Status as of October 2026. This page is a practitioner’s summary, not legal advice. Always confirm against the official circular or notification before acting.
Fintech security in India is governed by several overlapping authorities. Which rules apply depends on your licence and your role in the payment chain, but most fintechs touch at least three of the frameworks below.
1. Reserve Bank of India (RBI)
IT Governance, Risk, Controls and Assurance Practices (Master Direction, 2023)
Issued in November 2023 and in force since 1 April 2024 for banks, NBFCs (upper, middle and top layers), and other regulated entities. It consolidates earlier IT and cyber security circulars.
- Board-approved IT and information security policies, with an IT Strategy Committee and an IT Steering Committee
- A dedicated CISO, a cyber crisis management plan, and a business continuity / DR programme with defined recovery objectives
- Vulnerability management, patching, access control, logging and security operations
- Periodic information systems audits
Digital Payment Security Controls (Master Direction, 2021)
Sets baseline controls for internet and mobile banking, card payments and app security: secure development, application hardening, device binding, fraud monitoring and customer protection.
Authentication Mechanisms for Digital Payment Transactions (Directions, 2025)
- All domestic digital payments must use at least two distinct authentication factors, with at least one factor dynamic (unique to the transaction)
- Moves the ecosystem away from SMS OTP as the default second factor; issuers may apply risk-based (behavioural, device, location) checks
- Issuers carry liability for customer losses arising from non-compliance
- General compliance date: 1 April 2026; validation for cross-border card-not-present transactions by 1 October 2026
Payment aggregators, outsourcing and fraud risk
Payment aggregators and gateways must meet RBI’s baseline technology recommendations. Outsourcing directions make the regulated entity accountable for its technology vendors and fintech partners. Fraud risk management directions require early-warning signals, red-flagging of accounts and timely reporting.
2. CERT-In Directions (April 2022)
Issued under Section 70B of the IT Act. They apply to service providers, intermediaries, data centres, body corporates and government organisations, which in practice covers almost every fintech.
- Report specified cyber incidents to CERT-In within 6 hours of noticing them
- Retain ICT system logs for 180 days, within India
- Synchronise system clocks to NTP servers of NIC or NPL (or traceable sources)
- Designate a point of contact to coordinate with CERT-In
- VPN, cloud, VPS and virtual asset service providers have additional customer-record obligations
3. SEBI Cybersecurity and Cyber Resilience Framework (CSCRF)
Issued in August 2024 for SEBI-regulated entities such as stock exchanges, depositories, brokers, mutual funds, KRAs and RTAs. Obligations are graded by category: MIIs, qualified, mid-size, small-size and self-certification REs.
- Organised around Identify, Protect, Detect, Respond and Recover
- Security operations centre (own or market SOC), VAPT, periodic cyber audits, and backup and DR
- Structured compliance reporting formats
- Main compliance deadlines fell in 2025 (the final extension ran to 31 August 2025), so CSCRF is now enforced in audits
4. Digital Personal Data Protection (DPDP) Act, 2023 and DPDP Rules, 2025
The DPDP Rules were notified on 13 November 2025, with a phased commencement:
- 13 November 2025 – Data Protection Board provisions in force
- 13 November 2026 – Consent Manager framework
- 13 May 2027 – core obligations: notice and consent, reasonable security safeguards, breach notification, retention and erasure, and data principal rights
Key points for fintechs: report personal data breaches to the Board (a detailed report within 72 hours) and notify affected individuals; keep processing logs for at least a year; implement encryption, access control and monitoring as “reasonable security safeguards”. Penalties go up to ₹250 crore per instance. RBI and SEBI sector rules continue to apply alongside DPDP.
5. NPCI and UPI ecosystem
Banks, PSPs and Third-Party Application Providers (TPAPs) on UPI must follow NPCI’s operating and security guidelines. These cover device binding, app security, transaction limits and risk rules, API usage controls, data storage and periodic audits by CERT-In-empanelled auditors. NPCI audit findings often focus on app hardening, secrets management, logging, and data localisation of payment data under RBI’s 2018 storage directive.
Quick applicability guide
- Bank / NBFC: RBI IT Governance MD, Digital Payment Security Controls, authentication directions, CERT-In, DPDP
- Payment aggregator / gateway: RBI PA guidelines, authentication directions, payment data localisation, CERT-In, DPDP
- UPI TPAP / PSP: NPCI guidelines and audits, CERT-In, DPDP, plus your sponsor bank’s requirements
- Broker / AMC / market intermediary: SEBI CSCRF, CERT-In, DPDP
- Fintech partner to a regulated entity: the RE’s outsourcing and vendor-risk requirements flow down to you contractually, plus CERT-In and DPDP
Not sure which obligations apply to you? CyberQuotient runs regulatory gap assessments for fintechs.