RBI Issues New Cyber Security Rules For Non-Bank Payment Operators, Sets Audit Deadlines

The Reserve Bank of India (RBI) has issued a consolidated cyber security framework for non-bank payment system operators (PSOs), introducing stricter requirements for software security, system audits and third-party service providers.

The revised Master Directions on Cyber Resilience and Digital Payment Security Controls cover organisations such as the National Payments Corporation of India (NPCI), card networks, payment aggregators, prepaid payment instrument (PPI) issuers and white-label ATM operators (WLAOs).

The rules take effect immediately for large and medium PSOs. Small PSOs have been given time until April 1, 2028, to comply.

Third-Party Software Must Meet Security Requirements

Under the revised directions, PSOs have been mandated to obtain the source code of critical applications purchased from external vendors. If obtaining the code is not possible, they must arrange for it to be held in escrow to prevent service disruptions.

Where the PSO does not own the source code, it needs to obtain a certificate from the developer confirming that the application does not contain vulnerabilities, malware or hidden communication channels.

Developers must issue a fresh certificate whenever changes are made to the application.

The RBI has also made it mandatory for PSOs to have systems that allow them to install critical security patches immediately. These patches are meant to address known vulnerabilities and reported cyberattacks.

Annual Cyber Security Audits Made Mandatory

The new directions require every PSO to submit an annual system audit report within two months of the end of its financial year. For entities following the April-March financial year, the report must be submitted by June 1.

The RBI has also introduced conditions to prevent conflicts of interest during audits. An auditor and its related entities must not have provided any service to the PSO during the previous two financial years.

Auditors must also identify and report any differences between the actual process followed by the PSO and the process it submitted to the RBI when applying for authorisation.

PSOs must address pending audit observations within three months.

Third-Party ATM Switch Providers Under RBI Oversight

The directions also cover WLAOs that use shared ATM switch services. These operators must ensure that their service providers follow the prescribed cyber security requirements through contractual arrangements.

The agreements have to allow RBI to conduct on-site and off-site supervision of these providers. Security measures include blocking remote connections from external machines to ATM switch networks and preventing unauthorised backdoor access.

Six-Hour Cyber Incident Reporting Deadline Retained

The revised framework retains the requirement for PSOs to report cyber incidents to the RBI within six hours of detection. These incidents include cyberattacks, critical system outages, internal fraud and settlement delays.

It has also retained the mandatory 12-hour cooling-off period after a customer changes their registered mobile number or email address.

The RBI has repealed six earlier circulars, including one issued in 2009, and brought their requirements together under a single set of directions.