RBI revises cyber security rules for non-bank payment firms such as wallets and card networks

The full story

The Reserve Bank of India (RBI) has issued revised Master Directions on cyber resilience and digital payment security controls for non-bank payment system operators (PSOs). It has merged two older sets of guidelines, on cyber security for third-party ATM switch service providers and on system audits of payment systems, into the direction it first issued in July 2024.

Who it applies to

The rules apply to all authorised non-bank PSOs. RBI treats NPCI, card networks, large prepaid payment instrument (PPI) issuers and payment aggregators as large operators. Medium PPI issuers and inbound cross-border money transfer operators under the Money Transfer Service Scheme (MTSS) are medium, and small PPI issuers and instant money transfer operators are small.

The directions apply from the day they are published for large and medium operators, and from 1 April 2028 for small ones. Operators must also get unregulated partners in their payments chain, such as payment gateways and vendors, to follow them, subject to mutual agreement.

What it means for customers

• Alerts should mask account and card numbers as far as possible.
• Alerts for online payments should name the merchant rather than the payment gateway, along with the amount.
• Where an OTP is used, it should come at the end of the message, which should refer to the specific transaction.
• Apps and websites should let customers, with the necessary authentication, mark a transaction as fraudulent so the issuer is told immediately.
• For mobile payments, when the mobile number or email linked to a payment instrument changes, online payments wait at least 12 hours.
• Mobile payment apps must be bound to the device and SIM and end sessions after a period of inactivity. Where applicable, they must block access after too many failed attempts, and they must detect remote access apps as far as possible and block the payment app while one is live.

What operators must do

• Keep board oversight of cyber risk. If primary oversight is delegated to a board sub-committee, it must meet at least once a quarter.
• Have a board-approved cyber crisis management plan.
• Report unusual incidents such as cyber-attacks or outages of critical systems to RBI within 6 hours of detection, and report cyber security incidents to CERT-In.
• Get a system audit by qualified auditors every year.

RBI says its existing security rules for card payments, prepaid instruments and mobile banking continue to apply. Where instructions conflict, this direction prevails.