digital payment ecosystem. This includes organisations that process transactions, issue payment instruments or provide essential payment infrastructure.

• NPCI: The National Payments Corporation of India, which operates important retail payment systems.
• Card Networks: Organisations operating card payment networks.
• Payment Aggregators: Entities facilitating payments between merchants and customers.
• PPI Issuers: Providers of prepaid payment instruments, including wallets and prepaid cards.
• White-Label ATM Operators (WLAOs): Operators managing ATMs under the white-label ATM framework.
• Third-Party Service Providers: Vendors, payment gateways and technology partners connected to payment operations, subject to applicable contractual arrangements.

5 Major Changes Under RBI’s New Cyber Security Rules

The revised framework introduces stricter requirements across software security, audits, fraud monitoring and payment infrastructure. The following are the key changes digital payment operators need to understand.

1. Stronger Cyber Security Governance and Annual Audits

The RBI has strengthened accountability for cyber security by placing greater responsibility on the boards of payment operators. PSOs must establish appropriate information security policies, monitoring arrangements and cyber incident response mechanisms.

• Board Oversight: The board must oversee information security and cyber resilience.
• Quarterly Reviews: The designated sub-committee must meet at least once every quarter.
• Annual Policy Review: Information security policies must be reviewed and approved annually.
• Annual System Audit: PSOs must submit an annual system audit report within two months of the end of their financial year.
• Audit Compliance: Pending audit observations must be addressed within a maximum of three months.

2. Stronger Software and Third-Party Security

Payment operators will have to exercise greater control over applications purchased from external vendors. The RBI has specifically strengthened source code safeguards to reduce the risk of vulnerabilities entering critical payment systems.

• PSOs must obtain the source code of critical applications procured from third-party vendors.
• Where source code cannot be obtained, an appropriate escrow arrangement must be established.
• If the operator does not own the source code, it must obtain a developer certificate confirming that the application is free from vulnerabilities, malware and covert communication channels.
• A fresh certificate must be obtained whenever changes are made to the application.
• Critical security patches must be applied immediately when required to address known or reported attacks.

3. Six-Hour Cyber Incident Reporting and Better Fraud Monitoring

The RBI has retained the requirement for payment operators to report specified cyber and operational incidents within six hours of detection. This includes cyberattacks, outages involving critical systems, internal fraud and settlement delays.

• 12-Hour Cooling Period: A minimum 12-hour waiting period must be observed after a customer changes the registered mobile number or email address linked to a payment instrument, before online transactions are allowed.
• Fraud Reporting: Customers must have mechanisms on mobile applications or websites to identify and flag fraudulent transactions.
• Transaction Alerts: Notifications should clearly identify the merchant instead of mentioning only the payment gateway or aggregator.
• Beneficiary Details: Fund transfer notifications must include the beneficiary’s name and the amount debited.
• Remote Access Controls: Payment applications must have controls to identify remote access applications, to the extent possible, and prevent access while remote access is active.

4. Stronger Card Network and ATM Security

The new directions introduce additional safeguards for card networks and third-party ATM switch service providers. These requirements focus on transaction monitoring, network security and preventing unauthorised access to payment infrastructure.

5. Business Continuity and Disaster Recovery

The RBI has also focused on ensuring that payment operators can continue functioning during cyberattacks,

• Disaster recovery facilities in a separate seismic zone.
• Disaster recovery drills at least twice a year.
• Efforts to achieve a near-zero Recovery Point Objective (RPO).
• Appropriate business continuity and service restoration arrangements.
• Preservation of audit logs for at least five years.

RBI Cyber Security Rules 2026: Implementation Timeline

How Will the New RBI Rules Affect Digital Payments, Customers?

The revised directions primarily impose obligations on payment operators rather than introducing an entirely new payment procedure for customers. However, stronger fraud monitoring, clearer transaction alerts and additional safeguards after changes to registered contact details are expected to improve digital payment security.

• A minimum 12-hour cooling-off period applies after changes to registered mobile numbers or email addresses linked to payment instruments.
• Customers must have mechanisms to report suspicious transactions.
• Transaction notifications will provide clearer merchant and beneficiary details.
• Stronger security monitoring will help payment operators identify and respond to cyber incidents.