The Reserve Bank of India has introduced a six-hour reporting deadline for non-bank payment system operators after cyberattacks, fraud and other abnormal incidents, a move intended to help regulators respond faster to threats across India’s digital payments infrastructure.
According to a report by Press Trust of India cited by Aaj Tak Business, the revised directions require non-bank payment system operators, or PSOs, to report cybersecurity incidents to the central bank and the Indian Computer Emergency Response Team, known as CERT-In, within six hours of detecting the incident. The reporting must follow a prescribed format.
The rule covers incidents involving cyberattacks, system disruptions, delays in settlement and other unusual events that could affect the functioning or security of payment services. By setting a fixed deadline, the RBI aims to reduce the time between the detection of an incident and regulatory intervention, allowing potential risks to be monitored across the payment ecosystem more quickly.
The directions apply to a wide range of payment infrastructure providers, including the National Payments Corporation of India, card networks, payment aggregators, prepaid payment instrument issuers and white-label ATM operators. The revised master directions also address digital transaction security, software security, system audits and the management of third-party service providers.
The change places greater responsibility on payment operators to maintain monitoring and risk-management systems capable of identifying incidents quickly. Experts quoted in the report said the six-hour window would require payment companies to strengthen their internal surveillance, incident response and cybersecurity processes rather than treating security as a purely reactive compliance function.
Srinivas L, joint managing director and chief executive officer of 63SATS Cybertech, said the RBI had brought previously scattered circulars together into a clearer rulebook. Ravi Prakash, founder and chief executive officer of Apollo Infoweg, said the reporting window signalled that cybersecurity could no longer be treated only as a reactive compliance function. Subhasis Mazumdar, chief executive officer of Nerix TechnoServ, said the requirement would push payment operators to invest in stronger monitoring and risk-management frameworks.
The revised framework also includes business-continuity and disaster-recovery requirements. Payment operators must maintain a disaster-recovery facility in a seismic zone separate from their primary data centre and conduct recovery drills at least twice a year, according to the report. These measures are intended to strengthen the resilience of systems that support digital transactions and settlements.
The implementation timeline differs by the size of the operator. The new requirements are applicable to large and medium-sized PSOs, while smaller PSOs have been given until April 1, 2028, to comply with the directions. The phased timeline gives smaller operators additional time to build the required cybersecurity, auditing and recovery capabilities.
For customers, the rule does not by itself guarantee that every fraudulent transaction will be reversed or that an incident will be prevented. Its immediate effect is on how quickly payment operators must report significant cybersecurity events to the authorities. The RBI’s next step is the enforcement of the revised controls across covered operators, with smaller PSOs moving towards the April 2028 compliance deadline.
