RBI payment and IT security directions
The Reserve Bank of India regulates banks, NBFCs, payment aggregators and payment system operators through a family of directions. For engineering teams the ones that matter most are payment data localisation, card-on-file tokenisation, digital payment security controls and IT governance. Which directions bind you depends on your licence or your role as a service provider to a regulated entity.
Example finding{
"ruleId": "rbi.webhook-signature-unverified",
"framework": "rbi",
"severity": "high",
"title": "Payment webhook signature not verified",
"path": "src/api/handler.ts",
"controls": [
"DPSC",
"CSF 2016 Annex 1"
]
}What RBI expects from engineering.
- 01
Payment data stored in India
Storage of Payment System Data (2018): payment system operators and their service providers keep the entire payment data only in India; data processed abroad is deleted there and brought back within one business day or 24 hours.
- 02
Tokenise, don't store cards
Card-on-File Tokenisation (2021): since 1 October 2022 only card issuers and card networks may store actual card data; merchants and payment aggregators use tokens.
- 03
Digital payment security controls
Digital Payment Security Controls (2021 Master Direction, re-issued for commercial and payments banks in 2026): secure application life cycle, strong customer authentication, session controls and fraud monitoring for internet, mobile and card payments.
- 04
Cyber security framework
Cyber Security Framework in Banks (2016): a board-approved cyber security policy, a cyber crisis management plan and baseline controls such as secure configuration, application security and audit logs.
- 05
IT governance and assurance
IT Governance, Risk, Controls and Assurance Practices (2023): IT and information security risk management, cryptographic controls, change management, business continuity and IS audit.
- 06
Non-bank payment operators
Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators (2024): phased compliance from April 2025 (large) to April 2028 (small).
Turned into code rules.
16 rules run when RBI is selected, mapped to 7 RBI controls. Each covers part of a control in code — not the whole control.
- Hardcoded secret or credentialCSF 2016 Annex 1
- SQL built from untrusted inputCSF 2016 Annex 1 · DPSC
- TLS certificate verification disabledITGRCA 2023
- Unencrypted HTTP connectionITGRCA 2023
- JWT accepted without signature verificationDPSC
- Card number (PAN) stored or hardcodedCoFT 2021
- Card security code (CVV/CVC) storedCoFT 2021
- MD5/SHA-1 used for passwords or tokensITGRCA 2023
- Deprecated cipher or insecure modeITGRCA 2023
- Payment webhook signature not verifiedDPSC · CSF 2016 Annex 1
- OTP or PIN written to logsDPSC
- Bank account, PAN or UPI identifier in plaintextDPSC · ITGRCA 2023
- Card number column instead of a tokenCoFT 2021
- Payment data configured outside IndiaPSD 2018
- Payment created without an idempotency keyDPSC
- Long-lived session in payment codeDPSC
Preparing for an audit? Read the RBI readiness guide — the controls RuleFix checks, what stays organisational, and how to use reports as evidence.
Read the source.
RuleFix links to primary sources so you can check the requirements yourself. We are not affiliated with these bodies.
- Reserve Bank of IndiaStorage of Payment System Data (6 April 2018)rbi.org.in
- Reserve Bank of IndiaFAQs on Storage of Payment System Datarbi.org.in
- Reserve Bank of IndiaTokenisation — Card-on-File Tokenisation (CoFT) services (7 September 2021)rbi.org.in
- Reserve Bank of IndiaMaster Direction on Digital Payment Security Controls (18 February 2021)rbi.org.in
- Reserve Bank of IndiaCommercial Banks — Digital Payment Security Controls Directions, 2026rbi.org.in
- Reserve Bank of IndiaCyber Security Framework in Banks (2 June 2016)rbi.org.in
- Reserve Bank of IndiaMaster Direction on IT Governance, Risk, Controls and Assurance Practices (7 November 2023)rbi.org.in
- Reserve Bank of IndiaCyber Resilience and Digital Payment Security Controls for non-bank PSOs (30 July 2024)rbi.org.in
- Reserve Bank of IndiaMaster Direction on Regulation of Payment Aggregators (15 September 2025)rbi.org.in
Cover more with the same workflow.
GDPR
HIPAA
LGPD
Ship AI-powered products
that are compliant by design.
Join developers building with RuleFix.