On 5 November 2026, the Reserve Bank of India replaced several cyber instructions with one. Its Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators, 2026 apply to every authorised non-bank PSO, from NPCI and card networks to payment aggregators and prepaid payment instrument (PPI) issuers.

For large and medium PSOs, there is no new phase-in. The Directions took effect on the day they were published, and the compliance dates set in 2024 for those groups have already passed. For compliance teams, that makes this a re-baselining exercise, not a project for next year.

Original illustration created for this article, based on RBI circular RBI/DPSS/2026-27/475.

What the circular does

The circular, numbered RBI/DPSS/2026-27/475 and issued under Section 10(2) read with Section 18 of the Payment and Settlement Systems Act, 2007, consolidates three things into a single Master Direction: the 30 July 2024 Master Directions on cyber resilience, the 2019 cyber security controls for third-party ATM Switch Application Service Providers, and the 2020 review of system audit scope and coverage. It also repeals six earlier circulars dated between 2009 and 2020.

RBI says existing instructions on security measures for cards, PPIs and mobile banking continue to apply, and that if the two ever conflict, the Master Direction prevails. Large PSOs include NPCI, CCIL, card networks, non-bank ATM networks, white label ATM operators, large PPI issuers, TReDS operators, Bharat Bill Payment Operating Units and payment aggregators. Medium PSOs are medium PPI issuers and cross-border inbound money transfer operators. Small PSOs, such as small PPI issuers and instant money transfer operators, have until 1 April 2028.

What it asks for

The Directions run to six sections. These are the provisions we think compliance teams will feel first, with paragraph numbers from the circular text as reproduced by TaxGuru.

  • Board accountability (paras 7–12). The Board owns information security and cyber resilience. Primary oversight may sit with a Board sub-committee headed by a member with information or cyber security experience, meeting at least quarterly. The Board approves an information security policy, reviewed annually, and a separate Cyber Crisis Management Plan. System audit and VA/PT reports go before the sub-committee at its next meeting.
  • Six-hour incident reporting (para 22). Unusual incidents such as cyberattacks, critical outages, internal fraud and settlement delays must be reported to RBI in the prescribed format within six hours of detection. Cyber security incidents must also be reported to CERT-In.
  • Resilience (para 23). Business continuity plans must cover extreme but plausible scenarios and be reviewed annually. PSOs must strive for near-zero RPO, keep the DR site in a different seismic zone, and run DR drills at least half-yearly. Backups must be tested at least half-yearly (para 20).
  • Vendors and the wider ecosystem (paras 5, 17, 19). PSOs must seek adherence to the Directions from unregulated entities in their payments ecosystem, such as gateways and vendors, subject to mutual agreement and under a Board-approved policy. For vendors in critical processes, PSOs need certified assurance from an independent auditor on the vendor’s cyber resilience. For critical third-party applications, they need the source code or an escrow arrangement.
  • Logs and monitoring (para 27). Audit logs must be preserved for at least five years. PSOs also need real-time fraud monitoring and a facility staffed 24x7x365 to handle reported unauthorised transactions and respond to law enforcement.
  • Payment security (Section IV). Mobile payment apps need device binding, session timeouts and detection of remote-access apps, which must block access to the payment app while remote access is live. A minimum 12-hour cooling period applies after a change of registered mobile number or email before online payments are allowed.
  • System audit (paras 36–41). An annual System Audit Report is due within two months of the financial year-end, which means 1 June for April–March entities and 1 March for calendar-year entities. Auditors must be CERT-In empanelled, CISA-qualified through ISACA, or DISA-qualified through ICAI. The auditing firm, or its sister concerns, must not have provided any service to the entity in the previous two financial years. Controls are tested for both design and operating effectiveness across 20 areas. Open observations must be closed within three months, and only after the auditor accepts the closure.

Why now: a week of AI-driven fraud warnings

The circular is a rulebook, not a response to one incident, but the timing is hard to ignore. The same week, MediaNama reported that CERT-In’s advisory of 4 November named a threat actor, CRAFTY FALCON, which allegedly used Re 1 transfers to test fund flows before larger payouts and bypassed IP allow-listing by routing traffic through shared third-party IP pools. CERT-In recommended beneficiary cooling periods and maker-checker approval for merchant settlements. The Indian Cyber Crime Coordination Centre also issued a public advisory on AI-assisted attacks on banks, NBFCs and fintechs.

MediaNama also reported, citing Head and Tale, that RBI met bankers and issued a confidential advisory dated 3 November. According to that report, it asks banks to keep a full inventory of API clients, require CERT-In-empanelled audits of NBFC API clients before onboarding (existing clients by 3 February 2027), risk-assess other API clients such as payment aggregators and fintechs, enforce beneficiary whitelisting and add maker-checker or out-of-band confirmation for API debits. The advisory has not been published, and RBI has not confirmed these details, so treat them as reported, not confirmed.

Our reading: if that report is accurate, payment aggregators and fintechs should expect their sponsor banks to ask for audit evidence and tighter controls. Having the PSO system audit and VA/PT in order is the best preparation.

What is binding, and what is reported

ItemStatus
RBI Master Directions, 2026 (RBI/DPSS/2026-27/475, 5 November 2026)Binding on authorised non-bank PSOs. Issued under the Payment and Settlement Systems Act, 2007.
CERT-In Directions of 28 April 2022Binding for covered entities. Specified incidents must be reported within 6 hours, and ICT logs kept for a rolling 180 days within India. RBI’s five-year log retention is longer and applies to PSOs.
CERT-In advisory of 4 November 2026 on CRAFTY FALCONAn advisory with recommended actions, as reported by MediaNama
RBI confidential advisory to banks (3 November 2026)Reported by Head and Tale and MediaNama. Not published, and RBI has not confirmed it.
The checklist in the next sectionOur analysis

Eight things to do in the next 30 days

  1. Confirm your category. Check whether you are large, medium or small under the circular’s notes. A PPI issuer that moves to a higher category must comply within one year of the new categorisation.
  1. Re-map your evidence. Map your 2024 compliance evidence to the 2026 paragraphs, and update every policy, checklist and audit programme that cites the six repealed circulars.
  1. Check Board mechanics. Confirm the sub-committee is led by a member with information or cyber security experience, that it meets quarterly, and that audit and VA/PT reports reach it at the next meeting.
  1. Rehearse the six-hour clock. Define what counts as detection, who files the report to RBI in the prescribed format and who informs CERT-In. Run a drill.
  1. Plan the system audit. Check that your auditor meets the qualification and two-year independence tests, schedule testing of design and operating effectiveness, and set the 1 June or 1 March submission date.
  1. Review key vendors. List vendors in critical processes. Ask for independent assurance on their cyber resilience, and check source-code access or escrow for critical applications.
  1. Fix retention. Make sure audit logs are kept for five years, not just 180 days, and that copies sit off the systems they describe.
  1. Test recovery. Check that backup restores and DR drills occur at least half-yearly, and that any gap against your RTO and RPO is logged and fixed.

Evidence beats intent

This rulebook does not ask payment companies to invent anything exotic. It asks them to show, on paper and under audit, that governance, incident reporting, vendor oversight, logging and recovery work as described. In a week when regulators are warning about faster, AI-assisted fraud, the organisations that can produce that evidence quickly will be the ones their banks and auditors trust.

Synopsis

On 5 November 2026, RBI issued consolidated cyber resilience and digital payment security Master Directions for non-bank payment system operators, effective immediately for large and medium PSOs. This blog explains who is covered, the provisions compliance teams will feel first, how a week of AI-fraud warnings fits in, and eight steps for the next 30 days.

Sources