The Reserve Bank of India now requires non-bank payment system operators, including payment aggregators, prepaid payment instrument (PPI) issuers, card networks, NPCI, and white-label ATM operators, to report unusual incidents, including cyberattacks, critical system outages, and settlement delays, within 6 hours of detection to the RBI, and any cybersecurity incident to CERT-In within 6 hours of fraud detection.
The goal? To catch digital fraud early and keep your money safer, with faster reporting and monitoring when something goes wrong.
Deadline April 1 2028 for operators
These rules cover big names like NPCI as well as smaller operators, who get until April 1, 2028 to fully comply.
There's also a push for annual system audits and stronger disaster recovery plans (even making sure backup sites aren't all in the same earthquake zone).
Industry leaders are on board, seeing this as a step toward more transparency and a tougher, more secure digital payments scene for everyone.