Skip to main content

Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators (PSOs)

Reserve Bank of India (RBI) has issued directions on cyber resilience and digital payment security controls for non-bank Payment System Operators (PSOs).

To whom are the directions applicable?

The directions shall apply to all authorised non-bank Payment System Operators (PSOs).

To effectively manage cyber and technology related risks arising out of linkages of PSOs with unregulated entities (like payment gateways, third party service providers, vendors, etc.), PSOs shall ensure adherence to the directions by such unregulated entities as well, subject to mutual agreement. 

What are different categories of non-bank PSOs?

What are the timelines for complying with the directions?

To provide adequate time to put in place the necessary compliance structure, a phased implementation approach is prescribed as under –

Regulated Entity Timeline
Large non-bank PSOs April 1, 2025
Medium non-bank PSOs April 1, 2026
Small non-bank PSOs April 1, 2028

If a PPI Issuer moves to a higher category, the timeline of the category to which it moves into, would apply. For instance, if a small (or medium) PPI issuer moves into medium (or large) category, it will need to comply with the directions within 2 (or 1) years from the time of new categorisation.

What are some of the important directions on cyber resilience and digital payment security controls for non-bank PSOs?

  • The Board of Directors (Board) of the PSO shall be responsible for ensuring adequate oversight over information security risks, including cyber risk and cyber resilience. However, primary oversight may be delegated to a sub-committee of the Board, headed by a member with experience in information / cyber security, which shall meet at least once every quarter.
  • The PSO shall formulate a Board approved Information Security (IS) policy to manage potential information security risks covering all applications and products concerning payment systems as well as management of risks that have materialised. The policy shall be reviewed annually.
  • The PSO shall prepare a distinct Board approved Cyber Crisis Management Plan (CCMP) to detect, contain, respond and recover from cyber threats and cyber attacks.
  • The Board shall entrust the responsibility and accountability for implementing the IS policy and the cyber resilience framework as well as for continuously assessing the overall IS posture of PSO to a senior level executive with expertise in areas of information security including cyber security [e.g. Chief Information Security Officer (CISO)].
  • The PSO shall follow a ‘secure by design’ approach such as Secure-Software Development Life Cycle (S-SDLC) for design and development of products / services.
  • To safeguard applications against risks emanating from insecure Application Programming Interfaces (APIs), the PSO shall put in place, inter-alia, the following measures –
    • Authentication and Authorisation – Establish identity of the communicating applications.
    • Confidentiality – Ensure that the message content is not tampered with.
    • Integrity – Resources are reliably transferred.
    • Availability and Threat Protection – APIs are available when needed; anomalous activities identified and mitigative action taken.
  • Whenever there is a change in registered mobile number or email ID linked to the payment instrument there shall be a cooling period of minimum 12 hours before allowing any payment transaction through online modes / channels.
  • Audit logs shall be preserved for at least 5 years.

What are the reporting requirements?

  • Unusual incidents like cyber-attacks, outage of critical system / infrastructure, internal fraud, settlement delay, etc., shall be reported to RBI within 6 hours of detection. 
  • Any cyber security incident shall also be reported to Indian Computer Emergency Response Team (CERT-In).


References

Reserve Bank of India. (2024, July 30). 'Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators'. Retrieved from https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12715&Mode=0


Follow at - Telegram   Instagram   LinkedIn   X   Facebook

Labels:

Comments

Post a Comment

Popular Posts

Regulatory Measures for the Foreign Exchange Market

Reserve Bank of India (RBI) has announced regulatory measures for the foreign exchange market. Cancellation and rebooking / rollovers of foreign exchange derivative contracts An Authorised Dealer shall not permit users to rebook any foreign exchange derivative contract involving the INR, whether deliverable or non-deliverable, which has been cancelled with any of the Authorised Dealers. An Authorised Dealer may, however, continue to permit users to rollover foreign exchange derivative contracts on maturity, subject to compliance with the extant directions. Threshold limit for taking positions without requirement to establish the existence of underlying Authorised Dealers were permitted to allow users to take positions upto USD 100 million equivalent of notional value (outstanding at any point of time), across all Authorised Dealers, for hedging contracted exposure without the requirement to establish the existence of underlying exposure.  Further, a user was allowed to take positio...
Post a Comment
Read more

