On 5 November 2026 the Reserve Bank of India issued a single master direction on cyber security for non-bank payment system operators. It covers NPCI, card networks, payment aggregators, prepaid wallet issuers and others. Headlines have stressed a six-hour incident-reporting window and a 12-hour cooling period after a mobile or email change. Those two rules are real, but they are not new. The more important change is structural, and the open question is how the new audit regime will work in practice.
What actually changed
Per MediaNama's explainer, the direction merges the July 2024 cyber resilience rules with older material on ATM switch providers (2019) and annual system audits (2020), and repeals six circulars issued between 2009 and 2020. RBI says the aim is a "single reference point for the entities."
The 2024 text, RBI/DPSS/2024-25/123 dated 30 July 2024, already required unusual incidents to be reported to RBI "within 6 hours of detection" (paragraph 22.4) and a 12-hour cooling period after a registered mobile number or email change (paragraph 31.7). It was issued under Section 10(2) read with Section 18 of the Payment and Settlement Systems Act, 2007, as the RBI notification page records. So the 2026 direction mostly restates those obligations.
What MediaNama describes as new is the annual independent IT audit covering 20 areas, ranging from data security to mobile apps. Operators on an April-March year must file the report with RBI by 1 June and fix findings within three months. Large and medium operators are covered immediately; small ones have until 1 April 2028. MediaNama's piece does not list the 20 areas, and we have not independently confirmed them against the full 2026 text.
The case for the regulator
The strongest argument for tough, prescriptive rules is that payments infrastructure is a systemic utility. UPI, card rails and wallets carry daily life for hundreds of millions of people. A breach at one aggregator can hit merchants and consumers who never chose that vendor. Fast reporting lets RBI see correlated attacks early. Cooling periods blunt account-takeover fraud, where a thief swaps the phone number and drains the balance within minutes. Regulators can also point out that voluntary security spending is usually the first thing cut when margins are thin.
That argument is persuasive, and it is why consolidation deserves support. Operators that had to reconcile a 2019 ATM circular, a 2020 audit circular and a 2024 master direction faced real ambiguity about which text governed. Ambiguity is its own security risk: compliance teams spend effort on mapping rather than on defending systems.
Where proportionality matters
The direction does tier its obligations by size: large, medium and small operators, with the small tier getting until April 2028. That is the right instinct. Proportionate regulation fits obligations to the risk a firm poses, not to the label on its licence.
But several features deserve scrutiny.
- Audit as a paperwork exercise. A 20-area annual audit is only valuable if findings track real risk. If auditors work from a checklist, firms optimise for passing it. Good regimes reward demonstrated outcomes, such as tested recovery and measured detection times.
- Reach into the supply chain. Payment companies must make unregulated partners such as gateways, vendors and ATM switch providers follow the rules "subject to mutual agreement," under a board-approved policy. That pushes obligations onto firms RBI does not license. Large operators can negotiate this; a small vendor serving several of them may face contradictory demands.
- Prescriptive technical controls. The direction specifies device binding, auto-logout after inactivity, lockouts after failed logins, OTP placement in alert messages, and a disaster recovery site in a different seismic zone with drills at least every six months. Some are sensible baselines. But specifying the control rather than the outcome ages badly as attack methods and authentication technology change.
- Data localisation. The direction extends localisation expectations to vendors and cloud policies, according to MediaNama. Localisation can simplify supervision, but it does not by itself make systems more secure, and it can raise costs for smaller innovators that rely on global cloud providers.
Why the six-hour clock needs care
A six-hour window from detection is demanding. It is defensible for serious incidents because delay compounds harm. But a clock that starts at detection and covers broad categories, which Outlook Money lists as cyberattacks, critical outages, internal fraud and settlement delays, risks flooding the regulator with preliminary reports while engineers are still trying to establish what happened. The practical remedy is already available to RBI: accept an initial short notification with later updates, and publish clear guidance on what qualifies. Reporting should also be coordinated with the separate duty to notify CERT-In so that firms file once in a usable format.
What to watch
Three things will decide whether this is good regulation. First, whether RBI publishes the audit criteria and a template so that firms and auditors apply the same standard. Second, whether supervisors treat first-time reporting lapses as learning opportunities rather than enforcement targets, particularly for small wallets and fintechs. Third, whether RBI revisits prescriptive controls periodically instead of letting them harden into fixed requirements.
MediaNama also notes that RBI sent a confidential advisory to banks on 3 November about NBFC and fintech APIs, and that a "kill switch" is reportedly under study but "has not been finalised." That is a separate matter and should not be conflated with this direction. It does show that more rules are coming, which is another reason to keep the baseline coherent.
Consolidating the rulebook is the least glamorous part of this story and probably the most valuable. A single text lowers compliance cost, makes enforcement more predictable, and frees security teams to do security work. The risk lies in what gets layered on top: an audit regime that grows into a box-ticking industry, and supply-chain obligations that quietly shut out smaller innovators. India's payment system has succeeded because it combined strong rails with room for new entrants. Cyber regulation should protect both.