India: RBI Gives Non-Bank Payment Firms Six Hours to Report Cyber Incidents
India’s central bank has rewritten the cyber security rulebook for the non-bank companies that move the country’s digital money. Under new Master Directions issued on 5 November 2026, payment operators such as the National Payments Corporation of India (NPCI), card networks, payment aggregators and e-wallet issuers must report serious cyber incidents to the regulator within six hours of spotting them.
The Reserve Bank of India (RBI) says the rules apply straight away to large and medium operators, while smaller firms have until April 2028 to comply.
Key facts
- The RBI issued the Cyber Resilience and Digital Payment Security Controls for non-bank PSOs Master Directions, 2026, on 5 November 2026. PSO stands for payment system operator.
- Cyberattacks, critical system outages, internal fraud and settlement delays must be reported to the RBI within six hours of detection.
- Large and medium operators must comply immediately; small e-wallet (prepaid payment instrument) issuers and instant money transfer operators have until 1 April 2028.
- Each operator must file an annual system audit within two months of its financial year-end (1 June for April–March years) and fix open findings within three months.
- The 12-hour cooling-off period before online payments, after a customer changes their registered mobile number or email, stays in place.
What changes for payment firms
The new directions bring several older circulars into one document and repeal six of them, including one dating back to 2009. They sort operators into three tiers. The “large” group includes NPCI, which runs the Unified Payments Interface (UPI), as well as card networks, white-label ATM operators, payment aggregators and large e-wallet issuers. Cross-border money transfer operators and mid-sized wallet issuers form the “medium” group.
Beyond the six-hour reporting clock, the rules go deep into how these companies buy and run technology. For critical applications bought from outside vendors, an operator must obtain the source code or have it placed in escrow, meaning a neutral third party holds a copy. If the operator does not own the code, the developer must certify that the software has no known vulnerabilities, malware or hidden communication channels, and must do so again after every change.
Auditors also face tighter independence rules. A firm cannot audit an operator if it, or a related company, has provided any service to that operator in the previous two financial years. Audits must test whether controls actually work, not just whether they exist on paper.
Other requirements include multi-factor authentication for debit transactions and for remote staff access, a board sub-committee on IT and cyber risk that meets at least every quarter, a disaster recovery site in a different seismic zone from the main data centre, and audit logs kept for at least five years.
Why it matters
India runs one of the busiest real-time payment systems in the world, and much of that traffic flows through non-bank players rather than banks. A breach or long outage at a large payment aggregator or wallet can ripple quickly to millions of users and merchants. A short, fixed reporting window gives the RBI a faster view of problems across the system and puts pressure on firms to detect issues early.
The vendor rules matter just as much. Many fintechs depend on outside software and cloud providers, and the RBI is making operators answerable for that supply chain. Vendors handling critical processes must provide independent assurance on their cyber resilience and disclose incidents that affect the operator.
Across the region, regulators are moving in a similar direction on technology risk and outage reporting. For payment firms working in several Asian markets, India’s detailed checklist is likely to become a reference point when they design group-wide security controls.
What to watch
- How quickly large aggregators and wallet issuers can meet the source-code and vendor-certification rules for systems already in use.
- Whether the RBI publishes data on incidents reported under the new six-hour rule.
- How small wallet issuers prepare ahead of the April 2028 deadline, and whether costs push some to consolidate.
Related on FinDeskAsia: How Malaysia’s payment system works and PayNet and the regulators.
Sources: TaxGuru (RBI circular text), November 2026; Outlook Money, November 2026.
