RBI's Bhubaneswar data centre: India builds a second fortress for payments

At a glance: WCRC Leaders' assessment: the RBI has turned payment resilience from a compliance line into national infrastructure, and every bank and fintech board should expect its own continuity plans to be judged against that bar. On 25 October 2026 the Prime Minister inaugurated the RBI's Data Centre and Cybersecurity Training Institute in Bhubaneswar, Odisha, with Finance Minister Nirmala Sitharaman and RBI Governor Sanjay Malhotra present. The facility, certified to the Uptime Institute Tier IV standard, will host payment and settlement systems that moved ₹2,273.7 lakh crore through RTGS alone in 2025-26.

What exactly opened in Bhubaneswar?

The RBI said in a press release on 25 October that the Prime Minister inaugurated its "newly established Data Centre and Cybersecurity Training Institute" in Bhubaneswar. Odisha Governor Brajmohan Ram and Chief Minister Mohan Charan Majhi also attended. In the RBI's account, Ms Sitharaman said the centre will house the RBI's mission-critical systems, including RTGS and NEFT, and that the institute will build expertise in cybersecurity and AI.

The Prime Minister's Office, announcing the visit, described "four state-of-the-art data centres" that will host mission-critical payment and settlement systems. It said the facility is certified to the Uptime Institute's Tier IV standard, among the largest such facilities in global financial services. Tier IV, the scheme's highest tier, is designed so any single component can fail without interrupting service. The PMO said the aim is "a secure, resilient, scalable and future-ready computing ecosystem" for the RBI and the wider financial sector.

Then Governor Shaktikanta Das laid the foundation stone on 22 March 2023 for a greenfield data centre and an Enterprise Computing and Cybersecurity Training Institute on an 18.55-acre site in Bhubaneswar. The RBI's 2025-26 Annual Report called it the "second greenfield data centre" and said construction was complete. The RBI has not published the cost of the project.

Why does a central bank need a second fortress?

Scale is the short answer. The RBI's annual report shows India processed 241.6 billion UPI transactions worth ₹314.2 lakh crore in 2025-26, up 30% by volume and 20.6% by value. UPI made up nearly 86% of all retail payment transactions. NEFT carried about 10.1 billion transactions worth ₹502.3 lakh crore.

The bigger number sits in wholesale. RTGS, which the RBI runs directly and which settles large interbank and corporate payments, handled 350 million transactions worth ₹2,273.7 lakh crore, up 12.9% by value. That is roughly seven times the value of all UPI payments in the year. When RTGS stops, banks cannot settle with each other, treasuries cannot move funds, and retail systems that settle through the RBI would eventually stall.

WCRC analysis: a single primary site, however well built, concentrates that risk in one place. A second purpose-built centre in a different region gives the RBI geographic separation from its existing infrastructure. The RBI has not published its site-selection reasoning. But Bhubaneswar sits on the east coast, far from India's western and northern land borders, and away from the Mumbai region where much of the country's financial infrastructure is concentrated. That matters more in a year when, as WCRC has reported, disruption around Hormuz has become a standing cost for Gulf and Indian firms. Pairing it with a training institute signals that the RBI sees skills, not just concrete, as the scarce resource.

What does it change for banks and fintechs?

Nothing in the rulebook changed on 25 October. What changed is the benchmark. The RBI's IT governance directions, in force since 1 April 2024, already require banks and larger NBFCs to run disaster recovery drills for critical systems at least every six months, to operate from the DR site as the primary site for at least a full working day during those tests, and to aim for a "near zero RPO" (recovery point objective, the amount of data that can be lost) for critical systems. A board IT Strategy Committee, chaired by an independent director with IT expertise, must meet quarterly.

For non-bank payment operators, the July 2024 cyber resilience directions set similar duties. The board owns cyber risk, incidents must reach the RBI within six hours of detection, and DR drills must run at least half-yearly. Large operators, including NPCI, a WCRC MegaBrand in banking-as-a-service and lending infrastructure, card networks and payment aggregators, had to comply by 1 April 2025. Medium operators followed on 1 April 2026, and small ones have until 1 April 2028.

