RBI tightens cyber oversight of non-bank payment system operators

The revised directions mandate annual system audits, source code safeguards and stricter oversight of third-party ATM switch providers, with immediate effect for large and medium PSOs.

At a time when AI-led vulnerabilities are posing a challenge to payment systems globally, the Reserve Bank of India (RBI) on Thursday issued a consolidated cyber security rulebook for all non-bank payment system operators (PSOs). The rulebook also brings annual system audits and third-party ATM switch providers under its ambit.

 

The revised Master Directions on Cyber Resilience and Digital Payment Security Controls apply to entities including the National Payments Corporation of India (NPCI), card networks, payment aggregators, prepaid payment instrument (PPI) issuers and white-label ATM operators (WLAOs), among others.

 

They take effect immediately for large and medium PSOs. Small PSOs have until April 1, 2028.

 

PSOs are required to “obtain the source code of all critical applications procured from third-party vendors”. Where that is not possible, an escrow arrangement must be in place “to ensure continuity of services,” according to the notification.

 

If a PSO does not own the code, it must get a certificate from the developer stating that the application is “free of vulnerabilities, malwares and any covert channels in the code”. A fresh certificate is required after every change.

 

PSOs must also have “a mechanism to apply them immediately” for critical patches released to tackle well-known or reported attacks.

 

Under the new system audit norms, PSOs must file an annual audit report within two months of the close of their financial year, which means by June 1 for those following an April-March year.

 

To avoid any conflict of interest, the auditor and its sister concerns must not have provided any service to the entity during the last two financial years. Auditors must also report any deviation from the process flow the entity submitted to the RBI while seeking authorisation.

 

Open observations must be fixed within a “maximum 3 months”.

 

WLAOs that use shared ATM switch services must contractually require their providers to follow cyber controls on an ongoing basis and to give the RBI access “for on-site/off-site supervision”. These controls include disabling remote connections from outside machines to the switch network and blocking “potential backdoor connections”.

 

PSOs must also ensure that unregulated entities in their ecosystem, such as payment gateways and vendors, follow the directions, “subject to mutual agreement”.

 

The rulebook retains requirements to report cyber incidents, such as cyberattacks, outages of critical systems or infrastructure, internal fraud and settlement delays, to the RBI within six hours of detection and to impose a minimum 12-hour cooling-off period after a customer changes their registered mobile number or email.

 

The RBI said the consolidation would “provide a single reference point for the entities”. Six earlier circulars, the oldest dating to 2009, have been repealed.