RBI New Rules for Digital Payments in India November 2026
The RBI new rules for digital payments are the biggest payments story in India in November 2026, but they are not quite what many headlines suggest. On 5 November 2026, the Reserve Bank of India issued a consolidated Master Direction on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators. In simple terms, RBI has taken its existing cyber security and digital payment security rules for non-bank payment firms and put them into one rulebook. For most ordinary UPI users, there is no new limit, no new charge, and no new app to install. For payment companies, banks, and fintech firms, the rules are now clearer, stricter, and easier for RBI to enforce.
This article explains the RBI new rules for digital payments in plain language: what RBI actually announced on 5 November, what changes for you as a UPI or wallet user, what the separate UPI charges case in the Supreme Court means, and what you should do now to stay safe.
What did RBI announce on 5 November 2026?
On 5 November 2026, RBI issued the consolidated Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators, cited in reporting as circular RBI/DPSS/2026-27/475. The direction was reported on 7 November 2026, and explained in detail by MediaNama on 9 November 2026 and by other outlets on 10 November 2026.
A Master Direction is RBI’s consolidated rulebook on a subject. This one merges the July 2024 Master Directions on cyber resilience and digital payment security with earlier instructions on cyber security controls for third party ATM switch application service providers from December 2019 and the scope of system audits of payment systems from January 2020. It repeals six earlier circulars and instructions. RBI said the aim is to provide a single reference point for the entities covered, so payment firms, auditors and RBI supervisors are all working from the same document.
The direction covers authorised non-bank Payment System Operators, including payment aggregators, wallet issuers, card networks, NPCI, Bharat BillPay, non-bank ATM networks and white label ATM operators. In short, it covers the companies that run payment systems without being banks.
The direction takes effect immediately for large and medium non-bank PSOs. Small PSOs have until 1 April 2028 to comply. That staggered timeline matters, because it means the largest payment firms must follow the consolidated rules now, while smaller firms get more than a year to upgrade their systems.
The 6 hour reporting rule
One of the sharpest clauses in the RBI new rules for digital payments is the six hour reporting clock. Payment operators must report specified cyber incidents to RBI within six hours of detection. That includes cyberattacks, critical infrastructure outages, internal fraud and settlement delays, as reported in the Fintech Brief of 8 November 2026.
This is not a new obligation invented on 5 November. Multiple sources note that the six hour deadline was already part of the earlier framework and is retained in the consolidated direction. What is new is that it now sits in a single, consolidated rulebook with clearer governance and audit requirements around it.
There is an important gap to understand. The six hour clock runs to RBI, not to you. As the Cashless Consumer brief notes, there is still no rule forcing the operator to tell affected users directly within a set time. Faster reporting to RBI means faster regulatory attention, but it does not replace your own vigilance.
The 12 hour cooling period: what it means for you
The most consumer relevant rule in the RBI new rules for digital payments is the 12 hour cooling period. When you change the mobile number or email address linked to a payment instrument, there shall be a cooling period of minimum 12 hours before any payment transaction is allowed through online modes or channels.
This is an anti SIM swap tripwire. SIM swap fraud works like this: a fraudster convinces your mobile operator to issue a new SIM for your number, or changes the registered mobile number or email on your payment account, and then uses OTPs sent to the new number or email to drain your account. The 12 hour cooling period creates a window. If you get an alert that your number or email was changed and you did not make that change, you now have at least 12 hours to call your payment provider and your bank before online payments work on that instrument.
Like the six hour rule, the 12 hour cooling period was already part of the earlier framework and is retained in the consolidated direction. It is not a new idea, but it is now part of the single rulebook that large and medium operators must follow immediately. If you change your own number or email, expect a delay. Plan ahead if you are changing your SIM or email, and do not change both at a time when you need to make an urgent payment.
Device binding, remote access apps and session controls
The consolidated direction also requires payment operators to enforce device binding, to end inactive sessions automatically, and to detect or block remote access apps while a payment is in use. These are practical fraud controls that many users will notice directly.
Device binding means the payment app is linked to your device and SIM, so use from a different device should trigger extra verification. Ending inactive sessions automatically means an open app should close by itself, so a stranger who picks up your phone cannot pay without logging in again. The remote access rule is especially important in India, where fraudsters ask victims to install a screen sharing app and then see OTPs on screen. Under the new rules, payment apps must detect remote access apps and block the payment app while remote access is live. Payment apps must also offer an option to report fraudulent transactions.
Source code, vendors and audits: the behind the scenes rules
Much of the consolidated direction is about what happens behind the scenes. Payment operators must obtain the source code of critical applications from external vendors, or have an escrow arrangement for it, so the service can continue if a vendor fails. Operators must conduct annual system audits by CERT-In empanelled auditors or CISA or DISA qualified professionals, submit reports to RBI within two months of the financial year end, and fix open audit observations within three months. A technology risk committee must meet at least quarterly, disaster recovery must sit in a different seismic zone with drills twice a year, and cloud services need a board approved policy. These rules reduce the chance of a payment outage or a data breach at a large payment firm.
