NSE

Fintech Brief — November 8, 2026 Today’s Top Stories RBI gives non-bank payment firms a six-hour breach clock and a SIM-change cooling period Days after tightening bank API security, RBI has turned to the non-bank side of payments. A consolidated Master Direction dated November 5, reported November 7, merges RBI’s older instructions on third-party ATM switch providers and payment-system audits into one cyber-resilience and digital-payment-security rulebook covering payment aggregators, prepaid payment instrument issuers, card networks and white-label ATM operators. The sharpest consumer-relevant clauses: operators get just six hours to report cyberattacks, critical-infrastructure outages, internal fraud and settlement delays to the regulator; they must enforce device binding, end inactive sessions automatically, and detect or block remote-access apps while a payment is in use; and any change to a customer’s registered mobile number or email triggers a minimum 12-hour cooling period before online transactions work on that instrument. Governance moves up to the board — a technology-risk committee meets at least quarterly, disaster recovery must sit in a different seismic zone with drills twice a year and near-zero recovery-point objectives, and annual system audits are due within two months of financial year-end with a three-month cap on fixing open observations. Large and medium operators comply immediately; small ones have until April 1, 2028. NDTV Profit · PSU Watch ...