RBI Cyber Security Rules for UPI, Wallets, Card Networks Take Effect

The Reserve Bank of India has replaced several older circulars with a single cyber security master direction for non-bank payment system operators, covering NPCI, card networks, payment aggregators, prepaid wallet issuers and white-label ATM operators. MediaNama reported that the direction was issued on 5 November 2026; large and medium operators must comply immediately, while small ones have until 1 April 2028.

A 12-Hour Wait After Changing Your Number

For customers, the visible change is a 12-hour cooling period after a registered mobile number or email address is changed, as reported by both MediaNama and Outlook Money. MediaNama also reported blocks on payments while remote-access apps are running, device binding to the user’s phone and SIM, and clearer transaction alerts. These points come from MediaNama’s reading of the text and were not independently confirmed by a second outlet.

Six Hours to Report an Attack

Operators must report cyber incidents such as attacks, critical outages, internal fraud and settlement delays to RBI within six hours of detection. Annual system audit reports are due by 1 June for April–March financial years, and audit gaps must be fixed within three months. Auditors cannot have worked for the operator in the previous two financial years. Operators also need the source code of critical vendor applications, or a copy held in escrow, according to Outlook Money.

Also read Demonetisation at 10: Cash in Circulation Up 143%, UPI Hits 24 Billion

Six Circulars Folded Into One

The direction builds on RBI’s July 2024 master direction on cyber resilience and digital payment security controls for these operators. Outlook Money reported that six earlier circulars, one of them from 2009, were repealed. MediaNama said separate advisories to banks on fintech and NBFC API security carry deadlines of 3 December 2026 and 3 February 2027.

Earlier this month IPB News reported on the opening of RBI’s data centre in Jatni, where the Prime Minister warned of cyber attacks on banks. More RBI coverage is collected under the RBI tag.

The text of the 2026 direction was not yet visible on RBI’s master directions page when this report was filed, so the figures above are attributed to the two outlets. The next date to watch is 1 June 2027, when the first annual audit reports under the consolidated rules fall due for April–March operators.

Source: RBI master directions page (July 2024 direction, which the new text builds on). Also based on reporting by MediaNama and Outlook Money.

Image: Outlook Money.