NPCI Product Security Audits (IMPS, RuPay, AePS, NACH, NFS, FASTag, CTS)

Introduction to NPCI Product Security Audits

The National Payments Corporation of India (NPCI) is the umbrella organisation for retail payments and settlement systems in India, operating under the Payment and Settlement Systems Act, 2007 and regulated by the Reserve Bank of India (RBI). NPCI owns and operates a portfolio of nationally critical payment products, including the Immediate Payment Service (IMPS), RuPay card scheme, Aadhaar enabled Payment System (AePS), National Automated Clearing House (NACH), National Financial Switch (NFS), FASTag on the National Electronic Toll Collection (NETC) rails, Cheque Truncation System (CTS) and the Unified Payments Interface (UPI) with its overlay services. Every bank, non-bank member, Payment System Provider (PSP), Third Party Application Provider (TPAP), technical service provider (TSP), aggregator and merchant that integrates with these rails must undergo periodic security certification and audit before go-live and on a recurring basis thereafter.

NPCI Product Security Audits are the mandated technical and process assurance reviews that verify a participant's implementation of an NPCI product conforms to the applicable Procedural Guidelines, technical specifications, API integration specifications, risk management framework circulars and the overarching security requirements laid down by NPCI and RBI. Unlike a generic information security audit, these audits are product-specific: an IMPS audit checks Remitter/Beneficiary flows, session and OTP controls and the NFS/IMPS switch interface, whereas a RuPay audit examines PCI DSS scope, HSM key ceremonies, EMV/tokenisation and the RuPay authorisation host. This guide provides an auditor-grade, product-by-product deep dive that serves both the assessor performing the certification and the engineering, risk and compliance teams building or remediating the controls.

What is NPCI Product Audits

NPCI Product Audits is a family of product-scoped security certifications and periodic audits that a member entity must complete to obtain and retain the right to transact on a given NPCI rail. The audit universe is defined by three layers of authority: (1) statutory and regulatory instruments — the PSS Act 2007, RBI's Master Directions on Digital Payment Security Controls (RBI/2020-21/74, DoS.CO.CSITE.SEC.No.1852/31.01.015/2020-21), RBI's cyber security framework for banks (DBS.CO.CSITE/2016-17), and the RBI PA/PG guidelines for aggregators; (2) NPCI product Procedural Guidelines and Operating Circulars issued per product; and (3) scheme technical and security specifications such as the RuPay compliance and tokenisation specs, the UPI Procedural Guidelines and API specs, the AePS/Aadhaar authentication ecosystem requirements set by UIDAI, and the NACH/CTS operating specifications.

The audits are typically executed by a CERT-In empanelled auditor, and for card products additionally by a PCI QSA, culminating in a certification report, a compliance declaration and, for several products, a sign-off that NPCI accepts through the member/NPCI Connect portal before enabling the entity in production. Certification is not one-and-done: most products require an annual security audit, a fresh audit on any material change (new API version migration, new data centre, major architecture change), and continuous compliance with fraud and risk management (FRM) circulars issued through the year.

Each product carries a distinct control surface. IMPS is a real-time push credit rail over the NFS switch. RuPay is a card scheme with PCI DSS, EMV, HSM and tokenisation obligations. AePS relies on Aadhaar biometric/demographic authentication and therefore inherits UIDAI's Aadhaar Act 2016, AUA/KUA, ASA and biometric device (Registered Device / L1) requirements. NACH is a bulk mandate and clearing rail with e-mandate/API mandate and file integrity concerns. NFS is the ATM/interoperable switch network. FASTag/NETC covers RFID tag issuance, toll acquiring and reconciliation. CTS covers cheque image capture, IQA (Image Quality Assurance) and the CTS-2010 standard.

Who must comply

Any entity that connects to, processes, stores or transmits data on an NPCI rail is in scope. The obligation cascades from the sponsor/member bank down to every technical partner and outsourced provider under RBI's outsourcing and NPCI's third-party accountability principles.

• Go-live prerequisite: no entity is enabled in production on a rail without a passed certification/audit and NPCI acceptance.
• Annual recertification: most products mandate a fresh security audit at least once every financial year.
• Change-triggered audit: migration to a new API/spec version, new DR/DC, or major architectural change re-triggers audit.
• Flow-down: members remain accountable for the compliance posture of every downstream TSP/TPAP/aggregator they sponsor.

Structure of NPCI Product Audits

The audit programme is organised as a set of cross-cutting control domains that apply to every product, plus product-specific control families layered on top. The cross-cutting domains derive from RBI's Digital Payment Security Controls and the NPCI security baseline; the product families derive from each product's Procedural Guidelines, technical spec and risk circulars.

