RBI readiness

There is no RBI certification. Regulated entities are assessed through RBI supervision and inspection, their own information-systems audits, and specific audit reports — for example, the 2018 payment data localisation direction asked system providers for a System Audit Report by a CERT-In-empanelled auditor. Technology vendors are assessed indirectly, through the due diligence and contracts of the regulated entities they serve.

Banks, NBFCs, payment aggregators, card networks and other payment system operators — and, through outsourcing contracts, the fintechs and technology providers that build or run systems for them. Which directions apply depends on the licence: commercial banks follow the 2026 Digital Payment Security Controls Directions, non-bank payment system operators the 2024 cyber resilience directions, and every payment system provider the 2018 localisation direction.

• Payment data localisation. The entire data relating to payment systems is stored only in India; data processed abroad is deleted there and brought back within one business day or 24 hours.
• Card-on-file tokenisation. Since 1 October 2022 only card issuers and card networks store actual card data; everyone else uses tokens.
• Digital payment security controls. Secure application life cycle, strong customer authentication, session management, fraud and risk monitoring for internet, mobile and card payments.
• Cyber security framework. Board-approved cyber security policy, cyber crisis management plan, baseline controls and incident reporting to RBI.
• IT governance and assurance. IT strategy and risk committees, information security and cryptographic controls, change management, BCP/DR and periodic IS audit.
• Outsourcing and vendors. Regulated entities remain responsible for outsourced IT; vendors face audits, data-location clauses and right-to-inspect terms.

16 RuleFix rules run when RBI is selected on a project. 7 of the framework's controls have at least one rule mapped to them. The table is generated from the rule catalogue, so it always matches what the scanner runs.

A mapping means the rule checks part of that control in application code or configuration. Passing every rule does not satisfy a control: each one also needs process, people and infrastructure work that no code scanner can see.

Most of an audit is organisational. You need these in place regardless of what any scan finds:

• Governance. Board-approved policies, IT strategy and steering committees, CISO appointment and reporting lines.
• Fraud and transaction monitoring. Real-time fraud rules, velocity checks and transaction risk scoring.
• Reconciliation and customer protection. Settlement reconciliation, grievance redressal and turnaround times for failed transactions.
• Incident reporting and SOC. Cyber incident reporting to RBI and CERT-In, security operations centre and cyber crisis management.
• Infrastructure and resilience. Network security, VAPT, BCP/DR drills and data centre controls.
• What a resource actually stores. RuleFix flags non-India regions next to payment wording; only you can confirm whether payment data lives there.

Select RBI on each project in scope. Every scan then records findings with stable fingerprints. An issue becomes Fixed when a complete scan no longer finds it, when your agent resolves it with a confirming re-scan, or when a person marks it — and every status change is written to the audit log with who made it. The evidence report (print to PDF or JSON) collects the latest scan, score history, open and resolved findings and triage decisions per framework.

• Localisation findings are prompts, not verdicts. Resolve each one by moving the resource to an India region or by suppressing it with a written reason — the suppression and its reason are your record for the system auditor.
• Card-on-file and card-data findings show that application schemas and code keep tokens, not card numbers, which supports CoFT compliance reviews by your payment aggregator.
• If you are a vendor to a bank or payment aggregator, attach a RuleFix evidence report with RBI and PCI DSS selected to their security questionnaire.

• List which RBI directions apply to you — directly by licence, or through contracts with regulated entities.
• Map where payment data is stored, processed, replicated, backed up and logged, and confirm each location is in India.
• Turn on RuleFix with RBI selected for payment services; resolve every localisation and card-on-file finding.
• Verify signatures on every payment webhook and add idempotency keys to payment, refund and payout calls.
• Keep OTPs, PINs, bank account numbers and PANs out of logs; encrypt identifiers at rest.
• Keep payment sessions short and step up authentication for payee and payout changes.
• Prepare for the system audit: architecture diagrams, data-flow maps and a list of every cloud region in use.