RBI's new cyber rules for payments firms mandate source-code access, tighter vendor checks

The Reserve Bank of India (RBI) has tightened cybersecurity and digital payment security requirements for non-bank payment system operators (PSOs), mandating annual system audits, stricter oversight of third-party technology providers and faster reporting of cyber incidents.

The RBI's latest directions also come against the backdrop of growing concerns over cybersecurity vulnerabilities across the payments ecosystem. In its earlier confidential advisory to banks and NBFCs, the regulator had flagged the potential exposure at payment aggregators, with a banker telling The Head and Tale that the risks could be considerably higher given the scale of funds flowing through their systems. The Head and Tale had exclusively reported the advisory. 

In a Master Direction issued on November 5, the central bank has consolidated its existing instructions on cyber resilience and digital payment security into a single regulatory framework. The revised directions cover authorized non-bank PSOs, including payment aggregators (PAs), prepaid payment instrument (PPI) issuers, card networks, the National Payments Corporation of India (NPCI), NPCI Bharat Bill Pay Ltd, Bharat Bill Payment Operating Units (BBPOUs), non-bank ATM networks and white-label ATM operators.

While the directions take effect immediately for large and medium non-bank PSOs, small PSOs have been given until April 1, 2028, to comply.

The move comes amid growing cybersecurity risks across the digital payments ecosystem, where payment operators increasingly depend on third-party technology providers, cloud infrastructure and interconnected systems to process transactions.

One of the key requirements under the new framework is the introduction of tighter controls over applications procured from third-party vendors. PSOs, according to the RBI guidelines, will have to obtain the source code of all critical applications acquired from external vendors; and where obtaining the source code is not possible, there must be an escrow arrangement for the source code to ensure continuity of services.

Further, if the source code is not owned by the PSO, the operator will have to obtain a certificate from the application developer confirming that the application is free of vulnerabilities, malware and covert channels. A fresh certificate will be required whenever changes are made to the source code.

In case of vendors involved in critical processes and activities as defined in ‘Framework for Outsourcing of Payment and Settlement-related Activities by PSOs’, the PSO shall obtain certified assurance from an independent auditor on the vendor’s cyber resilience capabilities.

The RBI has also strengthened requirements around system audits. Payment system operators will have to submit their system audit reports – conducted by auditors empanelled with CERT-In or professionals holding recognised CISA or DISA qualifications – annually, within two months of the close of their financial year. For entities following the April-March financial year, the deadline will be June 1 of that year.

To avoid conflicts of interest, the audit firm or its sister concerns must not have provided any services to the entity being audited during the preceding two financial years.

The audit will cover information security governance, access controls, hardware management, network and data security, human resource security, business continuity, vendor/third-party risk management, change/patch/and log management, incident response,  application security and source code review, among other areas. Any outstanding observations will have to be addressed within a maximum period of three months, with corrective action reported to the RBI.

The revised directions also retain the requirement for payment operators to report unusual incidents, including cyberattacks, outages of critical systems or infrastructure, internal fraud and settlement delays, to the RBI within six hours of detection. Cybersecurity incidents will also have to be reported to CERT-In.

On customer-facing security, the RBI has mandated a minimum 12-hour cooling period before allowing online transactions following a change in the registered mobile number or email ID linked to a payment instrument.

PSOs offering mobile payment services will also have to ensure device binding or fingerprinting of applications with the device and SIM. Where a mobile application remains unused beyond a specified period, device binding will have to be performed again. Operators must also identify the presence of remote access applications, to the extent possible, and prohibit access to mobile payment applications while such applications are active.

The central bank has further mandated real-time or near real-time fraud monitoring systems to identify suspicious transaction behaviour and generate alerts. Payment operators must maintain a round-the-clock facility to facilitate swift resolution of unauthorized or fraudulent transactions reported by customers and respond promptly to law enforcement agencies.

Another important requirement relates to customer transaction alerts. Notifications for online payments must mention the merchant's name and transaction amount, rather than the name of the payment gateway or aggregator. The RBI has also directed operators to provide customers with a facility on their websites or mobile applications to identify and flag fraudulent transactions for immediate notification to the issuer.

PSOs using cloud services will have to establish a board-approved cloud operations policy covering the activities hosted on cloud infrastructure, responsibilities of cloud service providers, data localisation, protection and recovery requirements. Cloud service providers will have to undergo independent information and cybersecurity audits at least annually. The audit reports and the provider's overall cybersecurity capabilities will be reviewed by the PSO's board-level committee responsible for IT oversight.

The RBI has also extended cybersecurity expectations to unregulated entities connected to the payment ecosystem, including payment gateways, vendors and third-party service providers. PSOs will have to ensure that these entities adhere to the prescribed directions, subject to mutual agreement, and put in place a board-approved organisational policy for this purpose.

The revised framework also consolidates cybersecurity requirements applicable to third-party ATM switch application service providers (ASPs). White-label ATM operators using shared ATM switch infrastructure will have to ensure that their contractual arrangements require these service providers to follow prescribed cybersecurity controls and provide the RBI access for on-site or off-site supervision.

The new Master Direction repeals six earlier circulars and instructions, including the December 2019 guidelines on cybersecurity controls for third-party ATM switch application service providers and the January 2020 instructions on the scope and coverage of system audits of payment systems.

The RBI said the consolidation is intended to provide authorized non-bank PSOs with a single reference point for managing information security risks and strengthening the resilience of payment systems. Existing instructions on security and risk mitigation for card payments, PPIs and mobile banking will continue to apply. In case of any discrepancy, the provisions of the new Master Direction will prevail.