Master assessment checklist

This is the core of the audit. Each control group below is enumerated with what the auditor must verify and the typical evidence the implementer must produce. The cross-cutting domains apply to every product; the product-specific families follow. No control area is skipped.

Governance, risk and compliance (GRC)

Network and infrastructure security

Application and API security

Cryptography and key management

Authentication and transaction integrity

Fraud and risk management (FRM)

Data protection, privacy and localisation

Logging, monitoring and incident response

Business continuity and disaster recovery

Reconciliation and settlement integrity

IMPS product family

RuPay product family

AePS / Aadhaar authentication family

NACH product family

NFS / ATM switch family

FASTag / NETC family

CTS product family

Scoping

Scoping determines which control families, systems, data stores and third parties fall inside the audit boundary. Under-scoping is the single most common cause of certification rejection and post-go-live incidents; over-scoping inflates cost and timeline. Scope must be documented, agreed with NPCI/sponsor and re-validated each cycle.

• Product scope: identify every NPCI rail the entity transacts on (IMPS, RuPay, AePS, NACH, NFS, FASTag, CTS) and the specific spec/OC version in production for each.
• System scope: all systems that store, process or transmit product data — switches, hosts, HSMs, API gateways, databases, SIEM, and the CDE for card products.
• Data scope: PAN, PIN, biometric/Aadhaar, UMRN/mandate, cheque images, VRN, settlement files; map each to its data flow and residency.
• Network scope: NPCINet/leased-line segments, DMZ, CDE, DR site and management planes.
• Third-party scope: TSPs, aggregators, TPAPs, cloud providers and their sub-processors, with flow-down compliance obligations.
• Environment scope: production plus DR; segregation from dev/test; and any shared/multi-tenant infrastructure.
• Exclusions: explicitly document out-of-scope systems with justification and compensating controls.

Implementation approach

A phased approach de-risks certification. Each phase below lists the key activities and the concrete deliverables an auditor will expect to see.

Phase 1 – Discovery and gap assessment

• Activities: inventory in-scope products/systems, obtain current NPCU/UIDAI/RBI specs and OC versions, map data flows, run a gap assessment against every control family in the master checklist.
• Deliverables: scope document, data-flow diagrams, control-gap report with severity, remediation roadmap and effort estimate.

Phase 2 – Design and remediation

• Activities: design/fix segmentation, HSM key ceremonies, API message signing, tokenisation/ADV, FRM rules, logging and DR; update policies and runbooks.
• Deliverables: updated security architecture, hardened configs, key-ceremony records, policy set, remediation-closure tracker.

Phase 3 – Testing and validation

• Activities: application/infra VAPT, configuration compliance scans, segmentation testing (card products), functional/security test of NPCI API flows, DR drill.
• Deliverables: VAPT report with closure, scan reports, segmentation test results, DR drill report, retest evidence.

Phase 4 – Certification audit and NPCI sign-off

• Activities: CERT-In empanelled (and PCI QSA for RuPay) audit, evidence review, findings closure, preparation of certification report and compliance declaration.
• Deliverables: signed audit/certification report, compliance declaration, NPCI/sponsor submission and acceptance record.

Phase 5 – Continuous compliance and surveillance

• Activities: circular tracking, FRM tuning, periodic VAPT, quarterly recon health-checks, annual recertification and change-triggered re-audit.
• Deliverables: compliance calendar, circular-closure log, ongoing MIS, next-cycle audit plan.

Maturity and capability model

CyberSigma uses a five-level capability model to benchmark an entity's NPCI product security posture beyond a binary pass/fail, helping prioritise investment and demonstrate improvement across audit cycles.

Assessment and audit approach

1. Engagement scoping and kick-off: confirm products, spec/OC versions, systems, third parties and audit objectives; agree evidence request list and timeline.
2. Documentation review: policies, procedures, architecture, data-flow diagrams, key-ceremony records, prior audit/VAPT reports and circular-closure logs.
3. Control walkthroughs and interviews: with GRC, network, application, crypto/HSM, FRM, SOC and settlement teams to understand design and operation.
4. Technical testing: VAPT, configuration/hardening review, segmentation testing (card products), API security testing and log/SIEM validation.
5. Product-specific validation: exercise IMPS/RuPay/AePS/NACH/NFS/FASTag/CTS flows against the applicable spec, including cryptographic and message-integrity checks.
6. Sampling and evidence corroboration: sample transactions, disputes, recon breaks, access reviews and change tickets to confirm operating effectiveness.
7. Findings analysis and rating: classify gaps by severity against NPCI/RBI mandates and business risk; identify root cause.
8. Remediation and retest: track closure of high/critical findings and retest to confirm effectiveness before sign-off.
9. Reporting and certification: issue the certification/audit report, compliance declaration and management summary.
10. NPCI/sponsor submission and continuous surveillance planning: submit for acceptance and define the ongoing compliance cycle.

