# RBI Cyber Resilience for Payment System Operators: RBI Master Directions on Cyber Resilience and Digital Payment Security Controls for Non-bank Payment System Operators

> Cyber resilience and payment security requirements for non-bank PSOs such as PPI issuers, payment aggregators and card networks.

URL: https://securei3.com/standards/rbi-pso-cyber-resilience/
Category: India regulations: Law or regulation
Provider: Secure iQube (independent consultancy; ISO certificates are issued by accredited certification bodies; SOC and ISAE reports by licensed CPA and audit firms, which Secure iQube can arrange through partner firms)


RBI issued Master Directions in 2024 extending cyber resilience and digital payment security expectations to non-bank payment system operators. They cover board-approved information security policy, IT and cyber risk management, baseline controls, incident response, vendor risk, and security of payment applications, with phased timelines based on the operator’s size.

We help payment companies run a gap assessment, prioritise against the phased deadlines and build an ISMS that makes compliance demonstrable to RBI and to bank partners.

## Who it is for

- Prepaid payment instrument issuers
- Payment aggregators and payment gateways
- Card networks, cross-border and other authorised PSOs

## Benefits

- A prioritised plan aligned to the phased timelines
- Controls reusable for PCI DSS and ISO 27001
- Stronger position in bank partnerships

## How Secure iQube helps

1. **Applicability and scoping**: Confirm whether and how the law applies to you, entities, data, systems, roles and territories.
2. **Data and process mapping**: Build a record of processing or control inventory so obligations can be tied to real systems and owners.
3. **Gap assessment**: Measure current practice against each obligation and rank the gaps by legal and business risk.
4. **Remediation roadmap**: Policies, notices, contracts, technical controls and governance, sequenced so the highest risks close first.
5. **Evidence and ongoing monitoring**: A compliance calendar, metrics and periodic reviews so you can demonstrate compliance to a regulator or customer at any time.

## Frequently asked questions

### Which PSOs are in scope?

Non-bank payment system operators authorised by RBI under the Payment and Settlement Systems Act, with timelines varying by category and size. Confirm your applicability against the Direction.

Related: https://securei3.com/standards/rbi-digital-payment-security/, https://securei3.com/standards/rbi-payment-aggregators/, https://securei3.com/standards/pci-dss/, https://securei3.com/standards/iso-27001/

Contact: https://securei3.com/contact/: info@securei3.com