The Reserve Bank of India (RBI) on July 31, 2026, issued the Reserve Bank of India (Payments Banks - Internal Audit Function) Directions, 2026.
These Directions shall come into effect on July 31, 2026.
The following has been stated:
• The Directions establish a comprehensive framework for strengthening the Internal Audit Function in Payments Banks through a Risk-Based Internal Audit (RBIA) approach. The Directions provide for Board oversight over the internal audit framework, approval of a risk assessment methodology and annual audit plan, and periodic evaluation of the effectiveness of the audit function.
• They require the Internal Audit Department to function independently from business operations, adopt a risk-based approach for identifying and prioritising audit areas, and assess the adequacy of risk management systems, internal controls, regulatory compliance, fraud-prone areas, data integrity, and information systems.
• The framework also covers periodic risk assessments, communication of significant audit findings, performance evaluation of the audit function, and engagement of external experts where specialised expertise is required, while retaining overall responsibility with the bank.
• Additionally, the Directions prescribe the authority, independence, tenure, and reporting structure of the Head of Internal Audit, who reports directly to the Audit Committee of the Board or senior management, and repeal the earlier internal audit framework while preserving actions taken under the previous directions.
[Notification No. – RBI/DoS/2026-27/431 DoS.CO.PPG.25/11.01.005/2026-27]
