Payments and FinTech — PCI and RBI compliance

Applicable regulations

• PCI DSS v4.0.1, and PCI PIN where applicable
• RBI Payment Aggregator and Payment System (PA/PSS) directions
• RBI data-localisation requirements for payment data
• ISO 27001 and SOC 2 for enterprise procurement
• DPDP Act 2023

Common cybersecurity risks

• An oversized CDE that inflates cost and audit burden
• Token vault and key-management weaknesses
• API abuse across merchant and partner integrations
• Payment data stored outside India, breaching localisation
• Rapid releases that outpace security review
• Sponsor-bank due-diligence failures that block go-live

Audit findings we typically see

• Scope not minimised through segmentation and tokenisation
• Incomplete SAQ and RoC evidence for service-provider requirements
• Gaps in quarterly ASV scans and annual VAPT closure
• Insufficient change-control evidence for CDE systems
• Secrets and keys held in code or CI pipelines

Services required

• PCI DSS assessment and scope reduction
• PCI PIN assessment
• RBI PA/PSS compliance audit
• ISO 27001 ISMS
• SOC 2 readiness
• ASV scanning and VAPT
• API penetration testing

Our engagement approach

• Scope reduction. Design segmentation and tokenisation to shrink the CDE before assessment.
• Assessment. PCI DSS gap and RoC readiness, with evidence collected once and reused across requirements.
• Testing. ASV scans, penetration testing and segmentation validation.
• Validation. QSA-led validation with localisation and PA/PSS control evidence.

Expected evidence

• CDE scope diagram after segmentation
• Tokenisation and key-management design
• ASV and VAPT reports with closure
• RoC and SAQ evidence pack

Deliverables

• Scope-reduction plan
• PCI DSS RoC and SAQ readiness
• Penetration-test and ASV reports
• PA/PSS control evidence