The RBI has consolidated and strengthened cybersecurity rules for non-bank (PSOs), mandating incident reporting within **six hours** and implementing a **12-hour cooling period** for online transactions after mobile/email changes.
6 hours
Incident Reporting Deadline
⏳ Time Machine
How today’s news fits into the bigger picture
December 2019
Rules for ATM Switch Providers
RBI issued specific instructions for cybersecurity controls to be implemented by third-party ATM switch application service providers, highlighting early concerns about the extended payment ecosystem.
January 2020
System Audit Guidelines
Guidelines for system audits of payment systems were released, emphasizing the need for periodic external assessments of IT infrastructure and security.
July 30, 2024
Initial Cyber Security Directions
RBI issued its first Master Directions on and Digital Payment Security Controls for non-bank PSOs, laying foundational cybersecurity requirements.
April 2026
Anticipation of Tighter Rules
Industry discussions began intensifying around the need for more consolidated and stringent cybersecurity norms, given the increasing sophistication of cyber threats and growth of digital payments.
November 5, 2026
Master Directions Issued
The RBI released its consolidated Master Directions for and Digital Payment Security Controls, bringing all previous guidelines under one framework and introducing new mandates.
Today
RBI released new Master Directions, consolidating cybersecurity rules for non-bank payment operators.
What happens next?
Large and medium PSOs must comply immediately, while small PSOs have until April 1, 2028, to meet the new cybersecurity requirements.
The Reserve Bank of India (RBI) has introduced a new Master Direction on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators (PSOs). Issued on November 5, 2026, these consolidated guidelines aim to significantly enhance the security of India's digital payment ecosystem. Key mandates include a strict six-hour window for PSOs to report any cybersecurity incidents or critical outages to the RBI and CERT-In. Additionally, a crucial consumer safeguard has been introduced: a minimum 12-hour cooling period for online transactions after a user changes their registered mobile number or email ID linked to their payment instruments. Large and medium PSOs must comply immediately, while smaller operators have until April 1, 2028.
💭 If you're wondering…
CERT-In, the Indian Computer Emergency Response Team, is the national agency for cyber security incidents. It collects, analyzes, and disseminates information on cyber attacks, and issues forecasts and alerts.
Did this story help?
Official sources
Knowledge Chain — tap a concept