The Reserve Bank of India has put every authorised non-bank payment system operator under one consolidated cyber rulebook — and for large and medium operators, it is already in force. The instrument is headed "Reserve Bank of India (Cyber Resilience and Digital Payment Security Controls for non-bank PSOs) Master Directions, 2026" — Circular RBI/DPSS/2026-27/475, CO.DPSS.CSD.No.S825/01-01-078/2026-2027, dated 5 November 2026, issued under section 10(2) read with section 18 of the Payment and Settlement Systems Act, 2007. It consolidates the Master Directions of 30 July 2024 with the earlier third-party ATM switch controls and the system-audit scope review, and repeals six older circulars. Large and Medium category PSOs must comply from the day the Directions were placed on the RBI website; Small category PSOs have until 1 April 2028.
In plain business-owner language: if your customers pay you through UPI, cards, wallets or bill-payment apps, the companies running those rails now answer to one consolidated RBI cyber rulebook, with six hours to report a cyber incident and a 12-hour cooling-off after a customer changes their registered mobile number or email.
Quick Answer: RBI's Master Directions on cyber resilience for non-bank PSOs, dated 5 November 2026, consolidate the 2024 directions and repeal six circulars. They require six-hour incident reporting to RBI, a 12-hour cooling-off after mobile or email changes, and annual system audit within two months of year-end — in force for large and medium PSOs, from 1 April 2028 for small PSOs.
What changed
The 2026 Master Directions are, first and foremost, a consolidation. The circular letter states that the Master Directions dated 30 July 2024 are consolidated here, together with the third-party ATM switch controls (31 December 2019) and the system-audit scope review (10 January 2020). Paragraph 58 then repeals six circulars outright — four on system-audit reporting from 2009 to 2011, the 2019 ATM switch controls, and the 2020 scope review — with a proviso that nothing done under the repealed directions before repeal is affected.
In practice, a non-bank PSO no longer has to piece its cyber obligations together from a 2024 Master Direction plus a trail of older circulars. There is now one 32-page document covering governance, baseline controls, incident reporting, payment security, system audit and ATM switch operations. The Directions apply to all authorised non-bank PSOs (paragraph 4), and paragraph 5 extends the discipline to arrangements with unregulated entities, whose relevant IT systems must meet minimum security standards and the PSO's own policies.
One structural change matters for planning — the staggered commencement. Paragraph 3 brings the Directions into force on website publication for Large and Medium category PSOs, but only on 1 April 2028 for Small category PSOs — a preparation runway of nearly two and a half years. It is not open-ended: a small PPI issuer that moves up to a medium or large category must comply within one year of the new categorisation.
Key requirements at a glance
- Six-hour incident reporting: cyber security incidents to RBI within six hours of detection, and also to CERT-In (para 22(d)).
- 12-hour cooling-off: minimum 12 hours before any online payment transaction after a change in the registered mobile number or email ID (para 31(g)).
- Board-owned governance: the Board is overall responsible for information and cyber security; a Board sub-committee headed by an experienced Board member meeting at least once every quarter (paras 6–7).
- Cyber Crisis Management Plan: a distinct, Board-approved CCMP (para 9), alongside a Board-approved Information Security Policy reviewed at least annually (para 8).
- Source-code escrow: for critical applications owned by third parties, the PSO must ensure source code is obtained or escrowed (para 17(c)).
- Annual testing: security testing including vulnerability assessment and penetration testing (VAPT) at least annually (paras 18 and 27).
- Annual system audit: the System Audit Report annually within two months of year-end — by 1 June for an April–March year, by 1 March of the following year for a calendar-year entity — by CERT-In-empanelled or CISA/DISA auditors (para 36).
- Three-month closure: audit observations closed with time-bound corrective action within a maximum of three months, reported to RBI (para 41).
Governance: the Board owns cyber security
Paragraph 6 places overall responsibility for information and cyber security on the Board. Paragraph 7 requires the Board to constitute a sub-committee headed by a Board member with experience in information or cyber security, meeting at least once every quarter. This is not a delegation to the IT team: the Directions frame cyber resilience as a board-level accountability, with the sub-committee as its standing forum.