What banks were told on 3 November 2026
Two days before the consolidated Master Direction, RBI issued a separate confidential advisory to banks. According to reporting by Cashless Consumer on 7 November 2026 and MediaNama on 9 November 2026, the confidential Cyber Security and IT Risk advisory dated 3 November 2026 requires banks that process API based fund transfers to tighten security on the APIs that NBFCs and fintechs use to move money through banks.
Banks must maintain a full inventory of API clients and get a CERT-In security audit before onboarding any new NBFC client, with existing NBFC clients given until 3 February 2027. Business correspondents, payment aggregators and fintech clients must be risk assessed within three months.
Banks must also enforce per transaction and daily cumulative limits immediately, add intra day velocity limits within a month, run beneficiary whitelisting, and apply maker checker or out of band confirmation to API debits, with at least one such safeguard live for all existing integrations by 3 December 2026. The advisory came after warnings from I4C and CERT-In that AI assisted attacks on payment APIs can drain disbursement APIs at machine speed. On 4 November, CERT-In identified one threat actor, named CRAFTY FALCON, which it said used 1 rupee transfers to test fund flows before larger transactions. The advisory itself is described as confidential, so this article attributes its details to the reporting, not to a public RBI circular.
The separate UPI charges case: what is happening in the Supreme Court?
The RBI new rules for digital payments are often confused with a separate story about UPI charges. They are related, but they are not the same thing. The UPI charges story is about NPCI, the company that operates UPI, and a case in the Supreme Court.
On 3 November 2026, NPCI filed a counter affidavit in the Supreme Court in Anjan Datta v. Union of India, the public interest litigation challenging the UPI Merchant Discount Rate framework. In that affidavit, NPCI told the Court that merchants are strictly prohibited from passing the charge on to customers, and that UPI apps cannot levy platform fees on payments.
The framework in question imposes a charge of up to 0.4 percent only on person to merchant payments above 2,000 rupees, capped at 300 rupees for transactions of 75,000 rupees and above. Certain merchant categories, including railways, telecom services, insurance and fuel, will have a concessional flat MDR of 5 rupees per transaction for payments exceeding 2,000 rupees, instead of the standard percentage rate, according to Livemint reporting on 10 November 2026.
NPCI said the charge would apply to only about 4 percent of person to merchant transactions, and about 96 percent will remain unaffected. Person to person transfers remain free at any value, and payments to small merchants receiving up to 1 lakh rupees a month in UPI credits also remain free.
The Supreme Court had sought responses from the Centre, NPCI and other parties on 28 September 2026, and declined to grant an interim stay on the revised framework. The Court has not delivered a final ruling. The revised MDR framework was originally scheduled to be implemented on 15 October 2026, but NPCI deferred its rollout to immediately after Diwali, with the date to be notified separately. As of 10 November 2026, no new implementation date had been announced in the sources reviewed for this article. Livemint reported on 10 November 2026 that the rollout is likely in November, but that is a report of an expectation, not an announcement of a date.
The Union government, in its own affidavit filed the same week, told the Court that merchants were never assured of zero MDR on UPI indefinitely, according to the Cashless Consumer deep dive of 8 November 2026. That is the government’s legal argument, not a final court finding.
What does this mean for ordinary UPI users?
For ordinary users, the short answer is: your daily UPI payments do not change because of the 5 November Master Direction, and they do not change yet because of the UPI MDR case.
Your person to person transfers, such as sending money to family or splitting a bill, remain free and are not covered by the proposed MDR. Your payments to a merchant up to 2,000 rupees also remain outside the proposed MDR.
If the MDR does come into effect, it is a merchant side fee, not a customer fee. NPCI has told the Supreme Court that merchants cannot pass it to customers and UPI apps cannot add platform fees. If a merchant tries to charge you extra for a UPI payment, keep the bill and report it to your payment app or bank. The case is still pending, so the final rules may change.
What does this mean for merchants and small businesses?
If the MDR framework comes into effect, large merchants who receive person to merchant UPI payments above 2,000 rupees will pay up to 0.4 percent on those payments, capped at 300 rupees. Small merchants in the P2PM category, receiving up to 1 lakh rupees a month, are outside the framework, so a small shop or street vendor should not be affected. The 5 November Master Direction does not directly impose a new fee on merchants, but payment aggregators and apps must now follow the consolidated cyber security rules, which may mean stricter onboarding and device checks. If you are a merchant, do not change your registered mobile number or email without planning for the 12 hour cooling period, and do not add a UPI surcharge to customer bills. For more ways to earn without investment, see our guide on how to earn money online without investment in India.
