Key Facts

The Reserve Bank of India's Master Directions on Cyber Resilience issued on 11 November 2026 lay down enforceable mandates:

  • Applicability: Covers non-bank Payment System Operators (PSOs) including Payment Aggregators (PAs), Prepaid Payment Instrument (PPI) issuers, Bharat Bill Payment Operating Units (BBPOUs), and White Label ATM Operators (WLAOs).
  • Statutory Authority: Issued under Section 10.
  • read with Section 18 of the Payment and Settlement Systems (PSS) Act, 2007.
  • 6-Hour Reporting Window: Payment operators must report all cyber incidents and suspicious breach attempts to the RBI within 6 hours of discovery.
  • Governance Architecture: Mandatory constitution of a Board-level Information Security Committee and appointment of a dedicated Chief Information Security Officer (CISO).
  • Baseline Standards: Multi-Factor Authentication (MFA), network segmentation, API security controls, and annual third-party cybersecurity audits.

GK Context

  • The Payment and Settlement Systems Act, 2007 designates the RBI as the apex authority for the regulation and supervision of payment systems in India.
  • Digital payment transactions in India have witnessed exponential growth, crossing billions of monthly volumes driven by Unified Payments Interface (UPI).
  • To protect financial consumers against systemic fraud and cross-border ransomware, the RBI has progressively tightened security baselines through tokenization, localization of payments data, and incident-response playbooks.

Static GK

The Indian Computer Emergency Response Team (CERT-In), operating under the Ministry of Electronics and Information Technology (MeitY) as the nodal agency under Section 70B of the Information Technology Act, 2000, also mandates 6-hour incident reporting for critical internet intermediaries.

UPSC Mains Framework

GS Paper III (Internal Security & Cyber Infrastructure): Analyze the vulnerabilities in non-bank digital payment architectures in India and assess how RBI's regulatory frameworks prevent systemic financial destabilization.