Digital payments have made it easier for small businesses to accept money from customers across India and even from overseas. However, as online transactions increase, so do risks such as fake payment screenshots, phishing links, unauthorised transactions and payment-related fraud.
Recognising the growing importance of digital payment security, the Reserve Bank of India (RBI) issued new Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators on 5 November 2026.
The new rules aim to strengthen the security of India’s digital payment infrastructure. But what do they mean for ordinary business owners, MSMEs, retailers and e-commerce sellers?
More importantly, what can a small business do to protect its payments and customers?
Let’s understand.
1. What are RBI’s new cybersecurity rules?
The RBI has introduced a consolidated cybersecurity framework for non-bank Payment System Operators (PSOs).
These include entities such as payment aggregators, card networks, prepaid payment instrument issuers and white-label ATM operators.
The new directions strengthen requirements relating to:
- Cybersecurity risk management and monitoring.
- Regular system security audits.
- Protection of payment applications and source code.
- Management of third-party technology and service providers.
- Detection and reporting of cybersecurity incidents.
- Stronger access controls and protection of payment infrastructure.
Large and medium-sized non-bank PSOs must comply immediately, while small PSOs have until 1 April 2028.
The objective is to make digital payment systems more secure and reliable.
2. Do these new RBI rules apply directly to MSMEs and small businesses?
This is an important point that business owners should understand.
No. An ordinary MSME or online seller does not automatically become subject to these RBI directions simply because it accepts digital payments.
The directions primarily apply to regulated non-bank Payment System Operators, not every merchant using their services.
For example, if your business accepts payments through a payment gateway, you are generally a merchant or user of that payment service, not a Payment System Operator.
However, this does not mean that your business has no responsibility for payment security.
You should take reasonable precautions to protect your website, business accounts, customer information, employee access and payment records. Other applicable laws, data-protection requirements and contractual obligations may also apply depending on your business.
Who is responsible for what?
| Payment operator | MSME or merchant |
|---|---|
| Securing its payment-processing infrastructure | Securing its own website and business devices |
| Meeting applicable RBI regulatory requirements | Choosing a reliable payment service |
| Monitoring security risks in its payment systems | Protecting merchant login credentials |
| Reporting specified cyber incidents to RBI | Reporting fraud through appropriate channels |
| Managing risks from its technology providers | Training staff to identify payment scams |
In simple terms, the payment provider must secure its payment infrastructure, while the merchant must take care of its own business systems and payment practices.
3. How can MSMEs check whether their payment gateway is reliable?
Many small businesses select a payment gateway by comparing transaction charges alone. But security, customer support and regulatory status are equally important.
Here are some practical checks before choosing a payment provider.
Step 1: Check the provider’s legal identity
Find the actual company name behind the payment gateway. Do not rely only on its brand name.
Step 2: Verify its regulatory status
Visit the Reserve Bank of India website and look for the latest list of authorised Payment System Operators and Payment Aggregators.
Check the legal entity and the activity for which it is authorised.
Remember that some payment gateway technology providers operate through authorised banks or payment aggregators. Therefore, the absence of a brand name from the authorised list does not automatically mean that the service is unauthorised.
Step 3: Check its business and support details
Look for:
- Registered company name and address.
- Customer support contact details.
- Merchant grievance-redressal procedure.
- Published terms and conditions.
- Refund and chargeback policies.
- Transaction and settlement information.
Step 4: Check its security features
Ask whether the provider offers two-factor authentication, suspicious transaction alerts, fraud monitoring and secure payment processing.
Step 5: Understand the settlement process
Check how many days the provider takes to transfer money to your bank account, how failed transactions are handled and how you can raise a settlement complaint.
4. Ten payment security practices every small business should follow
You do not need an expensive cybersecurity department to improve your business’s payment security. Start with these basic precautions.
- Use a trusted payment gateway: Compare providers on security, support, settlement terms and total charges, not just advertised fees.
- Enable two-factor authentication: Protect your payment gateway dashboard, business email, website hosting and administrator accounts.
- Never share OTPs or passwords: Employees should never ask customers to disclose their OTP, PIN, CVV or banking password.
- Verify payments before dispatch: Check the transaction in your official payment dashboard or bank account. Never rely only on a screenshot sent by a customer.
