Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators

The Reserve Bank of India (RBI) introduced Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators (PSOs) to consolidate earlier fragmented guidelines issued between 2019 and 2020. The new framework aims to strengthen resilience against cyber threats and ensure secure digital payment transactions across all non-bank PSOs. The directions replace prior instructions on third-party ATM switch providers and system audits, establishing a unified reference for compliance. Existing security measures for card payments, prepaid instruments, and mobile banking remain applicable unless superseded by these new rules.

The Master Directions, issued under the Payment and Settlement Systems Act, 2007, will take effect for large and medium non-bank PSOs upon publication on the RBI’s website, while small PSOs must comply by April 1, 2028. The framework mandates that PSOs ensure their unregulated third-party service providers, such as payment gateways and vendors, adhere to these security controls through mutual agreements. PSOs are required to implement governance mechanisms for identifying, assessing, and managing cyber risks, including baseline security measures and annual policy reviews.

PSOs must establish a Board-approved Information Security (IS) policy covering roles, risk management, and employee training, alongside a Cyber Crisis Management Plan (CCMP) for detecting, containing, and recovering from cyber threats. The Board retains oversight, with primary responsibility delegated to a sub-committee meeting quarterly. A senior executive, such as a Chief Information Security Officer (CISO), must oversee implementation and continuous assessment of the IS posture. Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) must be defined and monitored to evaluate security control effectiveness.

PSOs are required to maintain detailed records of information assets, including applications, data, and third-party providers, and classify their criticality and business value. They must document network dependencies, assess risks from unsupported assets, and enforce strict access control policies, including digital identity management and deactivation of default authentication settings. All IT assessment reports, such as system audits and vulnerability assessments, must be reviewed by the Board’s IT oversight sub-committee. New product launches or major infrastructure changes require prior cyber risk assessments, with action points implemented under CISO oversight.