Credit Facilities to Scheduled Castes (SCs) & Scheduled Tribes (STs)

Reserve Bank of India (RBI) has issued guidelines on credit facilities to Scheduled Castes (SCs) & Scheduled Tribes (STs). What are the guidelines on credit facilities to SCs & STs? District Level Consultative Committees formed under the Lead Bank Scheme should continue to be the principal mechanism of co-ordination between banks and development agencies.  National Scheduled Tribes Finance & Development Corporation and National Scheduled Castes Finance & Development Corporation have been set up under the administrative control of Ministry of Tribal Affairs and Ministry of Social Justice & Empowerment, respectively. Banks should advise their branches / controlling offices to render all the necessary institutional support to enable these institutions to achieve the desired objectives. Loans sanctioned to State Sponsored Organisations for Scheduled Castes / Scheduled Tribes for the specific purpose of purchase and supply of inputs and / or the marketing of the out...
Post a Comment
Read more

Cash Reserve Ratio (CRR) and Statutory Liquidity Ratio (SLR) (Updated as on September 11, 2026)

Reserve Bank of India (RBI) has issued the directions on maintenance of Cash Reserve Ratio (CRR) and Statutory Liquidity Ratio (SLR) by banks. To whom are the directions applicable? The directions are applicable to the following Regulated Entities (REs) – Commercial Banks  Small Finance Banks (SFBs) Payments Banks (PBs) Local Area Banks (LABs) Regional Rural Banks (RRBs) Primary (Urban) Co-operative Banks (UCBs) Rural Co-operative Banks – State Co-operative Banks (StCBs) District Central Co-operative Banks (DCCBs) What is CRR? Every bank shall maintain in India by way of cash reserve, a sum equivalent to such percent of its Net Demand and Time Liabilities (NDTL) in India, as the RBI in terms of Section 42(1) of the RBI Act, 1934 (for scheduled banks) and Section 18(1) of the Banking Regulation Act (BR Act), 1949 (for non-scheduled banks) [including provisions of Section 18(1) of the BR Act as applicable to co-operative banks], may specify. What is incremental CRR? In terms of Secti...
Post a Comment
Read more

What is Ways and Means Advances (WMA)? (Updated as on September 25, 2026)

Reserve Bank of India (RBI) has recently announced the Ways and Means Advances (WMA) limit for the Government of India. So, what is WMA? What is Ways and Means Advances (WMA)? Ways and Means Advances (WMA) is a collateral free clean advance availed by the Central and State Governments from RBI, to tide over temporary mismatches in the receipts and payments. Section 17(5) of the Reserve Bank of India Act, 1934 empowers RBI to grant WMA to Central and State Governments, as and when required by them. What is Special WMA / Special Drawing Facility (SDF)? In addition to WMA, State Governments are also eligible for a Special Drawing Facility (SDF), which is granted against collateral of Government Securities held by the State Governments.  SDF availed by State Governments / UTs is linked to the quantum of their investments in marketable securities issued by the Government of India, including Auction Treasury Bills (ATBs).  (Updated as on June 28, 2024) Based on the recommendations m...
Post a Comment
Read more

Framework for Self-Regulatory Organisations in the FinTech Sector (Updated on September 10, 2026)

Reserve Bank of India (RBI) has released the framework for self-regulatory organisations in the FinTech sector. What are FinTechs? For the purpose of membership of an Self-Regulatory Organisations for FinTech Sector (SRO-FT), FinTechs may be defined as entities that provide technological solutions for delivery of financial products and services to businesses and consumers or encompass regulatory and supervisory compliance in partnership with traditional financial institutions or otherwise.  What is the need of Self-Regulatory Organisations for FinTech Sector? FinTechs play a pivotal role in redefining financial services by saving time, enhancing access, and lowering costs. While the FinTechs bring various innovations, the FinTech sector also raises concerns relating to customer protection, data privacy, cyber security, grievance handling, internal governance, financial system integrity, etc. A judicious balance between maximising the creative potential of FinTechs, while minimising...
Post a Comment
Read more