Two board-approved documents anchor it. Paragraph 8 requires a Board-approved Information Security Policy, reviewed at least annually. Paragraph 9 requires a distinct, Board-approved Cyber Crisis Management Plan (CCMP) — distinct, meaning it cannot simply be a chapter inside the information security policy or a general business continuity plan; it must stand on its own. Annual cyber security awareness is required under paragraph 25, extending the governance layer from the boardroom to staff training.
Incident reporting: six hours to RBI
The sharpest number in the Directions is six hours. Paragraph 22(d) requires cyber security incidents to be reported to RBI within six hours of detection, in the format in Annex 1, and also to CERT-In. Paragraphs 22(a) to (c) require 24x7 incident response capability, defined incident types and an incident response plan; paragraph 23 requires root-cause analysis and reporting to the Board.
Six hours from detection is a demanding clock. It presupposes fast detection — which is why the Directions also require centralised audit logs, time synchronisation and log monitoring (paragraph 51) — and a rehearsed escalation path to the RBI reporting channel. A PSO that discovers an incident on a Friday night and works out its reporting route on Saturday morning will miss the deadline.
The Directions state no audit-log retention period — paragraph 51 requires centralised logs and their monitoring and management, but no number of years; that point is marked NOT CHECKED below.
Digital payment security: the 12-hour cooling-off
The provision most visible to ordinary users is paragraph 31(g): "Whenever there is a change in registered mobile number or email ID linked to the payment instrument there shall be a cooling period of minimum 12 hours before allowing any payment transaction through online modes/channels." A fraudster who takes over an account by changing the registered mobile number or email ID can no longer move money online for at least 12 hours — time for the genuine customer to notice the change and the PSO to act.
Paragraph 35 adds a second cooling-off: a suitable cooling period before loading or reloading a prepaid payment instrument (PPI) after an OTP-based request — paragraph 31(g) fixes a minimum of 12 hours, while paragraph 35 leaves the period "suitable", for the PSO to determine. Together they slow the takeover of an instrument and the loading of value into one.
System audit: annual report within two months
Paragraph 36 requires the System Audit Report (SAR) annually within two months of year-end — by 1 June for an April–March year, by 1 March of the following year for a calendar-year entity — by CERT-In-empanelled or CISA/DISA auditors. Paragraph 41 requires the SAR before the Board, with open observations closed through time-bound corrective action within a maximum of three months, and reported to RBI.
Third-party ATM switch operators
Section VI (paragraphs 42–57) carries the controls for third-party ATM switch application service providers (ASPs) into the consolidated Directions: a board-approved agreement with the ASP (paragraph 43), a centralised Security Operations Centre (C-SOC) monitoring switch operations 24x7 (paragraph 56), and PCI-DSS and PA-DSS compliance (paragraph 57).
Old vs new: the 2024 directions and the 2026 directions
The verified change is consolidation, not a line-by-line comparison: the 2024 Master Directions were not compared against the 2026 text paragraph by paragraph, so no claim is made about which individual controls are new. What is verified is the architecture — one consolidated document replacing the 2024 directions plus the older circulars, with a deferred start for small PSOs.
Who is affected
The Directions apply to all authorised non-bank PSOs, in three categories set out in the footnotes to paragraph 3:
PPI issuer categorisation follows the Oversight Framework for Financial Market Infrastructures and Retail Payment Systems. A PPI issuer moving to a higher category must comply within one year of the new categorisation — a small issuer that grows into medium does not keep the 2028 runway.
Beyond the PSOs themselves, the Directions touch three further groups. Banks and other regulated entities that rely on PSOs should expect tighter incident-reporting and audit discipline from their payment partners. Third-party ATM switch ASPs now sit inside the consolidated framework. And customers — anyone paying through UPI, cards, wallets or bill-payment channels — get the practical benefit of the 12-hour cooling-off and six-hour incident reporting, even though the obligations fall on the operators.
What to do next
For Large and Medium PSOs — the Directions are already in force:
- Check the Board layer first. Confirm the Board has taken overall responsibility for information and cyber security, constitute the Board sub-committee with a chair who has information/cyber security experience, meeting quarterly, and put the two Board-approved documents in place: the Information Security Policy (reviewed at least annually) and the distinct Cyber Crisis Management Plan.
