RegTracA CashlessConsumer Register

RBI briefs · register entry

2026-11-09 · weekly

The week's biggest move came from consolidation. On 5 November 2026 the Reserve Bank of India issued a single rulebook for the cybersecurity of the companies that move the country's non-bank money (RBI notifications page, 5 Nov 2026 entry).

What changed

RBI issued the Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators, circular RBI/DPSS/2026-27/475, dated 5 November 2026, under section 10(2) read with section 18 of the Payment and Settlement Systems Act, 2007 (notification PDF; full text via TaxGuru). It consolidates the Master Directions of 30 July 2024 with the cyber-security controls for third-party ATM switch application service providers (2019) and the system-audit directions for payment systems (2020), naming the circulars it repeals (TaxGuru). The directions apply to every authorised non-bank PSO — prepaid payment instrument issuers, payment aggregators, card networks, white-label ATM operators — and extend to unregulated ecosystem entities, such as payment gateways and vendors, through contractual adherence under a Board-approved policy (TaxGuru). Large and medium PSOs must comply from the date of placement on the RBI website; small PSOs from 1 April 2028 (TaxGuru; Informist, 5 Nov 2026). The substance spans governance (Board oversight, annually reviewed information-security policy, cyber crisis management plan, a Chief Information Security Officer), baseline technical controls, and an annual System Audit Report due within two months of the financial-year close, with unresolved observations ordinarily corrected within three months (TaxGuru). Incident reporting is clocked: cyberattacks, critical outages, internal fraud and settlement delays must reach RBI within six hours of detection (cyber incidents also to CERT-In), and audit logs are preserved for at least five years (TaxGuru; PSU Watch, 6 Nov 2026). The same text carries consumer-facing controls: a minimum 12-hour cooling period before online payments are allowed after a change to the registered mobile number or email linked to a payment instrument, and transaction display rules — merchant name and amount, or beneficiary name and debit amount for transfers, taken from the entity maintaining the beneficiary account (TaxGuru; Informist).

Why it matters

Consolidation is not housekeeping; it relocates accountability. Obligations spread across three instruments issued between 2019 and 2024 now live in one checkable text with the repeals named, so a customer, auditor or journalist can check what an operator owes in one place (TaxGuru). RBI issued a parallel technology-rulebook consolidation for banks and regulated entities on 31 July 2026 (KPMG, Sep 2026); non-bank payment operators now have theirs. It lands three weeks before the deadline in last week's edition: the Supreme Court is supervising RBI's KYC Amendment Directions, due to be notified by 30 November 2026. Payment rule-writing is moving on two fronts: conduct rules under court supervision, a security rulebook by consolidation. NPCI, tracked in this register as non-statutory context, is an RBI-authorised non-bank payment system operator (register entry), so the consolidated directions reach it too (TaxGuru).

Who is affected

Everyone who pays through a non-bank operator — wallet and PPI users, merchants on payment aggregators, card users, white-label ATM customers. The 12-hour cooling period after a registered mobile or email change closes a takeover path: someone who seizes a victim's number cannot immediately transact online on the linked instrument (TaxGuru). The display rules make payment notifications carry the merchant or beneficiary name, so a customer can see who actually received the money (TaxGuru). Customers of small PSOs wait longer for the full protection — they comply from 1 April 2028 (TaxGuru). If a payment fails or fraud is suspected: complain to the bank or payment service provider first, escalate through NPCI's dispute channels, then take unresolved complaints to the RBI Integrated Ombudsman at cms.rbi.org.in (register entry). Which industry bodies pressed for speed or carve-outs during the consolidation is LobbyWatch's ledger; the industry and self-regulatory layer that borrows these conduct rules back is SROTrac's.

What to watch

Evidence

Sources

Editorial swarm: tracker ✓ · institutional ✓ · advocate ✓ · skeptic ✓ · mapper ✓ · evidence ✓ · editor ✓ · gated by scripts/editorial.py on 2026-11-10 02:17 UTC.

← All briefs

The Sousveillance Stack — who writes, borrows and buys the rules

Layer 1 · rule-writersRegTracIndia's statutory financial regulatorsyou are here Layer 2 · rule-borrowersSROTracIndia's financial-sector self-regulatory organisationslive Layer 3 · rule-buyersLobbyWatchconsultations, access, revolving doorslive