Reserve Bank of India (Payments Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026

This page is the record of the instrument itself — reference, dates, scope and source. For what it means in practice, read The seven RBI Directions, and which one binds you.

The record

What it says

• Binds Payments Banks, and only Payments Banks.
• Issued on 31 July 2026 as one of seven parallel Directions, each addressed to a different class of regulated entity.
• Repeals its predecessors through the same covering circular as the other six.
• In force on issue, with no transition period stated.
• Since 1 October 2026 the board may delegate the annual review of its IT and cybersecurity strategies and policies to the IT Strategy Committee, and still approves any material amendment. The change came from the (Payments Banks – Governance) Amendment Directions, 2026, RBI/2026-27/179, which never names these Directions; the RBI wrote it into paragraph 7 of its consolidated text.

Read the instrument

The link below goes to the issuing regulator’s own copy. Where a regulator serves its text through a PDF viewer or a query-string URL, it points at the document rather than at a landing page that may not render it.

• RBI/DoS/2026-27/428 — RBI’s own copy

Instruments that change what this one requires

Not a reading list. Each of these alters the obligation on this page — the amendment that moved a date, the sibling that binds the entity class this one excludes, or the separate track it is routinely merged with.

• Commercial Banks RBI/DoS/2026-27/410 — Banking companies other than Small Finance Banks, Payments Banks and Local Area Banks.
• Small Finance Banks RBI/DoS/2026-27/419 — Small Finance Banks, which the commercial banks Directions expressly exclude.
• Urban Co-operative Banks RBI/DoS/2026-27/437 — Primary Co-operative Banks, graded into Levels I to IV by the digital services they offer.

This record is one entry in the Indian cyber regulation register, which publishes the same fields for every instrument as an open dataset. Indicative, and not legal advice: whether an instrument reaches your organisation turns on your licences and registrations, and is a determination for your legal team.