The Reserve Bank of India (RBI) on July 31, 2026, issued the Reserve Bank of India (Small Finance Banks – Digital Payment Security Controls) Directions, 2026.
The following has been stated: -
•The Reserve Bank of India issued these directions to establish robust security controls, data protection protocols, and operational resilience standards across digital payment channels offered by Small Finance Banks.
•Under these guidelines, bank Boards are required to approve and annually review policies for digital payment products to effectively identify, assess, and manage cyber and fraud risks.
•The document mandates strict governance and application security controls, including a "secure by design" development approach, regular vulnerability assessments, penetration testing, and secure source code reviews.
•To protect financial transactions, banks must implement multi-factor authentication with dynamic, non-replicable mechanisms across digital channels, mobile banking, and ATM systems.
•Furthermore, the directions outline requirements for fraud risk management, transaction logging, continuous network monitoring, secure encryption standards, and efficient customer grievance redressal mechanisms.
These Directions shall come into effect immediately upon issuance.
The detailed directions are given in the document below.
[Notification No.: RBI/DoS/2026-27/420 DoS.CO.CSITEG.14/31.01.015/2026-27]
