Skip to main content

Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators (PSOs)

Reserve Bank of India (RBI) has issued directions on cyber resilience and digital payment security controls for non-bank Payment System Operators (PSOs).

To whom are the directions applicable?

The directions shall apply to all authorised non-bank Payment System Operators (PSOs).

To effectively manage cyber and technology related risks arising out of linkages of PSOs with unregulated entities (like payment gateways, third party service providers, vendors, etc.), PSOs shall ensure adherence to the directions by such unregulated entities as well, subject to mutual agreement. 

What are different categories of non-bank PSOs?

What are the timelines for complying with the directions?

To provide adequate time to put in place the necessary compliance structure, a phased implementation approach is prescribed as under –

Regulated Entity Timeline
Large non-bank PSOs April 1, 2025
Medium non-bank PSOs April 1, 2026
Small non-bank PSOs April 1, 2028

If a PPI Issuer moves to a higher category, the timeline of the category to which it moves into, would apply. For instance, if a small (or medium) PPI issuer moves into medium (or large) category, it will need to comply with the directions within 2 (or 1) years from the time of new categorisation.

What are some of the important directions on cyber resilience and digital payment security controls for non-bank PSOs?

  • The Board of Directors (Board) of the PSO shall be responsible for ensuring adequate oversight over information security risks, including cyber risk and cyber resilience. However, primary oversight may be delegated to a sub-committee of the Board, headed by a member with experience in information / cyber security, which shall meet at least once every quarter.
  • The PSO shall formulate a Board approved Information Security (IS) policy to manage potential information security risks covering all applications and products concerning payment systems as well as management of risks that have materialised. The policy shall be reviewed annually.
  • The PSO shall prepare a distinct Board approved Cyber Crisis Management Plan (CCMP) to detect, contain, respond and recover from cyber threats and cyber attacks.
  • The Board shall entrust the responsibility and accountability for implementing the IS policy and the cyber resilience framework as well as for continuously assessing the overall IS posture of PSO to a senior level executive with expertise in areas of information security including cyber security [e.g. Chief Information Security Officer (CISO)].
  • The PSO shall follow a ‘secure by design’ approach such as Secure-Software Development Life Cycle (S-SDLC) for design and development of products / services.
  • To safeguard applications against risks emanating from insecure Application Programming Interfaces (APIs), the PSO shall put in place, inter-alia, the following measures –
    • Authentication and Authorisation – Establish identity of the communicating applications.
    • Confidentiality – Ensure that the message content is not tampered with.
    • Integrity – Resources are reliably transferred.
    • Availability and Threat Protection – APIs are available when needed; anomalous activities identified and mitigative action taken.
  • Whenever there is a change in registered mobile number or email ID linked to the payment instrument there shall be a cooling period of minimum 12 hours before allowing any payment transaction through online modes / channels.
  • Audit logs shall be preserved for at least 5 years.

What are the reporting requirements?

  • Unusual incidents like cyber-attacks, outage of critical system / infrastructure, internal fraud, settlement delay, etc., shall be reported to RBI within 6 hours of detection. 
  • Any cyber security incident shall also be reported to Indian Computer Emergency Response Team (CERT-In).


References

Reserve Bank of India. (2024, July 30). 'Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators'. Retrieved from https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12715&Mode=0


Follow at - Telegram   Instagram   LinkedIn   X   Facebook

Labels:

Comments

Post a Comment

Popular Posts

Payment of Agency Commission to Agency Banks (ABs) and Disbursement of Government Pension by ABs

Reserve Bank of India (RBI) has issued guidelines on the conduct of Government business by Agency Banks (ABs), payment of agency commission to ABs and disbursement of Government pension by ABs. Who are ABs? ABs mean all Public Sector Banks (PSBs), scheduled Private Sector Banks (PVBs), scheduled Payments Banks (PBs), and scheduled Small Finance Banks (SFBs) appointed by the RBI under Section 45 of the RBI Act, 1934, by mutual agreement, to carry out Government banking business of the Central Government (CG) / State Governments (SGs). What is agency commission? Agency commission means the remuneration paid by the RBI to an AB in consideration of it acting as an agent of the RBI in the conduct of general banking business of the CG and the SGs at the places and in the manner specified in the agreement between the RBI and the bank, with the exception of the functions relating to the management of the public debt. What are the guidelines on appointment of ABs? Any eligible bank which intend...
Post a Comment
Read more

