RBI's 2026 cyber resilience Directions for non-bank payment system operators: what they require of you and your vendors

What did RBI issue on 5 November 2026?

The instrument is the Reserve Bank of India (Cyber Resilience and Digital Payment Security Controls for non-bank PSOs) Master Directions, 2026, reference RBI/DPSS/2026-27/475, dated 5 November 2026 and addressed to authorised non-bank payment system operators (PSOs). Paragraph 1 states that it is issued under section 10(2) read with section 18 of the Payment and Settlement Systems Act, 2007.

The covering letter recalls that RBI issued Master Directions of the same name on 30 July 2024 and says it has decided to consolidate related directions into a single Master Direction to give entities one reference point. It names two instruments consolidated under what it calls the revised Master Directions: the circular of 31 December 2019 on cyber security controls for third party ATM switch application service providers, and the circular of 10 January 2020 on the scope and coverage of the system audit of payment systems.

The repeal table in paragraph 58 lists six circulars: four on system audit dated 7 December 2009, 27 December 2010, 15 April 2011 and 14 June 2011, and the two named above. The 30 July 2024 Directions are not in that table, and the 2026 text does not publish a list of what changed from the 2024 text. This article therefore describes what the 2026 Directions say and does not present any requirement as new.

The Directions have six parts: preliminary, governance, baseline security controls, digital payment security measures, the system audit, and cyber security controls for third party ATM switch application service providers.

Who do the Directions apply to, and from when?

Paragraph 4 applies the Directions to all authorised non-bank PSOs. Paragraph 3 sets two commencement dates by size, and the footnotes to that paragraph say which operators fall in each size. For prepaid payment instrument (PPI) issuers, the footnotes take the small, medium and large categorisation from RBI's Oversight Framework for Financial Market Infrastructures and Retail Payment Systems.

A PPI issuer that moves to a higher category follows the timeline of the category it moves into; the footnote's example is a small issuer that becomes medium or large and must comply within one year of the new categorisation.

What do the Directions require about vendors and third parties?

Vendor obligations are spread across the text rather than held in one chapter. Paragraph 5 is the widest: to manage cyber and technology risks from linkages with unregulated entities in the digital payments ecosystem, such as payment gateways, third party service providers, vendors and third party ATM switch application service providers, a PSO must ensure that those entities adhere to the Directions as well, subject to mutual agreement, and must have a Board-approved organisational policy on this.

Paragraph 19, headed Vendor Risk Management, says the PSO is to be guided by RBI's Framework for Outsourcing of Payment and Settlement-related Activities by PSOs (circular of 3 August 2021, as updated) and adds three duties. The PSO must put in place security controls to prevent infiltration into its network from vendor environments. It must adhere to the legal and regulatory requirements on the geographical location of infrastructure and on processing, storage and usage of data, and ensure its vendors comply too. For vendors involved in critical processes and activities, which a footnote defines by reference to the same outsourcing framework, it must obtain certified assurance from an independent auditor on the vendor's cyber resilience capabilities.

Other paragraphs put vendors into records the PSO must keep and tests it must run. Paragraph 14 requires a record of key roles, information assets, critical functions, processes and third-party service providers, classified by usage, criticality and business value, and a process flow diagram that includes third-party systems. Paragraph 17(c) requires the PSO to obtain the source code of critical applications procured from third-party vendors, or an escrow arrangement where that is not possible. Under paragraph 18(b), where the PSO does not own the source code it must obtain a certificate from the application developer that the application is free of vulnerabilities, malware and covert channels, renewed whenever the code changes. Paragraph 25(a) extends information security training to vendors managing the PSO's information assets.

Cloud providers get their own paragraph. Under paragraph 26 a PSO using cloud services needs a cloud operation policy as part of its Board-approved information security policy, covering the cloud service provider's roles and responsibilities and data localisation among other things. The PSO must ensure the provider is subject to independent information and cyber security audits at least annually, and the Board sub-committee responsible for IT oversight must review those audit reports and the provider's performance every year.

What will the system auditor check about vendor oversight?

Paragraph 36 requires a System Audit Report every year, conducted by a CERT-In empanelled auditor, a Certified Information Systems Auditor registered with ISACA, or a holder of ICAI's Diploma in Information System Audit. It is due within two months of the close of the financial year: by 1 June for entities on an April to March year and by 1 March of the following year for entities that close on the calendar year. Under paragraph 37 there should be no conflict of interest: the audit firm and its sister concerns should not have provided any service to the audited entity during the last two financial years.