What has NOT changed
It is important to be clear about what the RBI new rules for digital payments do not do. They do not change UPI transaction limits, they do not require ordinary customers to register for a new payment service, they do not introduce a new charge for person to person UPI transfers, and they do not make UPI paid for all users. They also do not finalise the reported kill switch proposal to let customers instantly block all debit transactions. That proposal has not been finalised, according to MediaNama. Large and medium operators must comply now, but most of the rules are about systems and audits in the background, so the changes you are most likely to notice are the 12 hour cooling period, a block on payments while a remote access app is running, and stricter device checks.
What you should do now
First, check that the mobile number and email linked to your bank account, UPI apps and wallets are current. Second, turn on transaction alerts and read them: if you get an alert about a number or email change you did not make, call your bank and payment provider immediately. Third, never install a remote access app at a stranger’s request, and never share your OTP, PIN, password or CVV with anyone. Fourth, do not change your registered number or email just before a large payment; allow at least 12 hours. Fifth, if you are a merchant, check whether you fall in the P2PM category and do not add a UPI surcharge. Sixth, if you lose money to fraud, call your bank, use the in app report option, and report it on the national cybercrime helpline 1930 or at cybercrime.gov.in.
Timeline: November 2026 at a glance
28 September 2026: Supreme Court seeks responses on the UPI MDR challenge, declines a stay. 3 November 2026: RBI bank API advisory and NPCI Supreme Court affidavit. 5 November 2026: RBI consolidated Master Direction. 3 December 2026: bank API safeguard deadline. 3 February 2027: CERT-In audit deadline for existing NBFC clients. 1 April 2028: compliance deadline for small payment operators.
FAQ
1. What are the RBI new rules for digital payments in November 2026?
The RBI new rules for digital payments are the consolidated Master Direction issued on 5 November 2026 on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators. It merges the July 2024 rules with earlier ATM switch and audit instructions into one rulebook, covering payment aggregators, wallet issuers, card networks, NPCI and white label ATM operators. It retains a 6 hour incident reporting rule and a 12 hour cooling period after a mobile number or email change.
2. Will UPI payments become paid for customers now?
No, not for ordinary customers under the framework as described by NPCI. Person to person transfers remain free at any value, payments to merchants up to 2,000 rupees remain free, and payments to small merchants receiving up to 1 lakh rupees a month in UPI credits remain free. The proposed charge of up to 0.4 percent applies only to person to merchant payments above 2,000 rupees, is paid by the merchant, and merchants cannot pass it to customers according to NPCI’s affidavit to the Supreme Court. The case is still pending and no implementation date had been announced as of 10 November 2026.
3. What is the 12 hour cooling period in the RBI new rules for digital payments?
When you change the mobile number or email address linked to a payment instrument, there is a minimum 12 hour cooling period before any online payment transaction is allowed on that instrument. It is an anti fraud measure against SIM swap fraud, giving you time to report an unauthorised change before payments work.
4. Do the RBI new rules for digital payments change UPI limits?
No. Multiple sources reporting the 5 November direction state that it does not announce changes to UPI transaction limits and does not require ordinary customers to register for a new payment service. UPI limits are set separately by NPCI and your bank, and they are not changed by this Master Direction.
5. When do the new rules apply?
The consolidated Master Direction applies immediately to large and medium non-bank payment system operators. Small operators have until 1 April 2028 to comply. Banks have separate deadlines under the 3 November advisory, including 3 December 2026 for beneficiary whitelisting or maker checker safeguards on existing API integrations, and 3 February 2027 for CERT-In audits of existing NBFC clients, as reported.
6. What should I do if a merchant charges me extra for paying by UPI?
Under the framework as described by NPCI, merchants cannot pass the MDR charge to customers and UPI apps cannot levy platform fees. If a merchant adds a surcharge for UPI, keep the bill, note the date and merchant name, and report it to your payment app or bank. The Supreme Court case is still pending, so the final position may change when the Court rules.
Conclusion
The RBI new rules for digital payments in November 2026 are best understood as a consolidation, not a revolution. On 5 November, RBI put its cyber security and digital payment security rules for non-bank payment firms into one Master Direction, with a 6 hour reporting clock to RBI, a 12 hour cooling period after a number or email change, device binding, remote access blocks, annual audits and stronger board governance. Large and medium operators must comply now, small operators have until 1 April 2028, and banks have until 3 December 2026 to put key API safeguards in place.
Separately, the UPI charges question is still in the Supreme Court, with NPCI saying merchants cannot pass the proposed 0.4 percent charge to customers, and no implementation date announced as of 10 November 2026. For most users, daily UPI payments do not change today. What does change is the safety net around those payments, and your part in it is simple: keep your number and email updated, read your alerts, never share your OTP, and report fraud immediately on 1930. Check back for updates when the Supreme Court rules or NPCI announces a date, because this story is still developing.
