RBI Sets Mandatory Cyber Security Rules for Payment Apps

RBI has issued binding security and fraud-control rules for all non-bank payment platforms like wallets, prepaid cards, and payment gateways.

Here's what happened: RBI has issued Master Directions on Cyber Resilience and Digital Payment Security Controls, making comprehensive cybersecurity standards legally binding on all RBI-authorised non-bank Payment System Operators (PSOs).. These directions cover the full spectrum of digital payment security obligations — including governance frameworks, incident response, data security, fraud risk management, and IT infrastructure controls.. Non-bank PSOs must now comply with these directions as a regulatory requirement; non-compliance can attract supervisory action from RBI as per the Payment and Settlement Systems Act, 2007.. The effective date and any phased implementation timeline are as stated in RBI's official notice at the source link — consumers and platforms should refer to the official text for exact compliance deadlines..

What you should do: If you use a digital wallet, prepaid card, or non-bank payment app, check whether that platform is RBI-authorised by searching the RBI's list of authorised payment systems on rbi.org.in — only use authorised platforms.. If you experience an unauthorised transaction, data breach notification, or fraud on a non-bank payment app, first raise a formal complaint with the platform's grievance officer; they are now under tighter regulatory obligation to respond.. If your complaint on a payment app is not resolved satisfactorily, escalate to the RBI Ombudsman for Digital Payments through the RBI's CMS portal at sachet.rbi.org.in — these new directions strengthen the regulatory backing for your complaint..

These rules affect anyone who uses a non-bank digital payment platform — this includes prepaid wallet users, customers of payment gateway-backed checkout services, and users of UPI-linked non-bank apps. Your bank's own mobile banking app and UPI app are governed by separate RBI directions for banks and are not covered here. The practical benefit for you is that the payment apps handling your money are now required by law — not just policy — to maintain active fraud monitoring, encrypt your data, and have an incident response plan in place.

If you're considering settling a loan, our loan settlement guide walks through the process.