What happened
The Reserve Bank of India (RBI) has issued Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators. The notification was posted on the RBI website on 5 November 2026.
Master Directions are consolidated instructions that a regulator issues on a subject, so that the applicable rules sit in one document. Non-bank Payment System Operators are entities that run payment systems but are not banks.
What it means for you
If you pay through apps, wallets or other digital channels run by non-bank operators, the directions concern the security controls and cyber resilience of those services. Cyber resilience means the ability of a system to withstand and recover from cyber attacks.
The page available for this notification does not set out the individual requirements, deadlines or penalties, so those details are not covered here. The full document is on the RBI website under notifications.
Background
The RBI regulates payment systems in India and issues directions to the operators it authorises. You can read how bank deposits are protected in our explainer on DICGC deposit insurance, though that cover is a separate matter from payment security rules.
