The new rules cover source code checks, annual system audits, third-party ATM switch providers and reporting of cyber incidents to the central bank. RBI introduces consolidated cybersecurity rules for non-bank payment operators.Annual system audits and third-party ATM checks become mandatory.Small payment operators must comply by April 1, 2028.