India fintech sector faces cybersecurity and monetization challenges

India's fintech landscape is navigating significant shifts in cybersecurity requirements and payment monetization. Cybersecurity incidents in India rose from 10.29 lakh in 2022 to 22.68 lakh in 2024. In response, regulators have transitioned security from a best practice to a binding obligation. The Reserve Bank of India (RBI) now requires board-level IT strategy committees, while the Digital Personal Data Protection Rules, 2025, mandate compliance within 18 months, with potential penalties of up to ₹250 crore for security failures.

Simultaneously, the industry is awaiting clarity on the monetization of the Unified Payments Interface (UPI). The National Payments Corporation of India (NPCI) has deferred the introduction of merchant discount rate (MDR) charges on certain person-to-merchant transactions. Under the proposed framework, eligible transactions above ₹2,000 could attract a 0.40% fee, capped at ₹300. While the proposal faced resistance from retail associations and a legal challenge in the Supreme Court, the court declined to stay the charges. Despite a slight month-on-month decline in transaction volumes in September, daily transaction averages reached record highs.