RBI Consolidates Cyber Rules for Payment Operators Into One Master Direction

Six circulars are dead, one rulebook stands. On November 5, the Reserve Bank of India issued a single master direction consolidating its cyber security rules for non-bank payment system operators — the companies that move India's money without holding a banking licence.

That's a bigger universe than it sounds. The direction covers the National Payments Corporation of India, which runs UPI, plus card networks, payment aggregators, prepaid wallet issuers, ATM switch providers and white label ATM operators. RBI said the goal is to "provide a single reference point for the entities," merging its July 2024 master directions on cyber resilience with earlier rules from 2019 on ATM switch providers and 2020 on annual system audits.

What does this change for payment operators?

Compliance timelines first. The direction applies immediately to large and medium payment companies. Small operators — small wallet issuers and instant money transfer operators — have until April 1, 2028.

The board owns cyber risk, full stop. Boards can delegate primary oversight to a committee chaired by a member with information or cyber security experience, and that committee must meet at least once a quarter.

The operational obligations are extensive:

• Incident reporting: Cyber attacks, critical outages, internal fraud and settlement delays must reach RBI "within 6 hours of detection." Cyber security incidents also go to CERT-In.
• Fraud monitoring: A "real-time / near real-time fraud monitoring solution" plus a security operations centre watching networks for attacks.
• Risk-based alerts: Warning signals include unusual locations or IP addresses, behavioural biometrics such as changes in typing or swiping patterns, and payments to UPI IDs, wallets or mobile numbers already linked to fraud.
• Data localisation: Rules on where payment data is stored and processed extend to vendors, and cloud policies must cover localisation too.
• Disaster recovery: A backup site in a different seismic zone, with recovery drills at least every six months.

Companies must also appoint a senior security head such as a CISO, run anti-phishing takedown services for fake sites and apps, keep system activity logs for at least five years, and secure access to the source code of critical vendor software.

What safeguards do users get?

Several of these read like a checklist written after real fraud cases. Change the mobile number or email linked to a payment instrument, and "there shall be a cooling period of minimum 12 hours before allowing any payment transaction through online modes / channels."

Payment apps must also detect remote access apps "to the extent possible" and block the payment app "while the remote access is live" — a direct answer to the scam scripts that start with "please install this support tool." Device binding ties each app to one phone and SIM card, and re-binding is required after a period of disuse.

Other user-facing requirements:

• Fraud reporting: Apps and websites must let users "mark a fraudulent transaction" for immediate notification to the payment instrument's issuer.
• Clearer alerts: Payment alerts must name the actual merchant and amount — no gateway or aggregator standing in for the merchant. Transfer alerts must show the amount debited and the beneficiary's name as recorded by their bank. Any OTP must appear "at the end of the notification message" and reference the specific transaction.
• Masked details: Account and card numbers masked "to the extent possible."
• Login controls: Auto-logout after inactivity, lockout after a set number of failed attempts, and immediate notification of each failure.
• Multi-factor authentication: Every electronic debit, including cash withdrawals, requires more than one check — think PIN plus OTP — except where explicitly relaxed.
• 24x7 fraud desk: A manned facility "on 24x7x365 basis" to resolve complaints and respond to law enforcement.
• Wallet safeguards: A cooling period before newly loaded wallet funds can be transferred or withdrawn, with alerts offered in vernacular languages.

Who carries the compliance burden?

RBI splits the market into three tiers. Large: NPCI, NPCI Bharat BillPay, card networks, payment aggregators, large wallet issuers, non-bank ATM networks, white label ATM operators, plus the Clearing Corporation of India, Bharat Bill Payment operating units and TReDS platforms. Medium: inbound cross-border money transfer operators and medium wallet issuers. Small: the rest.

Operators must also push compliance down their chain — payment gateways, vendors and ATM switch providers — "subject to mutual agreement," backed by a board-approved policy. White label ATM operators must bind their switch providers contractually, block unapproved software, cut off remote access to the switch network, and defend against DDoS-style traffic floods.

Annual independent IT audits cover 20 areas; on an April-March financial year, reports go to RBI by June 1, with fixes due within three months.

What else is RBI doing?

The consolidation isn't happening in a vacuum. A confidential November 3 advisory asks banks to tighten the APIs that NBFCs and fintechs use, after a rise in AI-assisted attacks. On November 4, CERT-In flagged a threat actor it calls "CRAFTY FALCON," which probes fund flows with Rs 1 test transfers before moving larger sums. Banks must get NBFC API clients audited by CERT-In-empanelled auditors by February 3, 2027, and enforce beneficiary whitelisting or maker-checker approval by December 3, 2026.

RBI is also weighing a customer "kill switch" to instantly block all debits — not yet finalised, per its 2025-26 annual report — and draft AI guidelines would require banks to be able to switch off any AI system they deploy.

One rulebook, in other words, is just the opening move.