The Reserve Bank of India has issued the Reserve Bank of India (Payments Banks – Cybersecurity, Technology Risk, Resilience and Assurance Framework) Directions, 2026, applicable to all Payments Banks with immediate effect. The Directions establish a comprehensive framework for IT governance, cybersecurity, technology risk management, operational resilience, and IS audit.
The framework requires Payments Banks to implement Board-approved IT and cybersecurity policies, establish governance structures including IT Strategy Committee and Information Security Committee, and strengthen controls relating to data protection, access management, network security, application security, vulnerability testing, third-party risk management, and cyber incident response.
The Directions also mandate effective Business Continuity and Disaster Recovery mechanisms, Cyber Security Operations Centre (CSOC), customer awareness measures, transaction monitoring, and risk-based Information Systems Audit to enhance cybersecurity resilience and ensure secure banking operations.