- Secure your website: Use HTTPS, update WordPress and plugins regularly, remove unused plugins and restrict administrator access.
- Be careful with payment links: Do not click unknown links claiming to be from your payment provider or bank.
- Check QR codes: Make sure your shop’s displayed UPI QR code has not been replaced or tampered with.
- Verify refund requests: Process refunds through the official payment dashboard. Do not transfer money to a different account merely because someone requests it.
- Reconcile transactions: Regularly compare payment gateway records, refunds, charges and actual bank credits.
- Train employees: Make sure staff can recognise fake payment messages, phishing emails, impersonation calls and suspicious transactions.
These simple measures can prevent many common payment-related mistakes and losses.
5. What should you do if your business faces online payment fraud?
If you notice an unauthorised transaction, suspicious account activity or a payment-related cyberattack, act quickly.
- Contact your bank and payment gateway through their official channels.
- Report the suspicious transaction immediately.
- Change compromised passwords and revoke suspicious account sessions.
- Preserve transaction IDs, messages, emails and other evidence.
- Check whether other transactions or customer accounts are affected.
- If money has been lost through cyber fraud in India, call the national cybercrime helpline 1930 or report it at cybercrime.gov.in.
Do not delay reporting a suspected financial fraud.
The RBI’s six-hour cyber-incident reporting requirement under these directions applies to covered Payment System Operators. It should not be confused with a general six-hour reporting deadline for every small merchant.
6. Why should small businesses take payment security seriously?
For a large company, a payment-related security problem may be handled by a dedicated IT and compliance team. A small business may not have that advantage.
A single fake payment confirmation, compromised merchant account or careless refund can result in financial loss.
For e-commerce businesses, a security incident can also damage customer confidence and affect future sales.
As digital payments become an essential part of everyday business, payment security should be treated as an important part of business management—not merely a technical issue.
Frequently Asked Questions
Do RBI’s new cybersecurity rules apply to every MSME?
No. The November 2026 directions primarily apply to covered non-bank Payment System Operators. Ordinary merchants are not automatically subject to the same regulatory requirements merely because they accept digital payments.
Does a small online business need a cybersecurity audit?
Not automatically under these particular RBI directions. However, businesses should secure their websites, payment accounts and customer information. Other legal or contractual requirements may apply depending on the business.
How can I check whether a payment aggregator is authorised by RBI?
Visit the RBI website and check its latest list of authorised Payment System Operators and Payment Aggregators. Search using the provider’s legal company name and check the relevant authorised activity.
Is it safe to accept UPI payments?
UPI is widely used for digital payments, but businesses should still verify that money has actually been credited to their account. Never treat a payment screenshot or sound notification alone as proof of receipt.
What should I do if a customer sends a fake payment screenshot?
Do not dispatch the goods until the payment is visible in your official bank account or payment dashboard. Report repeated suspicious activity to your payment provider.
Final thoughts
RBI’s new cybersecurity directions are an important development for India’s digital payment ecosystem. Although ordinary MSMEs are not automatically required to follow all the regulatory requirements imposed on payment operators, they should not ignore payment security.
Choosing a reliable payment provider, protecting business accounts, verifying transactions and training employees can help small businesses reduce avoidable risks.
A secure payment process protects not only your money but also your customers’ trust.
Explore More Business Guides
- International Payment Gateway Guide for MSMEs
- Can UPI Replace PayPal?
- UPI’s Global Expansion and Opportunities for Indian MSMEs
More practical business insights at BusinessZindagi.com – Your MSME Life Partner in Growth.
Sources and References
- Reserve Bank of India – Master Directions on Cyber Resilience and Digital Payment Security Controls, 5 November 2026
- Reserve Bank of India – Payment System Notifications
- National Cyber Crime Reporting Portal
AI Disclaimer
This article was prepared with the assistance of artificial intelligence (AI) for research, drafting and presentation. The content has been reviewed and edited for general informational purposes.
Editorial Disclaimer
BusinessZindagi.com aims to provide useful and understandable business information. This article is not legal, financial or cybersecurity advice. RBI regulations and payment-provider policies may change. Readers should verify the latest official guidelines and consult the relevant bank, payment provider or qualified professional before making compliance or business decisions.