Paragraph 38 fixes the scope, and the auditor must comment on every item. Item (xi), Vendor/Third Party Risk Management, asks the auditor to assess whether outsourcing risks are managed through oversight measures that should include, among others, the five points listed below.

Paragraph 41 requires the report and the compliance status to be placed before the Board. Each open observation needs time-bound corrective action, within a maximum of three months, reported to RBI, and an observation is closed only after the auditor accepts the closure.

• A service level agreement that mandatorily includes a right of audit or inspection by the home country regulators.
• Assessment of the security controls during on-boarding or off-boarding.
• Implementation of baseline cyber security controls by the service provider.
• The service provider's responsibility to get its systems audited to ensure error-free operation.
• Mandatory disclosure of any security incident specific to the entity's systems or processes.

What is the 6-hour incident reporting rule?

Paragraph 22(d) requires unusual incidents, such as cyber-attacks, an outage of a critical system or infrastructure, internal fraud or a settlement delay, to be reported to RBI in the Incident Reporting Format in Annex 1 within 6 hours of detection. Annex 2 gives an indicative list of incident types. Any cyber security incident must also be reported to CERT-In. Paragraph 22(a) requires a Board-approved incident response mechanism that provides for prompt notification of senior management and of regulatory, supervisory and relevant public authorities.

The six hours run from detection, and many incidents surface first at a vendor. The Directions give the PSO two levers for that. One is the system-audit item above on mandatory disclosure of security incidents by service providers. The other, for white label ATM operators, is paragraph 52(c): the switch provider must inform the operator about any cyber security incident concerning it on a timely basis, even where the provider's own infrastructure is managed by third parties. The paragraphs on vendors and incident reporting (5, 19, 22, 38(xi) and 52) set no hour limit for the vendor's notice to the PSO, so the contract has to.

What do the Directions require of white label ATM operators and their switch providers?

Section VI carries the controls for third party ATM switch application service providers. Under paragraph 42, a white label ATM operator that runs its switch ecosystem through a provider's shared services must ensure that the contract mandates the provider to comply with the listed cyber security controls on an ongoing basis and to give RBI access for on-site and off-site supervision. The controls that follow cover, among other things, network security, secure configuration, the application security life cycle, patch and change management, user access, audit logs, incident response, vulnerability assessment and penetration testing, and a security operations centre.

What should a payment aggregator's vendor team do now?

For large and medium operators the Directions are already in force, so the work is to show that each obligation has a record behind it. A practical order is set out below. None of it depends on a particular tool.

• List every third-party service provider against the function it supports, and mark which are involved in critical processes as the 3 August 2021 outsourcing framework defines them (paragraphs 14 and 19).
• For each critical vendor, hold the independent auditor's assurance on its cyber resilience, with the auditor's name, the date and the period covered (paragraph 19(c)).
• Re-read each service agreement for the regulator's right of audit or inspection, a duty to disclose security incidents with a time limit short enough to let you meet six hours, and adherence to the Directions where the vendor is an unregulated ecosystem entity (paragraphs 5, 22(d) and 38(xi)).
• Put the Board-approved policy on unregulated ecosystem entities, the cloud operation policy and the incident response mechanism on the Board calendar with review dates (paragraphs 5, 22(a) and 26(a)).
• For cloud providers, file the latest independent security audit report and the date the Board sub-committee reviewed it (paragraph 26(c)).
• Diarise the System Audit Report: 1 June for an April to March year, and three months at most for each open observation (paragraphs 36 and 41).

Where do IntelloVendor and IntelloComply fit?

IntelloVendor, IntelloSync's vendor management product, keeps a register of outsourced arrangements with a materiality rubric that tiers suppliers, and produces a board-ready outsourcing compliance report. Its RBI material-outsourcing assessment and RBI outsourcing clause playbook were built on RBI's outsourcing directions for banks and NBFCs; the playbook treats inspection language conditioned on the provider's consent as a failure rather than a pass. A high or critical incident logged against a supplier re-scores it and pulls its next review forward.

We do not publish a template specific to the 2026 PSO Directions or to the 3 August 2021 outsourcing framework for PSOs, and IntelloVendor does not file incident reports with RBI or CERT-In. IntelloComply holds recurring items, such as the System Audit Report date and annual policy reviews, as rules with an owner, a reviewer and filing evidence. Interpretation of the Directions remains with your compliance and legal teams.