Who regulates what
A bank’s technology answers to more than one authority. RBIReserve Bank of India. India's central bank. It regulates banks and payment systems, runs RTGS and NEFT, and holds the accounts in which banks settle with one another. regulates banks and payment systems; other bodies cover cyber incidents, identity, personal data and the financial markets in which banks also operate.
| Body | What it regulates or runs | Where it touches bank technology |
|---|---|---|
| Reserve Bank of India (RBI) | Banks, non-bank lenders and payment systems | IT governance, outsourcing and cloud, cyber security, payment data storage, authentication, KYC, failed-transaction rules |
| National Payments Corporation of India (NPCI) | Operator of retail payment systems, authorised by RBI | Technical specifications, certification and operating rules for UPI, IMPS, cards and other systems it runs |
| CERT-In | National agency for cyber incidents, under MeitY | Incident reporting deadlines and log retention |
| Ministry of Electronics and IT (MeitY) | IT Act and data protection law | Digital Personal Data Protection Act and Rules |
| UIDAI | Aadhaar | Aadhaar authentication and e-KYC for banks acting as authentication or e-KYC user agencies |
| FIU-IND | Financial intelligence under the Prevention of Money-laundering Act | Suspicious and cash transaction reporting systems |
| SEBI, IRDAI, PFRDA | Securities, insurance and pensions | Rules for bank activities in those markets, such as broking, depository and insurance distribution |
| Ministry of Finance and FSDC | Financial policy and coordination between regulators | Laws such as the SARFAESI Act; inter-regulatory issues |
NPCINational Payments Corporation of India. A not-for-profit company set up in 2008 as an initiative of RBI and the Indian Banks' Association, owned by banks. It runs retail payment systems such as UPI and the National Financial Switch. is not a regulator in the legal sense, but its rules bind every participant in the systems it runs. NPCI was incorporated in December 2008 as a not-for-profit company, an initiative of RBI and the Indian Banks' Association under the Payment and Settlement Systems Act, 2007.19ICRA. National Payments Corporation of India: rating rationale. As of 30 June 2025. RBI classified NPCI as a system-wide important payment system in June 2020.19ICRA. National Payments Corporation of India: rating rationale. As of 30 June 2025.
How rules are made
RBI usually consults before it regulates. It publishes a draft, invites comments, then issues a final instrument. The 2025 authentication framework followed that path: Before issuing its 2025 authentication Directions, RBI published draft directions for comment on 31 July 2024 and 7 February 2025.7Business Standard. RBI issues Directions on Framework on Authentication Mechanisms for Digital Payment Transactions. As of 25 September 2025. RBI's Authentication Mechanisms for Digital Payment Transactions Directions, 2025, issued on 25 September 2025, require at least two factors of authentication for domestic digital payments, with compliance from 1 April 2026.6The Tribune. RBI unveils new directions to strengthen digital payment security. As of 25 September 2025. Model risk guidance is at the draft stage now: On 24 June 2026 RBI released draft guidance on model risk management across the model lifecycle, including models that use AI and machine learning, for public comment.18Business Standard. Reserve Bank issues draft Regulatory Principles for Management of Model Risks. As of 25 June 2026.
RBI’s rules take a few forms:
- Master Directions set out all the rules on a subject in one place and are updated as the rules change.
- Circulars issue specific instructions.
- Master Circulars consolidate circulars on a subject as of a date.
Other bodies use their own instruments: CERT-InIndian Computer Emergency Response Team. India's national agency for responding to cyber security incidents. Organisations, including banks, must report certain incidents to it. issues directions under the IT ActInformation Technology Act, 2000. India's main law on electronic records, digital signatures and cyber offences., and MeitYMinistry of Electronics and Information Technology. The ministry responsible for the IT Act and the Digital Personal Data Protection Act. notifies rules under the laws it administers.
