Reserve Bank of India (Cyber Resilience and Digital Payment Security Controls for non-bank PSOs) Master Directions, 2026

This page is the record of the instrument itself — reference, dates, scope and source. For what it means in practice, read What the 2026 revision asks of a payment operator.

The record

What it says

• Binds every authorised non-bank payment system operator, including CCIL, NPCI, card networks, White Label ATM Operators, payment aggregators and PPI issuers.
• Takes effect on issue for large and medium operators, and on 1 April 2028 for small PPI issuers and Instant Money Transfer Operators.
• Requires unusual incidents — cyber attacks, outages of critical systems, internal fraud, settlement delays — to be reported to the RBI within six hours of detection, and cyber incidents to CERT-In as well.
• Makes the operator secure adherence to the Directions from the unregulated entities in its payments chain, such as payment gateways, vendors and ATM switch providers, subject to mutual agreement and under a board-approved policy.
• Folds in the annual System Audit Report, previously a separate circular: a CERT-In empanelled auditor, a CISA or a DISA holder, due within two months of the financial year end, with each open observation given corrective action of at most three months.
• Carries over the 2024 controls: a board sub-committee meeting at least quarterly, a CISO, a SOC and SIEM, half-yearly DR drills from a different seismic zone, and audit logs kept for five years.

What accounts of this instrument get wrong

Read the instrument

The link below goes to the issuing regulator’s own copy. Where a regulator serves its text through a PDF viewer or a query-string URL, it points at the document rather than at a landing page that may not render it.

• RBI/DPSS/2026-27/475 — RBI’s own copy

Instruments that change what this one requires

Not a reading list. Each of these alters the obligation on this page — the amendment that moved a date, the sibling that binds the entity class this one excludes, or the separate track it is routinely merged with.

• Commercial Banks RBI/DoS/2026-27/410 — Banking companies other than Small Finance Banks, Payments Banks and Local Area Banks.
• Non-Banking Financial Companies RBI/DoS/2026-27/461 — All NBFCs, through three alternative chapters split at ₹500 crore, and Core Investment Companies.
• CERT-In Directions, 2022 No. 20(3)/2022-CERT-In — Very nearly every organisation in India, with a six-hour incident report to CERT-In.

This record is one entry in the Indian cyber regulation register, which publishes the same fields for every instrument as an open dataset. Indicative, and not legal advice: whether an instrument reaches your organisation turns on your licences and registrations, and is a determination for your legal team.