# RBI Mandates Non-Bank Payment Operators to Report Cyber Incidents Within 6 Hours Under Revised Guidelines

> The Reserve Bank of India has tightened cybersecurity directives for non-bank payment system operators, making it mandatory to report any security breaches or severe system disruptions within six hours.

**Type:** article · **Category:** Business · **Published:** 2026-11-15 · **Source:** TrendKia
**Canonical:** https://trendkia.com/en/business/dijitala-bhugatana-knpaniyon-ke-lie-rbi-ki-nai-gaidalainsa-saibara-hamale-ya-takaniki-kharabi-ki-6-ghnte-men-deni-hogi-suchana-60168 · **Language:** English
**Tags:** RBI, Cyber Fraud, Digital Payments, Cybersecurity, CERT-In, Banking Rules

Amid the ongoing expansion of digital transactions across the country, the Reserve Bank of India (RBI) has issued tightened cybersecurity guidelines targeting non-banking Payment System Operators (PSOs). The central bank's updated framework aims to fortify the country's payment infrastructure against sophisticated cyber attacks and safeguard consumer funds from online fraud. By standardizing compliance protocols and enforcing strict event-reporting deadlines, the regulatory body seeks to enhance monitoring capabilities and ensure immediate intervention whenever vulnerabilities or system failures arise.

## Six-Hour Mandatory Reporting Window for Cyber Incidents
Under the finalized directives, all non-banking PSOs operating within India must notify the RBI of any cyber attacks, major operational disruptions, or settlement delays within six hours of their detection. Reports must be submitted in a pre-designed structured format. Concurrently, payment companies are obligated to inform the Indian Computer Emergency Response Team (CERT-In) about any security compromise within the same strict six-hour timeframe. Industry experts emphasize that this prompt notification mandate gives oversight bodies the necessary leeway to limit contagion risks and contain potential damages before they cascade across the financial system.

## Consolidation of Rules and Source Code Escrow Directives
The regulatory overhaul consolidates previously scattered circulars into a single, unified master manual. Srinivas L, Joint Managing Director and CEO of 63 Moons Cybertech, welcomed the streamlined rulebook, stating that it effectively eliminates ambiguities and operational excuses for non-compliance. He highlighted the requirement mandating payment operators to hold or keep third-party application source code in secure escrow custody. This condition ensures that external software vulnerabilities can be evaluated and addressed without vendors shifting responsibility during critical security incidents.

## Shift from Reactive Compliance to Proactive Cyber Resilience
Cybersecurity leaders view the strict notification window as a paradigm shift for the fintech landscape. Ravi Prakash, Founder and CEO of Apollo Infoways, noted that the mandatory six-hour window signals a clear message that cyber protection can no longer be treated as a passive, reactive exercise. Instead, it serves as a strategic mandate to build a more vigilant payment ecosystem. Echoing this sentiment, Subhashish Majumdar, CEO of Nerix Technoserv, remarked that the framework pushes companies from reactive safety measures toward proactive cyber resilience, prompting operators to invest heavily in robust monitoring tools, incident response mechanisms, and risk management architecture.

## What this means for you
This strict directive by the central bank offers an enhanced security shield for millions of consumers across India who rely daily on wallets, UPI, and digital payment platforms.

- **Enhanced Consumer Safety:** Immediate reporting of cyber breaches or platform glitches reduces the risk of financial loss for users and ensures faster mitigation during fraudulent activities.
- **Transparency in Transactions:** Mandating swift updates on settlement delays prevents prolonged funds lock-ups between payment intermediaries and commercial banks.
- **Swift Fraud Mitigation:** Dual alerts to RBI and CERT-In within six hours enable regulators to isolate compromised channels before widespread damage occurs.
- **Robust Third-Party Software:** Guidelines on source code custody ensure third-party fintech applications adhere to high security standards, reducing system vulnerabilities.

## Why this happened
The central bank introduced these comprehensive cybersecurity standards in response to the massive growth in digital transactions and the evolving sophistication of threats targeting payment infrastructure.

- **Rapid Expansion of Digital Payments:** The exponential rise in online transactions made non-bank payment platforms high-value targets for cybercriminals.
- **Fragmentation of Regulatory Guidance:** Cybersecurity directives were previously distributed across multiple separate circulars, leaving loopholes in operational compliance.
- **Delayed Incident Reporting:** Payment operators previously lacked a uniform tight deadline to report breaches, delaying timely interventions by oversight bodies.
- **Vendor Vulnerabilities:** Increased reliance on third-party software applications created hidden vulnerabilities that required mandatory source code escrow controls.

## Questions & Answers

### 1. Which entities are governed by the RBI's new cybersecurity guidelines?
The new rule applies to all non-banking Payment System Operators (PSOs) operating in India.

### 2. How quickly must payment companies report a cyber incident to the RBI?
Companies must report any cyber incident or serious operational outage within 6 hours of discovery.

### 3. Is it mandatory for operators to inform CERT-In as well?
Yes, operators must also notify CERT-In within 6 hours of detecting a security incident.

### 4. What does the new directive state regarding third-party applications?
Companies are now mandated to hold or keep the source code of third-party applications in secure escrow custody.

---
_TrendKia — Har trend, sabse pehle.. Machine-readable view; canonical HTML at the URL above._