The RBI’s revised cyber Directions for payment operators: what actually changed

Who it binds, and from when

Every authorised non-bank payment system operator, sorted into three sizes in the instrument’s footnotes. The size decides the date.

PPI issuers are sized under the RBI’s Oversight Framework for Financial Market Infrastructures and Retail Payment Systems, not by this instrument. One that moves up a band has a year from its re-categorisation to comply.

Banks are outside it by definition — the title says non-bank. A bank that runs a payment system answers to its own cybersecurity Directions of 31 July 2026, which come from a different RBI department under a different reference series — RBI/DoS/2026-27/410 against RBI/DPSS/2026-27/475. The two are easy to cross-cite and should not be.

What changed from the 2024 text

Less than the headline suggests. Read side by side with the Master Directions of 30 July 2024, the governance, baseline-control and digital-payment sections carry over without a substantive change. The revision is a consolidation, and the RBI says so: its covering letter calls this the revised Master Directions and gives “a single reference point” as the reason.

The commencement change is housekeeping. Large and medium operators’ 2024 dates have passed, so they were already bound; the new text simply stops pretending otherwise. Small operators keep the same date they had.

One trap in the paperwork. The repeal list names six circulars from 2009 to 2020 and does not name the 2024 Master Directions. That is a consolidation, not an oversight to exploit: the 2026 text is the operative one, and a policy that still cites RBI/DPSS/2024-25/123 cites the version the RBI has replaced.

The system audit, now in one place

Section V is not a new obligation. Payment operators have filed system audit reports since 2009, under four circulars and a 2020 scope review — all five now repealed and restated here. What is new is that the auditor’s scope, the filing dates and the closure rule sit in the same document as the controls being audited.

• Who audits. A CERT-In empanelled auditor, a CISA registered with ISACA, or a DISA holder from ICAI. Neither the firm nor any sister concern may have provided any service to the operator in the previous two financial years.
• When. Annually, within two months of the financial year end — 1 June for an April–March year, 1 March for a calendar year.
• What. Twenty named areas, from information security governance to mobile online services, each tested for both design and operating effectiveness. The auditor must comment on every one, including where there is nothing to report.
• What happens next. The report goes to the board. Each open observation gets corrective action of no more than three months, reported to the RBI, and closes only when the auditor accepts the closure.

Two scope items reach outside the operator. In the vendor and third-party area, the auditor checks that service-level agreements carry a right of audit and inspection by the regulators, and that providers must disclose security incidents affecting the operator’s systems. And the auditor must report any deviation from the process flow the operator submitted when it sought authorisation — which turns the authorisation file into an audit baseline.

ATM switch providers, bound by contract

Section VI restates the RBI’s December 2019 circular on third-party ATM switch providers, as it applies to White Label ATM Operators that run their switch on such a provider’s shared service. The provider is not regulated, so the RBI reaches it through the contract: the WLAO’s agreement must oblige the provider to keep fifteen sets of controls and to give the RBI on-site and off-site supervisory access.

The controls are specific in a way the rest of the instrument is not. Remote connections from outside machines to the switch network are disabled. Firewall rules block unidentified outbound connections and reverse TCP shells. Log settings carry an alert on any change. The provider runs a Cyber Security Operations Centre with SIEM, keeps forensic and DDoS mitigation support on standby, complies with PCI-DSS and PA-DSS, and shares its VAPT reports with the WLAO or the RBI on request.

Your payment chain, by agreement

Paragraph 5 is the provision a third-party risk team should read twice. An operator must ensure that the unregulated entities in its digital payments ecosystem — payment gateways, service providers, vendors and now, by name, ATM switch providers — adhere to these Directions, “subject to mutual agreement”, under a board-approved policy.

The qualifier limits how the obligation is met, not whether it exists. The operator still needs the policy, and the agreements, and a way to know whether the counterparties are keeping to them. Three other provisions point the same way:

• For vendors in critical processes, as the RBI’s 2021 outsourcing framework for payment operators defines them, certified assurance from an independent auditor on the vendor’s cyber resilience.
• Source code for every critical application bought from a third party, or an escrow arrangement where the code cannot be had.
• Annual independent security audits of any cloud provider, reviewed by the board sub-committee together with the provider’s performance and resilience.

The controls that carried over

For an operator that implemented the 2024 text, nothing below is new. For a small PPI issuer with a 2028 date, this is the work.

• Governance. Board oversight, delegable to a sub-committee headed by a member with information or cyber security experience and meeting at least quarterly. A board-approved information security policy reviewed annually, a separate Cyber Crisis Management Plan, and a CISO or equivalent.
• Six hours. Unusual incidents — cyber attacks, outages of critical systems, internal fraud, settlement delays — go to the RBI in the Annex 1 format within six hours of detection. Cyber incidents also go to CERT-In.
• Monitoring. A SOC, a SIEM correlating alerts across business units, real-time or near real-time fraud monitoring, a staffed 24x7x365 desk for fraud complaints and law enforcement, and an anti-phishing and rogue-app takedown service.
• Resilience. A disaster recovery site in a different seismic zone, drills at least half-yearly, backups tested half-yearly, a near-zero recovery point objective, and audit logs kept for at least five years.
• Payments. Multi-factor authentication on every electronic debit transaction unless expressly relaxed, device binding for mobile apps, and a twelve-hour cooling period after a registered mobile number or email changes.

Every provision, list and date on this page is from Reserve Bank of India (Cyber Resilience and Digital Payment Security Controls for non-bank PSOs) Master Directions, 2026, RBI/DPSS/2026-27/475, issued 5 November 2026, read on rbi.org.in. The comparison is with the Master Directions of 30 July 2024, RBI/DPSS/2024-25/123, read on the same day. The incident reporting format and the indicative incident list are in Annexes 1 and 2 of the RBI’s notification and are not reproduced here. This page is commentary on a published instrument, not legal advice, and the Directions should be read in full before anyone relies on a characterisation of them, including this one. External measurement referenced here is a Bitsight capability; BitScore Cybertech LLP is an authorised Bitsight partner.

The instrument records on this site: RBI/DPSS/2026-27/475 · No. 20(3)/2022-CERT-In