Resources Categories
INDUSTRY FACT FILE · PAYMENTS & TRANSACTION PROCESSING
Market Landscape and the Drivers of Cybersecurity Demand
The business, technology, regulatory, legal and statutory forces that create cybersecurity, audit and assurance work for payments and transaction processing companies.
|
In this document 1. Market landscape 2. Business drivers 3. Technology drivers 4. Regulatory drivers 5. Legal and statutory drivers 6. How the drivers differ by segment 7. What this means for buyers and for Codec Networks |
1. Market landscape
India's digital payments market is large, regulated and still growing quickly. Transaction volumes keep setting records, the number of authorised non-bank entities is rising as RBI formalises categories such as payment aggregators, and lending and data-sharing ecosystems are scaling on the same digital public infrastructure.
|
24.51 bn UPI transactions in Aug 2026 |
218.6 bn UPI transactions in FY26 to February |
1,100+ Regulated entities live on the AA ecosystem |
6 hours Deadline to report specified cyber incidents |
1.1 Market segments and buying behaviour
|
Market segment |
Landscape and buying behaviour |
Cybersecurity opportunity |
|
Newly authorised and applicant PAs |
Non-bank PAs had to apply under the 2025 Master Direction; physical-only PAs had to apply by 31 December 2025 or wind down by 28 February 2026. Authorised PAs face recurring audits. |
Annual system and cyber audits by CERT-In empanelled auditors, half-yearly VAPT, baseline technology controls |
|
Large non-bank PSOs |
Card networks, large PPI issuers, PAs, BBPOUs, TReDS and ATM networks were due to comply with the 2024 cyber resilience directions by 1 April 2025. |
Control-effectiveness reviews, SOC maturity, Board reporting, resilience testing |
|
Medium and small PSOs |
Medium PPI issuers and inbound MTSS operators by 1 April 2026; small PPI issuers and instant money transfer operators by 1 April 2028. |
Gap assessments, roadmap delivery, managed services sized to lean teams |
|
Digital lending ecosystem |
Banks, NBFCs and LSPs operating under the 2025 Digital Lending Directions, with DLA reporting and multi-lender transparency rules. |
API security, privacy programmes, LSP and partner assessments |
|
Fintech infrastructure and SaaS |
Vendors selling to regulated entities must pass partner security due diligence. |
SOC 2 / ISO 27001 readiness, PCI DSS, secure SDLC evidence |
|
Cross-border and remittance players |
PA-CB and MTSS operators handle FX flows with high AML and partner scrutiny. |
Transaction-monitoring reviews, third-party risk, logging assurance |
|
Market signal Regulation in this sector increasingly prescribes not only what controls must exist but how often they must be tested and by whom—for example, annual cyber security audits by CERT-In empanelled auditors and half-yearly VAPT reports for payment aggregators. This creates predictable, recurring assurance demand. |
2. Business drivers
These explain why management allocates money to cybersecurity.
|
Business driver |
Buying trigger |
Relevant services |
|
Licence and authorisation |
Applying for or retaining RBI authorisation; responding to supervisory observations |
Regulatory cyber audits, gap assessments, evidence management |
|
Transaction success and uptime |
Outages, failed transactions and settlement delays damage merchant and partner trust |
Resilience and DR testing, SOC, availability and DDoS readiness |
|
Fraud and chargeback reduction |
Rising account takeover, mule merchants and social-engineering scams |
Fraud-scenario testing, mule analytics, forensic investigations |
|
Bank and network partnerships |
Sponsor banks, escrow banks and networks run their own due diligence on fintech partners |
Partner-ready assurance packs, PCI DSS, third-party questionnaires |
|
Enterprise and merchant sales |
Large merchants and enterprises demand security evidence before integrating |
ISO 27001, SOC 2 readiness, VAPT reports, secure SDLC evidence |
|
Funding, M&A and IPO diligence |
Investors and acquirers examine cyber risk and regulatory standing |
Cyber due diligence, maturity assessments, Board reporting |
|
Customer trust and brand |
Data leaks and fraud incidents go viral quickly |
Brand and rogue-app monitoring, privacy programmes, incident readiness |
|
Limited internal capacity |
Lean security teams cannot cover 24x7 monitoring and specialist testing |
Managed SOC, virtual CISO support, testing retainers |
3. Technology drivers
These explain what changes in the technology environment create new security work.
