A payment business may buy its software, security support and audit services from outside firms. The choice of supplier can affect who is eligible to give it an independent assessment later.
That connection sits inside the Reserve Bank of India’s consolidated directions for non-bank payment system operators, issued on November 5, 2026. They combine the July 2024 cyber-resilience framework with January 2020 system-audit instructions and December 2019 controls for third-party ATM switch providers.
The consolidated directions take effect on publication for large and medium non-bank operators. Small operators have an April 1, 2028 commencement date. The 2024 framework had already set April 1, 2025 and April 1, 2026 implementation dates for large and medium operators respectively. The November consolidation does not give those groups a fresh transition period. These are regulatory categories, rather than a business’s own description of its size.
The Breakdown
Under the system-audit section, the audit firm and its sister concerns must not have provided any type of service to the audited entity during the previous two financial years.
This creates a purchasing constraint. A firm hired to help put systems in place may be unavailable to independently audit those systems later. Procurement, technology and compliance teams therefore have a shared interest in the supplier’s recent work and related firms.
The audit covers both how controls are designed and whether they work in operation. The report and compliance status go to the board. Open findings require time-bound corrective action, with a maximum of three months, and reporting to RBI. They can be closed only after the auditor accepts closure.
The commercial implication is that an audit engagement involves more than delivering a report. It also needs room for evidence, remedial work and the auditor’s review of the result.
The supplier relationship continues after purchase
The directions also require access to the source code of critical applications bought from third parties, or an escrow arrangement where obtaining it is not possible, to support service continuity.
That provision already appeared in the July 2024 framework. The November document should be read as a consolidation, rather than a claim that every safeguard has just been introduced.
For white-label ATM operators using shared switch services, supplier contracts must require ongoing cyber controls and access for RBI supervision. This contractual approach also featured in RBI’s December 2019 circular. A switch handles the messages involved in processing transactions, making the supplier relationship part of the payment service’s operating foundations.
The Crunch
Read together, these provisions connect three business decisions: who builds or supplies the system, how the operator can keep it running, and who can independently check it.
For a payment company, those decisions belong in the same procurement conversation. A low software quote can leave continuity arrangements unresolved, while a convenient advisory relationship can narrow the later choice of auditor.
For customers, dependable payments rely partly on these less visible arrangements behind the screen.
Leave your thoughts