The main technology mandates
| Mandate | Issued by | Date | What it requires, in brief |
|---|---|---|---|
| IT Governance, Risk, Controls and Assurance Practices Directions | RBI | 7 Nov 2023 | Board-level IT governance, risk management, recovery objectives and DR drills |
| Outsourcing of IT Services Master Direction | RBI | 10 Apr 2023 | Due diligence, accountability, cloud use, incident reporting and exit plans |
| Storage of Payment System Data | RBI | 6 Apr 2018 | Payment data stored only in India |
| Restriction on storage of actual card data (card-on-file) | RBI | 28 Jul 2022 | Only issuers and networks may store card data; merchants use tokens |
| Harmonisation of turnaround time for failed transactions | RBI | 20 Sep 2019 | Deadlines for reversals and automatic compensation |
| Positive Pay System for CTS | RBI | 25 Sep 2020 | Advance confirmation for large cheques |
| Continuous clearing in CTS: Phase 2 postponed | RBI | 24 Dec 2025 | Phase 1 continues; Phase 2 postponed; new session hours |
| Account Aggregator Master Direction | RBI | 2 Sep 2016 | Licensing and operation of consent-based data sharing |
| Central KYC Records Registry operationalised | RBI | 8 Jul 2016 | Use of the central KYC registry run by CERSAI |
| Directions under section 70B(6) of the IT Act | CERT-In | 28 Apr 2022 | Report incidents within 6 hours; keep logs for 180 days in India |
Dates are issue dates. Check each source for amendments and effective dates. Sources1Reserve Bank of India. Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices (RBI/2023-24/107). As of 7 November 2023.2Reserve Bank of India. Master Direction on Outsourcing of Information Technology Services (RBI/2023-24/102). As of 10 April 2023.3Reserve Bank of India. Storage of Payment System Data (RBI/2017-18/153). As of 6 April 2018.4Reserve Bank of India. Restriction on Storage of Actual Card Data [i.e. Card-on-File (CoF)] (RBI/2022-2023/95). As of 28 July 2022.5Reserve Bank of India. Harmonisation of Turn Around Time (TAT) and customer compensation for failed transactions using authorised Payment Systems (RBI/2019-20/67). As of 20 September 2019.10Reserve Bank of India. Positive Pay System for Cheque Truncation System (RBI/2020-21/41). As of 25 September 2020.11Reserve Bank of India. Continuous Clearing and Settlement on Realisation in Cheque Truncation System: Phase 2 (RBI/2025-26/156). As of 24 December 2025.8Reserve Bank of India. Master Direction - Non-Banking Financial Company - Account Aggregator (Reserve Bank) Directions, 2016 (updated 6 September 2024). As of 6 September 2024.9Reserve Bank of India. Amendment to Master Direction on KYC: Operationalisation of Central KYC Registry (RBI/2016-17/11). As of 8 July 2016.12CERT-In, Ministry of Electronics and Information Technology. Directions under sub-section (6) of section 70B of the IT Act, 2000 (28 April 2022). As of 28 April 2022.
The detail behind several of these:
- Payment data. RBI's circular of 6 April 2018 requires payment system providers to store the entire data relating to their payment systems only in India; data on the foreign leg of a transaction may also be stored abroad.3Reserve Bank of India. Storage of Payment System Data (RBI/2017-18/153). As of 6 April 2018. Payment system providers had to comply within six months and submit a system audit report by a CERT-In-empanelled auditor; the circular was issued under the Payment and Settlement Systems Act, 2007.3Reserve Bank of India. Storage of Payment System Data (RBI/2017-18/153). As of 6 April 2018.
- Cyber incidents. CERT-In's directions of 28 April 2022 under section 70B(6) of the IT Act require reportable cyber incidents to be reported to CERT-In within 6 hours of noticing them; they took effect 60 days after issue.12CERT-In, Ministry of Electronics and Information Technology. Directions under sub-section (6) of section 70B of the IT Act, 2000 (28 April 2022). As of 28 April 2022. The same CERT-In directions require logs of all ICT systems to be kept securely for a rolling 180 days, within Indian jurisdiction.12CERT-In, Ministry of Electronics and Information Technology. Directions under sub-section (6) of section 70B of the IT Act, 2000 (28 April 2022). As of 28 April 2022. RBI adds its own clock for incidents at suppliers: A service provider must report cyber incidents to the regulated entity without undue delay, so that the entity can report them to RBI within 6 hours of the provider detecting them.2Reserve Bank of India. Master Direction on Outsourcing of Information Technology Services (RBI/2023-24/102). As of 10 April 2023.
- Personal data. MeitY notified the Digital Personal Data Protection Rules on 13 November 2025. Provisions on the Data Protection Board applied at once, consent-manager rules apply from 13 November 2026, and most obligations on organisations apply from 13 May 2027.13S.S. Rana & Co.. MeitY notifies final Digital Personal Data Protection Rules 2025. As of 14 November 2025.
How rules are enforced
RBI supervises banks through off-site returns and on-site inspections, including IT examinations. When it finds weaknesses, it issues corrective action plans; when those are not met, it can restrict business.
- Payment data storage. RBI had earlier restricted American Express and Diners Club from onboarding new domestic customers from 1 May 2021 on the same grounds.16The Tribune. RBI bars Mastercard from adding new clients in India. As of 14 July 2021. RBI barred Mastercard from onboarding new domestic card customers from 22 July 2021 for not complying with the payment data storage directions.15Business Standard. RBI restricts Mastercard from onboarding new domestic customers. As of 14 July 2021. RBI lifted the restriction on Mastercard in June 2022 after satisfactory compliance with the data storage directions.17Reserve Bank of India. Restrictions on Mastercard lifted (press release). As of 16 June 2022.
- IT resilience. On 24 April 2024 RBI directed Kotak Mahindra Bank to stop onboarding new customers through online and mobile channels and to stop issuing new credit cards, citing concerns from its IT examinations of the bank for 2022 and 2023.14All India Radio News (Prasar Bharati). RBI directs Kotak Mahindra Bank to cease issue of fresh credit cards, bars onboarding of new online customers. As of 24 April 2024.
The pattern is consistent. Restrictions target growth, such as new customers or new cards, rather than existing customers, and they are lifted once the regulator is satisfied the gaps are closed. Limitations and known problems describes these cases in more detail.
Questions for a compliance review
- Which of the mandates above apply to this system, and who owns evidence for each?
- Where is this system’s payment data stored, including backups and logs?
- Could a cyber incident here be reported to CERT-In and RBI within 6 hours?
- Which parts of this system are outsourced, and is the outsourcing assessment complete?
- Which rules affecting this system are still in draft, and who is tracking them?