Evidence request list

• Governance: security policy, board minutes, CISO/FRM committee charter, risk register, circular tracker, outsourcing contracts.
• Architecture & network: network/data-flow diagrams, NPCINet circuit details, firewall/segmentation configs, hardening standards.
• Application & API: SDLC policy, threat models, SAST/DAST/VAPT reports, API design and message-signing configuration.
• Cryptography: HSM inventory and certificates, key-ceremony records, custodian sign-offs, KCV logs, crypto standard.
• Authentication & FRM: auth flow docs, OTP/MPIN configs, FRM rule catalogue, alert and dispute MIS, fraud-reporting acknowledgements.
• Data protection: data-localisation attestation, tokenisation/ADV design, masking evidence, retention and disposal records, consent records.
• Logging & IR: SIEM architecture, log-source list, use-case catalogue, incident register, CERT-In/RBI reporting records.
• BCP/DR: BCP/DR plan, BIA, DR drill and failover reports, backup/restore test records, capacity/load-test reports.
• Reconciliation & settlement: daily recon reports, DMS/UDIR records, file-integrity/checksum logs, unreconciled-item ageing.
• Product-specific: IMPS/RuPay/AePS/NACH/NFS/FASTag/CTS spec-version mapping, PCI ROC/AOC (RuPay), UIDAI licences (AePS), CTS-2010 test evidence.
• People & access: org chart, access-review reports, SoD matrix, PAM logs, training/awareness records.
• Change management: change register, spec-migration records, prior certification and acceptance letters.

Roles and responsibilities

KPIs to track

• Certification status and days-to-expiry per NPCI product.
• Open high/critical audit and VAPT findings, and mean time to remediate.
• Percentage of RBI/NPCI/UIDAI circulars closed within due date.
• Fraud rate (bps) and fraud value per product, versus NPCI ecosystem benchmarks.
• Dispute/chargeback volume and resolution within regulated TAT.
• Reconciliation break count and unreconciled-item ageing.
• Incident count, mean time to detect/respond, and CERT-In/RBI reporting within 6 hours.
• DR drill success rate and achieved RTO/RPO versus target.
• Patch SLA adherence and configuration-compliance score.
• HSM key-ceremony and certificate-expiry compliance (zero overdue).
• Transaction success/decline rate and technical-decline (TD) percentage per product.

Readiness checklist

• Current NPCI spec/OC versions and applicable RBI/UIDAI circulars identified and mapped.
• Scope document, data-flow diagrams and third-party inventory finalised and agreed.
• Board-approved security policy and FRM governance in place and current.
• Segmentation, NPCINet connectivity and infrastructure hardening validated.
• HSM key ceremonies documented; no clear-text PIN/PAN/biometric anywhere.
• API integrations spec-compliant with message signing and anti-replay controls.
• Tokenisation / Aadhaar Data Vault / PCI DSS controls implemented as applicable.
• FRM rules live with transaction monitoring, limits and negative lists.
• SIEM, SOC and 6-hour incident-reporting SOP operational.
• BCP/DR tested with successful switch failover and recon continuity.
• Daily reconciliation, DMS/UDIR dispute handling and TAT MIS in place.
• VAPT complete with high/critical findings closed and retested.
• Data localisation attested and privacy/DPDP controls evidenced.
• Evidence pack assembled and prior certification/acceptance letters available.

Common gaps

• Running an outdated NPCI API/spec (OC) version and missing a mandated migration deadline.
• Weak segmentation — the NPCI switch/CDE reachable from corporate or internet zones.
• Clear-text or improperly encrypted PIN/PAN/biometric in logs, DB or transit.
• HSM key ceremonies undocumented or lacking dual control / split knowledge.
• FRM rules static and untuned, leading to high false negatives and mule-account fraud.
• Reconciliation breaks left ageing beyond TAT with weak dispute (DMS/UDIR) handling.
• Payment-data localisation gaps via cloud sub-processors or offshore analytics.
• Aadhaar Data Vault missing or biometrics improperly stored (AePS non-compliance).
• RuPay entity relying on an expired or scope-narrowed PCI DSS certification.
• Incident reporting to CERT-In/RBI beyond the 6-hour window; no forensic readiness.
• Third-party TSP/TPAP compliance not flowed down or evidenced by the sponsor.
• DR untested for switch failover and settlement continuity; unrealistic RTO/RPO.

NPCI Product Audits mapped to other frameworks

How CyberSigma helps

Frequently asked questions

Need help with NPCI Product Audits?

CERT-In empanelled, PCI QSA senior auditors can take you from reading about it to compliant — with a scoped, guided programme.