印度储备银行（RBI）近期发布的全面主指南要求非银行支付系统运营商在检测到异常事件（包括网络攻击、关键系统中断和结算延迟）后六小时内上报，专家表示，此举旨在加强网络安全，遏制日益猖獗的数字诈骗。
The RBI’s recent comprehensive master guidelines mandating non-bank payment system operators to report unusual incidents, including cyberattacks, critical system outages, and settlement delays, within six hours of detection are aimed at strengthening cybersecurity and curbing the growing menace of digital fraud, experts said.
该指令要求所有非银行支付系统运营商在规定的六小时窗口内，按规定格式向央行通报此类事件，以便更快地进行监管干预，并更好地监测支付生态系统面临的潜在威胁。
The directive requires all non-bank payment system operators to notify the central bank of such incidents in a prescribed format within the stipulated six-hour window, enabling quicker regulatory intervention and better monitoring of potential threats to the payments ecosystem.
印度储备银行还强制要求支付公司在检测到欺诈后六小时内向印度计算机应急响应小组（CERT-In）报告任何网络安全事件。
The Reserve Bank of India also mandates payment firms to report any cybersecurity incident to CERT-In within six hours of fraud detection.
专家表示，随着数字交易的快速扩张以及针对支付基础设施的网络威胁日益复杂，这一举措显得尤为重要。
Experts said the move assumes significance amid the rapid expansion of digital transactions and the growing sophistication of cyber threats targeting payment infrastructure.
印度储备银行修订后的《非银行支付系统运营商网络弹性与数字支付安全控制主指南》适用于印度国家支付公司（NPCI）、卡网络、支付聚合商、预付支付工具发行商和白标自动取款机运营商等。
The RBI’s revised Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators apply to the National Payments Corporation of India , card networks, payment aggregators, prepaid payment instrument issuers, and white-label ATM operators , among others.
央行针对数字交易、软件安全、系统审计和第三方服务提供商提出了严格要求，为支付系统运营商（PSO）规定了新的网络安全防护措施。
The central bank has introduced rigorous requirements for digital transactions, software security, system audits, and third-party service providers to prescribe new cyber safeguards for PSOs.
63SATS Cybertech联合董事总经理兼首席执行官Srinivas L对印度储备银行修订后更严格的网络安全指南表示欢迎，他说：“印度储备银行将分散的通告整合成了一本清晰的规则手册，这消除了所有借口。最重要的要求是持有关键第三方应用程序的源代码，或将其存入代管。”
Welcoming the RBI’s revised and stricter cybersecurity guidelines, 63SATS Cybertech Joint MD and CEO Srinivas L said, ”The RBI has turned scattered circulars into one clear rulebook, and that removes all excuses. The most significant is the requirement to hold the source code of critical third-party applications or keep it in escrow”.”Many payment breaches today do not begin inside the company.
他说：“如今许多支付领域的违规事件并非始于公司内部，而是始于无人完全了解的供应商软件。看不见，就无法防御。”
They begin in vendor software that nobody inside fully understands. You cannot defend what you cannot see.
连同年度系统审计、严格的事件报告和移动设备绑定，这将网络安全从IT机房带到了董事会，这是它应有的位置，”他说。
Together with annual system audits, tight incident reporting, and mobile device binding, this moves cybersecurity from the IT room to the boardroom, where it belongs,” he said.
印度储备银行要求每个PSO在财政年度结束后两个月内提交年度系统审计报告。它保留了客户更改注册手机号码或电子邮件地址后强制性的12小时冷却期。
The RBI requires every PSO to submit an annual system audit report within two months of the end of its financial year. It retains the mandatory 12-hour cooling-off period after a customer changes their registered mobile number or email address.
据Apollo Infoways创始人兼首席执行官拉维·普拉卡什表示，“强制性的六小时网络事件报告窗口传递了一个明确的信息：网络安全不再能保持被动合规职能。印度储备银行已迈出战略步伐，使印度的数字支付生态系统更加智能。”
他补充说，本月早些时候发布的修订版网络安全框架，标志着塑造印度下一代安全且有韧性的数字金融基础设施的重要里程碑。
According to Apollo Infoways founder and CEO Ravi Prakash, ”The mandatory six-hour cyber incident reporting window sends a clear message that cybersecurity can no longer remain a reactive compliance function. The RBI has taken a strategic step towards making India’s digital payment ecosystem more intelligent”.The revised cybersecurity framework issued earlier this month marks a significant milestone in shaping India’s next generation of secure and resilient digital financial infrastructure, he added.
新规则已对大型和中型PSO生效。然而，小型PSO已获准至2028年4月1日前合规。
The new rules are already in effect for large and medium PSOs. However, small PSOs have been given time until April 1, 2028, to comply.”
“这项法规凸显了从被动安全向主动网络韧性的转变。六小时报告窗口将迫使支付运营商投资于更强大的监控、事件响应和风险管理框架，”Nerix Technoserve首席执行官苏布希斯·马朱姆达尔表示。
This regulation underscores the shift from reactive security to proactive cyber resilience. The six-hour reporting window will compel payment operators to invest in stronger monitoring, incident response, and risk management frameworks,” Nerix Technoserve CEO Subhasis Majumdar said.
印度储备银行还规定了更严格的业务连续性安排。运营商必须在与主数据中心不同的地震区保持灾难恢复设施，并每年至少进行两次恢复演练。
The RBI has also prescribed stricter business continuity arrangements. The operators must maintain disaster recovery facilities in a different seismic zone from their primary data centres and conduct recovery drills at least twice a year.
斯里尼瓦斯指出，“印度运营着世界上最大的数字支付系统之一，该链条中的每个运营商都必须像其末端的银行一样强大。合规是底线，而韧性是目标。”
Srinivas pointed out, ”India runs one of the world’s largest digital payment systems, and every operator in that chain must be as strong as the bank at its end. Compliance is the floor, while resilience is the goal”.