PA security: merchant controls, authentication and data

Security obligations cover the PA, relevant merchant infrastructure and the connected payment chain.

Published by Finin2min · Updated 24 October 2026

How this provision works

Use Board-approved information security, fraud monitoring and applicable PCI-DSS/PCI-SSF merchant controls. The PA direction’s baseline technology recommendations are mandatory for PAs, while adoption by a pure PG is recommended under that MD.
PAs are large non-bank PSOs for the 2024 cyber framework, whose implementation date was April 1, 2025. Do not assign them the small-PPI April 2028 transition. Board oversight, vendor security and incident/continuity controls must reflect the applicable framework.
The authentication direction’s domestic deadline was April 1, 2026. The general rule is two distinct independent factors, one dynamically created/proven for non-card-present transactions, subject to listed exemptions; SMS OTP is not the only permitted factor.
The merchant must not store customer card credentials in its database/server. Outsourcing or tokenisation terminology does not remove the applicable payment-data storage, access-control, audit and incident-reporting duties.
Cross-border CNP has its own October 1, 2026 requested-authentication/risk-control branch. Do not copy the domestic rules as an unconditional statement about every international transaction.

Practical illustration

A PA’s vendor contract says it is a technology gateway, but the PA stores sensitive card credentials on the merchant server. The label does not make that storage compliant or postpone the PA’s cyber implementation date.

The example is illustrative; it is not a reported company or court case.

Questions answered

Is the 2024 baseline optional for a PA because it is called recommendations?

The 2025 PA annex explicitly makes its baseline mandatory for PAs and recommends adoption for pure PGs.

Does outsourcing the checkout remove the PA’s security responsibility?

No. The PA’s framework, vendor controls and regulatory accountability remain applicable.

Primary source and edition

RBI PA Directions of 15 September 2025, read with the stated current common and payment-system instruments. PA paragraph 9,10(e), Annex 1; Cyber Directions 2024 paragraphs 3–5,27; Authentication Directions 2025 paragraphs 3–10.

Open the official instrument at this provision

Legal effect follows the instrument’s commencement and amendment provisions; a website upload date does not by itself change the law.

Related primary authorities

Scope and source editions

Reviewed against the named official editions on 24 October 2026. Product, regulated entity, transaction type and the instrument’s commencement or saving provisions determine applicability. Examples are illustrations rather than reported company cases.