RBI Cyber Resilience Master Directions 2026 Bring System Audits and ATM Switch Providers Under One Rulebook for Payment Operators

The Reserve Bank of India has reissued its cyber security rules for non-bank payment system operators as the Master Directions on Cyber Resilience and Digital Payment Security Controls, dated 5 November. The circular, RBI/DPSS/2026-27/475, pulls two older sets of instructions into the 2024 framework: the system-audit rules for payment systems and the cyber controls for third-party ATM switch providers.

Large and medium operators must comply from the day the directions appear on RBI's website, and small ones from 1 April 2028.

Who it covers

The large tier takes in NPCI, CCIL, card networks, non-bank ATM networks, white-label ATM operators, large prepaid instrument issuers and payment aggregators. Cross-border money transfer operators and mid-sized wallet issuers sit in the medium tier, small wallet issuers and instant money transfer operators in the small one.

What is new

The first new section governs the system audit. The report is due "within two months of close of their respective financial year", from a CERT-In empanelled auditor or a CISA or DISA holder, and "for each open observation, specific time-bound (maximum 3 months) corrective action must be taken and reported to RBI".

The second reaches the companies that run ATM switching for white-label ATM operators. Those operators' contracts must "necessarily mandate the ASP to comply" with the cyber controls and give RBI access for supervision, and the providers must set up a cyber security operations centre "at the earliest, if not yet set-up".

Circulars repealed

Six instructions are withdrawn: the December 2019 circular on ATM switch providers, the January 2020 review of system-audit scope and four audit circulars from 2009 to 2011.