Reserve Bank of India (Small Finance Banks – Digital Payment Security Controls) Directions, 2026

The Reserve Bank of India (Small Finance Banks – Digital Payment Security Controls) Directions, 2026 prescribe a comprehensive framework for securing digital paymentproducts and services offered by Small Finance Banks. The Directions require Board- approved policies, robust governance, risk assessment, secure-by-design application development, strong cybersecurity controls, periodic Vulnerability Assessments (VA) and Penetration Testing (PT), encryption, multi-factor authentication, fraud monitoring, business continuity, and secure customer data protection. They also prescribe specific security controls for internet banking, mobile banking, and card payment systems, including PCI compliance, ATM and PoS security, secure mobile applications, and Hardware Security Module (HSM) safeguards. Further, banks must establish effective customer awareness, grievance redressal, Online Dispute Resolution (ODR), and fraud reporting mechanisms while ensuring continuous monitoring and compliance. The Directions repeal earlier digital payment security instructions and provide a uniform regulatory framework for secure and resilient digital payment operations.