For small non-bank PSOs, the directions shall come into effect from April 01, 2028.
FinTech BizNews Service
Mumbai, 05 November, 2026: To ensure that the authorised non-bank Payment System Operators (PSOs) are resilient to existing and emerging information systems and cyber security risks, it has been decided by the RBI to consolidate the directions, issued from time to time on the subject, into a single Master Direction on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators. The consolidated Master Directions cover governance mechanisms for identification, assessment, monitoring and management of these risks.
The RBI today issued Master Directions (MDs) on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators (PSOs)
The Directions shall come into effect on the day they are placed on the official website of the RBI for Large and Medium non-bank PSOs. For small non-bank PSOs, the directions shall come into effect from April 01, 2028.
Applicability
The provisions of these Directions shall apply to all authorised non-bank PSOs.
To effectively identify, monitor, control and manage cyber and technology related risks arising out of linkages of PSOs with unregulated entities who are part of their digital payments ecosystem (like payment gateways, third party service providers, vendors, third party ATM Switch Application Service Providers (ASPs), etc.), PSOs shall ensure adherence to these Directions by such unregulated entities as well, subject to mutual agreement. An organisational policy in this respect, approved by the Board, shall be put in place.
Governance Controls
The Board of Directors (Board) of the PSO shall be responsible for ensuring adequate oversight over information security risks, including cyber risk and cyber resilience. However, primary oversight may be delegated to a sub-committee of the Board, headed by a member with experience in information / cyber security, which shall meet at least once every quarter.
Cyber Security Preparedness
The PSO shall prepare a distinct Board approved Cyber Crisis Management Plan (CCMP) to detect, contain, respond and recover from cyber threats and cyberattacks. Relevant guidelines from CERT-In / National Critical Information Infrastructure Protection Centre (NCIIPC) / IDRBT and other agencies may be referred for guidance.
Risk Assessment and Monitoring 10. The Board shall entrust the responsibility and accountability for implementing the IS policy and the cyber resilience framework as well as for continuously assessing the overall IS posture of PSO to a senior level executive with expertise in areas of information security including cyber security. [e.g. Chief Information Security Officer (CISO)].
The PSO shall define appropriate Key Risk Indicators (KRIs) to identify potential risk events and Key Performance Indicators (KPIs) to assess the effectiveness of security controls. These KRIs and KPIs shall be continuously monitored by the subcommittee of the Board
A complete process flow diagram of network resources, inter-connections and dependencies, and data flows with other information assets, including any other third-party systems, shall be created and maintained. Asset information shall necessarily include an identifier, network address, asset location, asset owner name and End of Life Support (EoLS). All assets (hardware or software) approaching EoLS shall be assessed to evaluate risks associated with the continued use of the unsupported asset.
All individuals having access to the IT environment of the PSO shall be assigned a digital identity, which shall be maintained and monitored till termination. (c) Default authentication settings in systems / software / services shall be deactivated and changed before they are rolled out to live environment.
Click to know further details: https://www.rbi.org.in/scripts/NotificationUser.aspx
