Updated 10 November 2026. A plain-language summary based on published news reports, not legal advice. Read the RBI's official text on the RBI website and speak to your compliance team before acting.
Short answer: on 5 November 2026 the RBI issued consolidated cyber resilience and digital payment security directions for non-bank payment system operators such as payment aggregators, wallet (PPI) issuers, card networks and NPCI. They apply now to large and medium operators and from 1 April 2028 to small ones. Key points: report serious cyber incidents to the RBI within 6 hours, run real-time fraud monitoring, keep logs for at least five years, and build user safeguards such as a 12-hour cooling period after a mobile number or email change.
What the RBI issued
According to MediaNama and Bankersadda, the new master direction merges the July 2024 directions on cyber resilience and digital payment security controls with older rules on ATM switch providers and annual system audits. Six older circulars from 2009 to 2020 are repealed.
Who is covered
| Category | Examples (as reported) | When it applies |
|---|---|---|
| Large | NPCI, card networks, payment aggregators, large PPI issuers, white label ATM operators, TReDS platforms, Bharat Bill Payment units | Immediately |
| Medium | Inbound cross-border money transfer operators, medium PPI issuers | Immediately |
| Small | Small PPI issuers, instant money transfer operators | 1 April 2028 |
Unregulated partners such as gateways, technology vendors and ATM switch providers are expected to follow the rules through their contracts with the regulated operator. If you build software for a payment company, expect these requirements to show up in your contract and audits.
Main requirements for operators
Governance
- The board owns cyber risk. It can delegate to a committee led by someone with information security experience, which must meet at least once a quarter.
- A senior security head, such as a CISO, must be appointed.
- An independent IT and system audit every year. Bankersadda reports the audit report is due within two months of the financial year end, and observations must be closed within three months.
Monitoring and incidents
- Cyber attacks, critical outages, internal fraud and settlement delays must be reported to the RBI within 6 hours of detection. Cyber incidents also go to CERT-In.
- A real-time or near real-time fraud monitoring system and a security operations centre (SOC).
- A 24x7 manned fraud desk that also handles law enforcement requests.
Resilience and records
- A disaster recovery site in a different seismic zone, with recovery drills at least twice a year.
- System activity logs kept for at least five years.
- Source code access (or escrow) for critical software bought from vendors, and quick patching.
- Data localisation rules apply to storage and processing, including at vendors and in the cloud.
User-facing safeguards your app may need
This is where product and engineering teams have the most work. The reported customer protections include:
- 12-hour cooling period after a registered mobile number or email is changed, before online payments are allowed.
- Remote access detection: where possible, detect screen-sharing or remote access apps and block the payment app while they are active.
- Fraud flag in the app: an option for users to mark a transaction as fraudulent.
- Clear alerts: show the actual merchant name (not the gateway or aggregator) and amount; show the beneficiary name for transfers; put the OTP at the end of the message; mask card and account numbers.
- Session safety: auto logout after inactivity, lockout after repeated failed logins and an alert for each failed attempt.
- Multi-factor authentication for electronic debits unless the RBI has specifically relaxed it.
- Wallet controls: a cooling period before newly loaded money can be transferred or withdrawn, and alerts in the user's language.
MediaNama's summary also lists device binding to the user's phone and SIM, with re-binding if the app is unused for a set period. Confirm this against the RBI text, since not every report mentions it.
What merchants and fintech partners should do
Ordinary online merchants are not the direct target, but their payment aggregators are. Expect aggregators to ask for tighter API security, IP whitelisting and better merchant name data. MediaNama also reports that banks were advised on 3 November 2026 to tighten security on APIs used by NBFCs and fintechs, with whitelisting or maker-checker controls due by 3 December 2026 and audits by 3 February 2027. If your platform sends payouts through a bank API, check these dates with your bank.
Our P2P payment automation case study shows the kind of controls (duplicate checks, verified beneficiaries, audit trails) that make these reviews easier.
Quick engineering checklist
- Event log for profile changes, with a 12-hour payment hold after mobile or email updates.
- Remote access app detection on Android and a payment screen that refuses to load when it is active.
- "Report fraud" button on each transaction, routed to a monitored queue.
- Alert templates reviewed for merchant name, masking and OTP position.
- Idle timeout, failed-login lockout and alerts.
- Centralised logs retained for five years, with tamper protection.
- Incident runbook that can produce an RBI report within 6 hours.
- Annual third-party security audit, plus fixes tracked to closure.
Our posts on RBI two-factor authentication rules and the DPDP Act compliance checklist cover related authentication and data protection duties.
Building or upgrading a payment product?
Nextinera works with fintech teams on secure payment apps, API integrations and security reviews. Book a free call to go through your gaps.