|
Technology driver |
Exposure created |
Codec Networks opportunity |
|
Open APIs and SDKs |
Broken object-level authorisation, excessive data exposure, insecure third-party SDKs |
API security testing, SDK reviews, API gateway assessments |
|
Cloud-native platforms |
Misconfiguration, excessive IAM permissions, exposed storage and secrets |
Cloud posture reviews, Kubernetes and container testing, secrets audits |
|
Real-time rails |
Fraud moves faster than manual review; outages are instantly visible |
Real-time monitoring design, SOC use cases, resilience testing |
|
New authentication methods |
Biometric, device-binding and token-based factors replace or supplement SMS OTP |
Authentication flow testing, mobile app hardening, device-integrity checks |
|
Tokenisation and HSMs |
Token vaults and key management become crown-jewel systems |
Cryptographic and key-management reviews, PCI DSS assessments |
|
AI and machine learning |
Deepfake-assisted KYC, model manipulation, prompt injection in AI assistants |
AI/LLM security testing, deepfake simulation, AI governance |
|
Rapid release cycles |
Security defects reach production through code, dependencies and pipelines |
SAST/DAST, secure code review, CI/CD and supply-chain testing |
|
Ecosystem dependence |
Processors, KYC vendors and cloud providers become indirect attack paths |
Third-party risk management, vendor assurance reviews |
Figure 3: The four groups of drivers behind cybersecurity spending in payments and transaction processing.
4. Regulatory drivers
The RBI regulates payment systems under the Payment and Settlement Systems Act, 2007. Since May 2025, the Payments Regulatory Board (PRB), chaired by the RBI Governor, has replaced the earlier Board for Regulation and Supervision of Payment and Settlement Systems; the RBI formally constituted the PRB on 30 September 2025. The table summarises the instruments with the greatest cybersecurity impact.
|
Instrument |
Who it applies to |
Key cybersecurity requirements |
|
RBI Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank PSOs (30 July 2024) |
All authorised non-bank PSOs; phased: large by 1 Apr 2025, medium by 1 Apr 2026, small by 1 Apr 2028 |
Board-level oversight with a sub-committee meeting at least quarterly; Board-approved IS policy and Cyber Crisis Management Plan; accountable CISO Asset inventory, SOC with SIEM correlation, network segmentation, secure SDLC; security testing (source code review, VA and PT) at least annually and before new critical services go live Incident reporting to RBI within 6 hours of detection and to CERT-In; backups tested at least half-yearly; DR site in a different seismic zone; DR drills at least half-yearly MFA for electronic debits, real-time fraud monitoring, anti-phishing and anti-rogue-app services, device binding and a 12-hour cooling period after a mobile number or e-mail change |
|
RBI Master Direction on Regulation of Payment Aggregators (15 September 2025) |
PA-Online, PA-Physical and PA-Cross Border; bank and non-bank PAs (payment gateways encouraged to follow the baseline technology recommendations) |
Board-approved IS policy reviewed at least annually; mandatory baseline technology recommendations (Annexure 1); IT Steering Committee and Cyber Crisis Management Plan Annual system audit including a cyber security audit by CERT-In empanelled auditors; annual IS and cyber audit reports; half-yearly VAPT reports; quarterly internal audit reports to the IT Committee Merchant due diligence and post-onboarding monitoring; FIU-IND registration for non-bank PAs; card credentials not stored on merchant-accessible systems; PCI DSS and PCI SSF compliance for merchant infrastructure where applicable PAs are also guided by the 2024 cyber resilience directions for non-bank PSOs |
|
RBI (Authentication Mechanisms for Digital Payment Transactions) Directions, 2025 (25 September 2025) |
Payment system providers and participants, bank and non-bank; domestic digital payments |
In force from 1 April 2026: at least two factors of authentication, with at least one dynamic factor (subject to specified exemptions) No single factor is mandated, enabling alternatives to SMS OTP; risk-based additional checks permitted Card issuers have specific obligations for cross-border card-not-present transactions from 1 October 2026 |
|
RBI (Digital Lending) Directions, 2025 (8 May 2025) |
Regulated lenders and their LSPs and DLAs |
Consolidates earlier digital lending guidelines; DLA reporting on CIMS from 15 June 2025; multi-lender LSP transparency from 1 November 2025 Data collection, storage and sharing restrictions for DLAs and LSPs, supporting privacy and security assessments |
|
RBI Storage of Payment System Data (6 April 2018) |
Payment system providers and their ecosystem |
Entire payment system data to be stored in systems only in India (with defined treatment for the foreign leg of cross-border transactions) System Audit Report on compliance by a CERT-In empanelled auditor |
|
RBI Master Directions on Prepaid Payment Instruments (27 August 2021, as updated) |
Bank and non-bank PPI issuers |
KYC, limits and interoperability rules; security and fraud-risk controls; a draft replacement direction was issued for consultation on 22 April 2026 |
|
Card-on-File Tokenisation (effective 1 October 2022) |
Merchants, PAs and gateways handling card payments |
No storage of actual card data by merchants and their PAs except as permitted; tokens replace card numbers |
|
RBI customer-protection framework for fraudulent electronic banking transactions (amendment issued 24 June 2026) |
Banks (for transactions on or after 1 January 2027) |
Broader liability regime covering fraudulent transactions; burden of proof on banks; affects fintech partners whose channels carry bank transactions |
Figure 4: Regulatory timeline — instruments in force and upcoming obligations as of October 2026.