- Rehearse the six-hour clock. Test the path from detection to RBI and CERT-In reporting, including out of hours, and confirm the Annex 1 format is ready.
- Build the 12-hour cooling-off into the product flow and set a suitable cooling period for PPI loading/reloading after OTP requests.
- Check third-party critical applications — confirm source code is obtained or escrowed under paragraph 17(c), and VAPT is scheduled at least annually.
- Re-anchor the audit calendar and check ATM switch arrangements: annual SAR within two months of year-end, by CERT-In-empanelled or CISA/DISA auditors, placed before the Board, observations closed within three months; for ATM switch arrangements, confirm the board-approved ASP agreement, the 24x7 C-SOC and PCI-DSS/PA-DSS compliance.
For Small PSOs — the runway runs to 1 April 2028:
- Plan backwards from 1 April 2028. The governance layer (Board responsibility, sub-committee, policy, CCMP) takes the longest to build well; start there.
- Watch the categorisation trigger: if growth moves you from small to medium or large under the Oversight Framework, you must comply within one year — the 2028 date does not travel with you.
- Build incident detection and logging now — centralised logs, time synchronisation and log monitoring under paragraph 51 are what the six-hour clock stands on.
What the Directions do not cover
The following are marked NOT CHECKED:
- Any audit-log retention period. NOT CHECKED — paragraph 51 requires centralised logs, time synchronisation, log monitoring and management, but states no retention period.
- The contents of the Annex 1 incident-reporting format. NOT CHECKED — paragraph 22(d) refers to Annex 1, but its format table was not seen.
- Penalties for non-compliance. NOT CHECKED — no penalty provision is stated in the provisions read.
FAQs
What are the RBI Cyber Resilience Master Directions 2026 for non-bank PSOs?
The Reserve Bank of India (Cyber Resilience and Digital Payment Security Controls for non-bank PSOs) Master Directions, 2026, Circular RBI/DPSS/2026-27/475 dated 5 November 2026, under the Payment and Settlement Systems Act, 2007. They consolidate the 2024 Master Directions with earlier ATM switch and system-audit controls into one rulebook for all authorised non-bank PSOs.
When do the Cyber Resilience Master Directions 2026 come into force?
On website publication for Large and Medium category PSOs — 5 November 2026, so large and medium PSOs are already covered — and on 1 April 2028 for Small category PSOs.
How quickly must a non-bank PSO report a cyber incident to RBI?
Within six hours of detection, in the format in Annex 1, and also to CERT-In — with 24x7 incident response capability, defined incident types, an incident response plan, root-cause analysis and Board reporting.
What is the 12-hour cooling-off period in the RBI Cyber Resilience Directions?
Whenever the registered mobile number or email ID linked to a payment instrument changes, there must be a cooling period of minimum 12 hours before any payment transaction through online modes or channels. A separate suitable cooling period applies before loading or reloading a PPI after an OTP-based request.
Which payment system operators do the 2026 Master Directions apply to?
All authorised non-bank PSOs. Large covers NPCI, card networks, payment aggregators, white-label ATM operators, large PPI issuers, TReDS operators and BBPOUs; Medium covers cross-border in-bound money transfer operators under MTSS and medium PPI issuers; Small covers small PPI issuers and instant money transfer operators.
What is the deadline for the annual System Audit Report under the 2026 Directions?
Within two months of year-end — by 1 June for an April–March year, by 1 March of the following year for a calendar-year entity — by CERT-In-empanelled or CISA/DISA auditors, placed before the Board, with open observations closed within three months and reported to RBI.
Sources
- Primary source: Reserve Bank of India (Cyber Resilience and Digital Payment Security Controls for non-bank PSOs) Master Directions, 2026 — Circular RBI/DPSS/2026-27/475, CO.DPSS.CSD.No.S825/01-01-078/2026-2027, dated 5 November 2026 — rbidocs.rbi.org.in (official PDF)
- Official listing: RBI — Master Directions, Payment and Settlement System, 5 November 2026 — rbi.org.in
Last verified by team: 6 November 2026, against the official RBI Master Directions PDF on rbidocs.rbi.org.in. Every factual claim traces to that document; unaddressed points are marked "NOT CHECKED" above.
