The Reserve Bank of India (RBI) on July 31, 2026, exercising powers under Section 35-A read with Section 56 of the Banking Regulation Act, 1949 and provisions of the Payment and Settlement Systems Act, 2007, issued the "Reserve Bank of India (Urban Co-operative Banks – Digital Payment Security Controls) Directions, 2026" with immediate effect. These Directions apply to all Primary (Urban) Co-operative Banks (UCBs) in respect of digital payment products and services offered to customers, whether directly or through RBI-authorised Payment System Operators (PSOs), covering both financial and non-financial transactions such as balance enquiry, PIN management, and mobile banking registration.
The framework mandates Board-approved policies covering Functionality, Security and Performance (FSP) aspects of digital payment products, governance and risk management including Risk and Control Self-Assessment (RCSA), and generic security controls such as encryption, Web Application Firewalls, and DDoS mitigation. It prescribes a secure-by-design application security lifecycle with mandatory VA/PT (half-yearly and annual respectively), robust multi-factor authentication frameworks, fraud risk management with transaction monitoring parameters, real-time reconciliation mechanisms, and customer protection, awareness, and grievance redressal requirements including Online Dispute Resolution. Additional channel-specific controls are prescribed for internet banking (adaptive authentication, session timeouts), mobile payment applications (device binding, app security, anti-malware), and card payments for Level III/IV UCBs (PCI-PIN, PCI-PTS, PCI-HSM, PCI-P2PE standards, HSM controls, and ATM/card transaction security).
The Directions repeal all prior guidelines on Digital Payment Security Controls for UCBs (communicated via circular dated July 31, 2026) while preserving rights, liabilities, and proceedings arising under the repealed framework, and operate in addition to other applicable laws. RBI retains final authority to interpret and clarify any provision of these Directions.
[Notification No. RBI/DoS/2026-27/438, DoS.CO.CSITEG.32/31.01.015/2026-27]
