RBI tightens cyber security framework for non-bank payment operators

The Reserve Bank of India has consolidated its cyber security guidelines for non-bank payment system operators (PSOs), establishing a comprehensive regulatory framework designed to strengthen defences across the digital payments ecosystem. The revised directions, which came into force with immediate effect, represent a significant consolidation of existing cyber security requirements and introduce new mandatory measures for the sector.

Under the new framework, payment service operators must conduct annual system audits and implement enhanced source code safeguards to protect critical infrastructure. The directions also establish stricter oversight mechanisms for third-party ATM switch providers, recognising the operational risks inherent in outsourced payment infrastructure. Large and medium-sized PSOs are required to comply with these provisions immediately, reflecting the RBI's prioritisation of cyber resilience among systemically important payment players.

The consolidated directions address gaps in existing regulations by bringing together previously scattered cyber security requirements into a single, coherent framework. This approach aims to reduce compliance ambiguity while raising the baseline security standards across the non-bank payment sector, which has expanded significantly in recent years with the proliferation of digital payment modes and fintech innovations.

The move underscores the RBI's commitment to safeguarding India's payment infrastructure against evolving cyber threats. As digital transactions continue to grow across the country, robust security protocols have become essential to maintain public confidence in non-traditional payment channels and protect consumer data from potential breaches.