Amid the ongoing expansion of digital transactions across the country, the Reserve Bank of India (RBI) has issued tightened cybersecurity guidelines targeting non-banking Payment System Operators (PSOs). The central bank's updated framework aims to fortify the country's payment infrastructure against sophisticated cyber attacks and safeguard consumer funds from online fraud. By standardizing compliance protocols and enforcing strict event-reporting deadlines, the regulatory body seeks to enhance monitoring capabilities and ensure immediate intervention whenever vulnerabilities or system failures arise.
Six-Hour Mandatory Reporting Window for Cyber Incidents
Under the finalized directives, all non-banking PSOs operating within India must notify the RBI of any cyber attacks, major operational disruptions, or settlement delays within six hours of their detection. Reports must be submitted in a pre-designed structured format. Concurrently, payment companies are obligated to inform the Indian Computer Emergency Response Team (CERT-In) about any security compromise within the same strict six-hour timeframe. Industry experts emphasize that this prompt notification mandate gives oversight bodies the necessary leeway to limit contagion risks and contain potential damages before they cascade across the financial system.
Consolidation of Rules and Source Code Escrow Directives
The regulatory overhaul consolidates previously scattered circulars into a single, unified master manual. Srinivas L, Joint Managing Director and CEO of 63 Moons Cybertech, welcomed the streamlined rulebook, stating that it effectively eliminates ambiguities and operational excuses for non-compliance. He highlighted the requirement mandating payment operators to hold or keep third-party application source code in secure escrow custody. This condition ensures that external software vulnerabilities can be evaluated and addressed without vendors shifting responsibility during critical security incidents.
Shift from Reactive Compliance to Proactive Cyber Resilience
Cybersecurity leaders view the strict notification window as a paradigm shift for the fintech landscape. Ravi Prakash, Founder and CEO of Apollo Infoways, noted that the mandatory six-hour window signals a clear message that cyber protection can no longer be treated as a passive, reactive exercise. Instead, it serves as a strategic mandate to build a more vigilant payment ecosystem. Echoing this sentiment, Subhashish Majumdar, CEO of Nerix Technoserv, remarked that the framework pushes companies from reactive safety measures toward proactive cyber resilience, prompting operators to invest heavily in robust monitoring tools, incident response mechanisms, and risk management architecture.
