CONNECT WITH US
Fintech

Fintech

RBI tightens cybersecurity norms for non-bank payment operators, mandates six-hour incident reporting

ET BFSI Fintech logo

Published on

Add as a preferred source on Google
RBI tightens cybersecurity norms for non-bank payment operators, mandates six-hour incident reporting

RBI tightens cybersecurity norms for non-bank payment operators, mandates six-hour incident reporting

Under the new framework, the board of each payment operator will be responsible for overseeing information security risks, including cyber risks and resilience. Boards may delegate primary oversight to a sub-committee headed by a member with expertise in information or cybersecurity.

Unusual incidents, including cyberattacks and system outages, must be reported to RBI within six hours and to CERT-In. Boards must strengthen cyber risk oversight, review security policies annually and approve a Cyber Crisis Management Plan. PSOs must conduct annual security testing, round-the-clock threat monitoring and strengthen fraud detection and disaster recovery. New safeguards cover mobile number changes, card transaction limits, customer fraud reporting and annual system audits.

The Reserve Bank of India (RBI) has tightened cybersecurity requirements for non-bank payment system operators (PSOs), mandating them to report unusual incidents, including cyberattacks, critical system outages, internal fraud and settlement delays, within six hours of detection. Cybersecurity incidents must also be reported to the Indian Computer Emergency Response Team (CERT-In). The new directions require payment operators to strengthen board-level oversight, conduct annual security testing and put in place mechanisms to monitor and respond to cyber threats round the clock. The central bank on Thursday issued the Reserve Bank of India (Cyber Resilience and Digital Payment Security Controls for non-bank PSOs) Master Directions, 2026, consolidating earlier instructions on cybersecurity controls for payment operators, system audits and third-party ATM switch application service providers. The consolidated directions incorporate guidelines issued in December 2019 and January 2020.


Source link
Related Topics:Fintech

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.