What changed
RBI issued the Master Direction on Digital Payment Security Controls (2021), replacing earlier piecemeal circulars with a comprehensive framework. It mandates a Board-approved policy for digital payment products, covering governance, risk management, and security controls for internet, mobile, and card payments. The direction applies to scheduled commercial banks (excluding RRBs), small finance banks, payments banks, and credit card-issuing NBFCs, effective six months from issuance (February 18, 2021).
What it means for you
Banks and NBFCs must now formalize digital payment security policies at the Board level, ensuring robust governance and minimum security standards. This raises compliance costs but reduces fraud risk and enhances customer trust. Non-compliance could attract supervisory action, so lenders must prioritize implementation within the timeline.
What you must do
- Formulate a Board-approved policy for digital payment products and services covering risk management, compliance, and customer experience.
- Implement common minimum security controls for internet banking, mobile payments, and card payments as per the direction's chapters.
- Ensure authentication frameworks and fraud risk management mechanisms are in place within six months from February 18, 2021.
- Review and align existing security measures with the new direction, especially for any previously issued circulars that take immediate effect.
Who it affects
Scheduled Commercial Banks (excluding RRBs), Small Finance Banks, Payments Banks, Credit card issuing NBFCs
When does this Master Direction come into effect?
It comes into effect six months from February 18, 2021, i.e., by August 18, 2021. However, instructions already issued by RBI departments take immediate effect or as per their original timelines.
Does this apply to Regional Rural Banks?
No, Regional Rural Banks (RRBs) are explicitly excluded from the applicability of this direction.
What are the key areas covered under general controls?
General controls include governance and management of security risks, application security life cycle, authentication framework, fraud risk management, reconciliation mechanism, and customer protection, awareness, and grievance redressal.