The RBI has issued the Payments Banks – Digital Payment Security Controls Supervisory Directions, 2026 to strengthen cybersecurity, fraud prevention, operational resilience, and customer protection in digital payment services. The Directions apply to all Payments Banks and cover digital payment products, applications, systems, and infrastructure. Payments Banks must implement Board-approved security policies, conduct regular risk assessments, and establish strong governance mechanisms for managing digital payment risks. The Directions require security measures such as encryption, multi-factor
authentication, vulnerability assessments, penetration testing, fraud monitoring, secure application development, and data protection controls. Banks must ensure customer protection through secure digital payment practices, grievance redressal mechanisms, transaction alerts, and awareness initiatives against cyber frauds. Additional controls are prescribed for internet banking, mobile applications, and card payment services to ensure secure transactions. The Directions replace earlier digital payment security guidelines and aim to create a safe, secure, and resilient digital payment ecosystem for Payments Banks.