Kisan Credit Card (KCC) Scheme

Reserve Bank of India (RBI) has issued directions on Kisan Credit Card (KCC) Scheme. To whom are the directions applicable? The directions are applicable to the following entities – Commercial Banks (excluding overseas branches of Indian banks) Small Finance Banks (SFBs) Regional Rural Banks (RRBs) Rural Co-operative Banks – State Co-operative Banks (StCBs) Central Co-operative Banks (CCBs) To which loans shall the directions be applicable? The directions shall be applicable to loans sanctioned under the KCC Scheme with effect from January 01, 2027.  What are the crop seasons? Crop season means the period up to harvesting and marketing of the crops raised. Short duration crops shall mean crops with anticipated period from sowing to marketing up to 12 months. Long duration crops mean crops which are not short duration crops. The crop season for long duration crops i.e., anticipated period from sowing to marketing is more than 12 months and up to 18 months. For the purpose of the KCC...
Post a Comment
Read more

Credit Derivatives

Reserve Bank of India (RBI) has issued directions on credit derivatives. What is Credit Derivative? Credit derivative means a derivative contract whose value is derived from the credit risk of an underlying debt instrument or an index of underlying debt instruments. What is Credit Default Swap (CDS) and Total Return Swap (TRS)? Credit Default Swap (CDS) means a credit derivative contract in which one counterparty (protection seller) commits to pay to the other counterparty (protection buyer) in the case of a credit event with respect to a reference entity and in return, the protection buyer makes periodic payments (premium) to the protection seller until the maturity of the contract or the credit event, whichever is earlier. Total Return Swap (TRS) means a credit derivative contract under which one counterparty (total return payer) commits to transfer the entire economic performance of a reference asset to the other counterparty (total return receiver), and, in return, receives a pre-d...
Post a Comment
Read more

Deposits between a person resident in India and a person resident outside India

Reserve Bank of India (RBI) has updated the regulations on deposits between a person resident in India and a person resident outside India. What are the restrictions on deposits between a person resident in India and a person resident outside India? No person resident in India shall accept any deposit from, or make any deposit with, a person resident outside India. However, the following deposits are exempted – Deposits held in rupee accounts maintained by foreign diplomatic missions and diplomatic personnel and their family members in India with an authorised dealer. Deposits held by diplomatic missions and diplomatic personnel in special rupee accounts namely Diplomatic Bond Stores Account to facilitate purchases of bonded stocks from firms and companies who have been granted special facilities by customs authorities for import of stores into bond. The funds in the account may be repatriated outside India without the approval of the RBI. Deposits held in accounts maintained in foreig...
Post a Comment
Read more

Lead Bank Scheme (LBS)

Reserve Bank of India (RBI) has issued guidelines on the Lead Bank Scheme (LBS). Who is a Lead Bank? RBI designates a commercial bank as Lead Bank in each district, to coordinate the efforts of the banks, Government, National Bank for Agriculture and Rural Development (NABARD) and other stakeholders at the district level to improve credit flow to the priority sectors and promote financial inclusion in the district. 12 public sector banks and 2 private sector banks (Jammu & Kashmir Bank and ICICI Bank) have been assigned lead bank responsibilities, covering 778 districts across the country. What appointments are made under the LBS? Every lead bank shall appoint a Lead District Manager (LDM) in each district where it has the lead bank responsibility, to exclusively oversee and coordinate the implementation of the LBS in the district. NABARD shall appoint a District Development Manager (DDM) for each district to act as a liaison between NABARD and the district-level banking and financ...
Post a Comment
Read more