RBI Compliance
RBI Digital Payment Security Controls:
what they require of mobile apps
In July 2026 the RBI issued Digital Payment Security Controls Directions for Payments Banks, Small Finance Banks and Co-operative Banks, each dated 31 July 2026 and effective immediately. A dedicated chapter sets mobile payment app controls, including device binding and re-authentication, while checks such as root detection are advisory.
Which banks do these directions apply to?
The RBI issued separate Digital Payment Security Controls Directions in 2026 for Payments Banks (RBI/DoS/2026-27/429), Small Finance Banks (RBI/DoS/2026-27/420) and Co-operative Banks (RBI/DoS/2026-27/438), each dated 31 July 2026. The Payments Banks directions state that they come into effect immediately upon issuance and apply to digital payment products and services the bank offers, including through RBI-operated systems and authorised payment system operators.
Check the direction that applies to your category of bank on rbi.org.in; the mobile chapter wording is closely aligned across them.
What do they require of mobile payment apps?
The mobile payments application chapter sits on top of the general controls. Its headline requirements are:
- Device binding of the app, built from hardware, software and service information, with the user notified of every new device registration.
- Re-authentication when the device or app has been unused for a set period and every time the app is launched.
- Remote-access awareness: identify remote access applications, to the extent possible, and prohibit login.
- App integrity and version control: verify the app version before transactions are enabled, phase out older versions within six months, and host the checksum of the current version publicly (or link to the official store listing).
- Device and network posture: device policy enforcement against vulnerable operating systems, vulnerable or malicious apps and insecure Wi-Fi, and extra checks on new or unsecured networks.
- Data protection on the device: no storage of sensitive authentication data, wiping sensitive data from memory on exit, encrypted local data and code obfuscation (an illustrative list, with alternative controls allowed).
Several items are advisory rather than mandatory: the bank may explore a rooted or jailbroken device check, may add anti-malware capability, and may use alternatives to SMS OTP.
What do most teams get wrong?
- Treating "may" items as mandatory, or the reverse. Read the verb in the clause.
- Implementing device binding as a stored token only, instead of tying it to hardware as the text describes.
- Checking device health once at login, when the controls expect posture to be assessed through the session.
- Assuming RBI controls are the whole story for UPI: NPCI's separate circular is stricter on rooted devices.
How this relates to RASP and NPCI
Runtime application self-protection is one way to implement the device, integrity and remote-access controls in this chapter. What is mobile RASP → If your app handles UPI, also read the NPCI circular that mandates RASP for UPI apps. NonaShield helps banks and PSPs comply; talk to us about your category of bank.
Frequently asked questions
What are the RBI Digital Payment Security Controls Directions?
They are supervisory directions issued by the RBI that set security controls for digital payment products and services. In 2026 the RBI issued versions for Payments Banks, Small Finance Banks and Co-operative Banks, each dated 31 July 2026 and effective immediately.
Which RBI directions cover mobile payment apps?
Each of the three 2026 directions includes a chapter on mobile payments application security controls, in addition to its general controls. It applies to banks offering or intending to offer mobile banking or mobile payments through a mobile application.
Does the RBI require root or jailbreak detection?
Not as a firm requirement. The text says the bank may explore the feasibility of a check that stops the app installing or functioning on a rooted or jailbroken phone. For UPI apps, NPCI's circular separately makes root detection mandatory.
Does the RBI require device binding?
Yes. The bank shall ensure device binding of the mobile application, implemented through a combination of hardware, software and service information, with notification of new device registrations and a record of registered devices.
Does the RBI mention remote-access scams?
Yes. The mobile controls include the ability to identify remote access applications, to the extent possible, and prohibit login access to the mobile application.
See it on your app.
Book a free 30-day shadow pilot, or download the platform brochure.