The 2023 IT outsourcing directions close the escape route. The board stays ultimately responsible for outsourced work, cloud security is shared, and customer data must stay in India, under the RBI's April 2018 circular requiring payment system data to be "stored in a system only in India". The Digital Personal Data Protection Rules, notified in November 2025 with an 18-month phased compliance timeline, add duties on personal data.

For the largest lenders, HDFC Bank, one of WCRC 1000, India's Most Valuable Enterprises 2026, ICICI Bank, also one of WCRC 1000 and State Bank of India, one of WCRC 1000, RTGS and NEFT are daily plumbing. For UPI apps such as PhonePe, selected among India's Most Loved 250 Workplaces 2026 by the Business Intelligence Unit of WCRC, the settlement layer beneath every transaction runs through the RBI. WCRC analysis: a stronger core shifts the weak point outward. The next outage the public sees is more likely to start at a bank, an app or a vendor.

Why should Gulf and Asian corridors care?

India's payment rails are becoming regional infrastructure. The RBI's sixth remittances survey, published in March 2025, found India received US$118.7 billion in 2023-24. The six Gulf Cooperation Council countries accounted for 38% of that, and the UAE alone for 19.2%, second only to the United States.

The rails are spreading along those corridors. The RBI's annual report says UPI QR-code acceptance is live in eight jurisdictions: Bhutan, France, Mauritius, Nepal, Qatar, Singapore, Sri Lanka and the UAE. The UPI-PayNow link with Singapore has carried real-time personal remittances since February 2023. Work is under way to interlink the UAE's financial messaging systems with the RBI's Global SFMS Hub. India is also part of Project Nexus, which links fast payment systems across borders.

WCRC analysis: every new link makes India's core systems a dependency for partners abroad. An exchange house in Dubai, a bank in Doha or a remittance firm in Singapore now has a direct stake in the uptime of the RBI's core systems. A Tier IV second site is part of the answer to the question every foreign regulator asks before connecting its rails: what happens when yours go down?

What should CIOs and boards do now?

Treat the RBI's move as a reference point for your own plans. The threat is not theoretical: WCRC has examined the case of a single AI-assisted attacker linked to breaches at several South Korean financial institutions, and why boards are deploying AI faster than they can secure it. Boards in India should ask management for evidence, not assurances, on three things: when the institution last ran a full working day from its DR site, what its actual RPO and recovery time were for payment systems, and how many critical vendors could stop a payment flow on their own.

Gulf and Asian firms that use UPI, RuPay or Indian banking partners should map those dependencies and ask partners for their RBI drill results. Fintechs should bring payment-chain vendors inside their board-approved cyber policy, as the 2024 directions expect.

The WCRC View

The Bhubaneswar centre is the RBI building for the day something goes badly wrong, and saying so publicly. That raises the bar for everyone connected to its systems.

The winners are the large, well-run banks and payment operators that already test failover seriously. Their compliance spending now looks like strategy. The pressure falls on mid-sized lenders, smaller payment companies and the vendors behind them, where drills risk being run on paper.

Leaders should act this quarter: commission an independent review of DR readiness for payment systems, bring the results to the board's IT or risk committee, and fix the gaps before a supervisor finds them. Gulf and Asian partners should add Indian rail resilience to their own third-party risk registers.

WCRC will watch three things next: when the RBI starts running live payment systems from Bhubaneswar, whether it publishes resilience metrics for RTGS and NEFT, and whether the first courses at the training institute open to bank and fintech staff.

Quick answers

Q: What did Prime Minister Modi inaugurate on 25 October 2026? A: The RBI's Data Centre and Cybersecurity Training Institute in Bhubaneswar, Odisha, which will house systems including RTGS and NEFT.

Q: How big is the site and when did work begin? A: The campus covers 18.55 acres. The foundation stone was laid on 22 March 2023 by then Governor Shaktikanta Das.

Q: What does Tier IV certification mean? A: The Uptime Institute's highest tier, designed so systems keep running when any single component fails.

Q: How much value moves through RTGS? A: The RBI's annual report shows RTGS settled ₹2,273.7 lakh crore across 350 million transactions in 2025-26.