Cyber resilience in payments is no longer only a technology-team agenda. RBI’s consolidated Master Directions connect security architecture, third-party dependencies, incident response and system audits directly to board oversight and accountable management action.
What RBI has directed
The Directions apply to all authorised non-bank payment-system operators. They became effective on publication for large and medium operators; small operators must comply from 1 April 2028. RBI also expects operators to secure adherence by unregulated entities in their digital-payment ecosystem—such as gateways, vendors and third-party service providers—through mutually agreed arrangements backed by a board-approved policy.
The board remains responsible for information-security and cyber-resilience oversight. A board subcommittee led by a member experienced in information or cyber security may take primary oversight, but it must meet at least quarterly. Operators also need an annually reviewed information-security policy, a board-approved cyber-crisis plan, defined risk and performance indicators, vendor-risk assurance and secure-by-design practices.
Unusual incidents—including cyberattacks, critical outages, internal fraud and settlement delays—must be reported to RBI within six hours of detection, with cyber incidents also reported to CERT-In. Annual system audits must test both control design and operating effectiveness. For April–March entities, the report is due by 1 June, and open observations require time-bound corrective action within a maximum of three months.
Key takeaway for management
The management challenge is evidence, not policy volume. Boards need a concise view of material assets, privileged access, vendor exposure, unresolved vulnerabilities, incidents, recovery readiness and ageing audit observations. The same control map should connect each regulatory requirement to an owner, system evidence, testing frequency and remediation date.
Finance leadership should treat cyber resilience as a continuity, capital-allocation and assurance issue. Vendor contracts, audit scope, insurance assumptions, recovery investment and customer-impact scenarios should be reviewed together, because a technology failure can quickly become a settlement, liquidity, reputation and regulatory event.
What leaders should do now
- Create one board dashboard covering cyber KRIs, incidents, vendor exceptions, recovery tests and overdue audit observations.
- Map every critical system and third party to a named owner, required control evidence and contractual audit or incident obligations.
- Test the six-hour reporting workflow and close system-audit observations through dated actions that the board can independently track.
CFO PERSPECTIVECyber resilience should be governed like any other material enterprise risk: quantified where possible, funded against priorities and monitored through accountable closure. A board should be able to see whether security spending is reducing exposure, whether vendors can sustain operations and whether unresolved observations threaten payment continuity.
CA Jigarkumar Shah
Read the original material
RBI/DPSS/2026-27/475; CO.DPSS.CSD.No.S825/01-01-078/2026-2027
Important: This article is general information and a business perspective based on the cited source. It is not legal, tax, accounting or investment advice. The law and official guidance may change; obtain advice for your facts before acting.