|
Recognised self-regulation The RBI recognised the Fintech Association for Consumer Empowerment (FACE) as the first Self-Regulatory Organisation for the FinTech sector on 28 August 2024. NPCI rules and circulars also impose security and operational requirements on UPI participants and TPAPs. |
5. Legal and statutory drivers
|
Law or obligation |
Relevance to payments and transaction processing |
Demand created |
|
Payment and Settlement Systems Act, 2007 |
Basis for authorisation and RBI directions to payment system operators |
Regulatory audits, authorisation readiness, supervisory responses |
|
Information Technology Act, 2000 and CERT-In Directions (28 April 2022) |
Report specified cyber incidents to CERT-In within 6 hours; maintain ICT logs for a rolling 180 days within India; synchronise system clocks with NIC or NPL NTP servers; designate a point of contact |
Logging assurance, incident readiness, SOC, forensic support |
|
Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 (notified 13 November 2025) |
Phased commencement: Board-related provisions immediately; consent-manager provisions after 12 months; most data-fiduciary obligations, including security safeguards and breach intimation, after 18 months (May 2027) |
Data mapping, consent and notice review, security safeguards, breach workflows, processor oversight |
|
Prevention of Money Laundering Act, 2002 |
Reporting entity obligations; non-bank PAs must register with FIU-IND under the PA Master Direction |
Transaction-monitoring system reviews, record integrity, investigations support |
|
Foreign Exchange Management Act, 1999 |
Governs cross-border flows handled by PA-CB and remittance players through AD banks |
Control reviews for cross-border platforms, partner assurance |
|
Contracts and industry standards |
PCI DSS v4.0.1 (future-dated requirements mandatory since 31 March 2025), card network rules, sponsor-bank and escrow-bank agreements |
PCI DSS readiness, payment-page security, partner assurance evidence |
|
Breach clock under the DPDP Rules Once the breach provisions commence, a data fiduciary must intimate the Data Protection Board without delay and submit a detailed report within 72 hours (unless extended). This runs alongside the 6-hour CERT-In and RBI reporting timelines that already apply to many payment entities. |
6. How the drivers differ by segment
|
Segment |
Dominant business drivers |
Dominant technology drivers |
Principal regulatory drivers |
|
Payment aggregators |
Merchant trust, approval rates, partner-bank confidence |
Checkout pages, APIs, SDKs, settlement automation |
PA Master Direction 2025; 2024 PSO cyber directions; PCI DSS; data localisation |
|
PPI issuers and wallets |
Customer trust, fraud losses, interoperability |
Mobile apps, KYC/V-CIP, device binding |
PPI directions; 2024 PSO cyber directions; Authentication Directions |
|
PSOs, networks and switches |
Systemic availability, participant confidence |
High-availability platforms, HSMs, real-time fraud tools |
2024 PSO cyber directions (large category); RBI oversight; CERT-In |
|
Digital lending platforms |
Partner-lender confidence, customer trust, collections |
Apps, APIs, AA connectors, AI underwriting |
Digital Lending Directions 2025; DPDP Act; lender outsourcing obligations |
|
Account Aggregators |
Ecosystem trust and data integrity |
Consent and encryption platforms, high-volume APIs |
NBFC-AA directions; DPDP Act; CERT-In |
|
Cross-border players |
Partner and correspondent confidence, AML standing |
FX and screening integrations |
PA-CB / MTSS rules; FEMA; PMLA |
7. What this means for buyers and for Codec Networks
|
Customer buying need |
Recommended offering |
Natural recurring engagement |
|
“We must pass our RBI-mandated audits.” |
Regulatory cyber audit and assurance programme |
Annual audit calendar, half-yearly VAPT, closure validation |
|
“We need to launch or change products safely.” |
Application, API and cloud security |
Release-based testing and DevSecOps retainer |
|
“We need 24x7 visibility and a 6-hour response capability.” |
Managed SOC and incident response |
Monitoring, threat hunting and response retainer |
|
“We must be ready for DPDP obligations.” |
Privacy and data-protection programme |
Periodic reviews, DPO support, breach-drill exercises |
|
“Our partner banks and merchants want proof.” |
Partner assurance programme |
PCI DSS, ISO 27001 / SOC 2 maintenance, questionnaire support |
|
“Our Board needs to understand cyber risk.” |
Board advisory and virtual CISO support |
Quarterly risk reporting aligned to the Board sub-committee cycle |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document summarises regulatory and legal instruments as published up to October 2026. It is not legal advice. Applicability depends on the entity's authorisation, category and activities; confirm obligations against the current official text of each instrument, including amendments and FAQs.