VAPT for banks and NBFCs

The Reserve Bank of India (Information Technology Governance, Risk, Controls and Assurance Practices) Directions, 2023 (RBI/2023-24/107), effective 1 April 2024, was a Master Direction that consolidated earlier RBI IT-governance and cyber-risk instructions and required a board-level IT governance framework, an IT and information-security risk management framework and periodic information systems audits. IMPORTANT - NO LONGER IN FORCE: this Master Direction was repealed on 31 July 2026 and replaced, together with the 2016 Cyber Security Framework and other circulars, by the entity-specific RBI (Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026. Regulated entities must now comply with the applicable 2026 Directions (see 'rbi-cyber-tech-risk-framework-2026').

The RBI (Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026 are the current, in-force cyber and technology-risk directions for RBI-regulated entities. Issued on 31 July 2026 (Commercial Banks version: RBI/DoS/2026-27/410, DoS.CO.CSITEG.4/31.01.015/2026-27) and effective immediately with no transition window, they repealed and consolidated the 2016 Cyber Security Framework in Banks, the November 2023 IT Governance, Risk, Controls and Assurance Practices Master Direction and around 626 other circulars into a single framework. RBI issued separate, entity-specific Directions under this common title for commercial banks, small finance banks, payments banks, urban co-operative banks, all-India financial institutions, NBFCs and credit information companies. Core requirements include board oversight and an IT Strategy Committee, an independent CISO (GM rank), baseline cybersecurity controls, a 24x7 Cyber Security Operations Centre (C-SOC) with SIEM, risk-based information systems audit, VA at least every six months and penetration testing at least annually for critical and internet-facing systems, and reporting of cyber incidents to the RBI on the DAKSH platform within six hours of detection.

The RBI circular Cyber Security Framework in Banks (RBI/2015-16/418, DBS.CO/CSITE/BC.11/33.01.001/2015-16), dated 2 June 2016, required scheduled commercial banks to put in place a board-approved cyber-security policy distinct from their IT or IS-security policy, a baseline cyber-security and resilience framework, continuous surveillance (for example through a Security Operations Centre), a Cyber Crisis Management Plan and incident reporting to the RBI. IMPORTANT - NO LONGER IN FORCE: this circular was repealed on 31 July 2026 and replaced, together with the November 2023 IT Governance Master Direction and other circulars, by the entity-specific RBI (Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026 (see 'rbi-cyber-tech-risk-framework-2026').

The RBI Master Direction on Digital Payment Security Controls (RBI/2020-21/74, DoS.CO.CSITE.SEC.No.1852/31.01.015/2020-21), dated 18 February 2021, sets out a robust governance structure and common minimum standards of security controls for digital payment products and services. It covers areas such as internet banking, mobile banking and card payments, along with customer protection and grievance redressal. It applies to Scheduled Commercial Banks (excluding Regional Rural Banks), Small Finance Banks, Payments Banks and credit-card-issuing NBFCs, and took effect within six months of being placed on the RBI website.

The RBI circular on Storage of Payment System Data (RBI/2017-18/153, DPSS.CO.OD No.2785/06.08.005/2017-2018), dated 6 April 2018, requires all system providers to ensure that the entire data relating to the payment systems they operate is stored in a system only in India. This includes the full end-to-end transaction details and any information collected, carried or processed as part of the payment message or instruction. Providers were given six months to comply and to submit a System Audit Report conducted by a CERT-In empanelled auditor. It applies to all Payment System Providers authorised under the Payment and Settlement Systems Act, 2007.

The Reserve Bank of India (Regulation of Payment Aggregators) Directions, 2025 (RBI/DPSS/2025-26/141), issued 15 September 2025 and in force from 31 December 2025, consolidate the earlier 2020, 2021 and 2023 payment-aggregator guidelines into a single framework covering online and face-to-face (proximity) payment aggregators. A non-bank entity carrying on payment-aggregator business must obtain RBI authorisation, and must have a minimum net worth of INR 15 crore at the time of application, rising to a minimum net worth of INR 25 crore by the end of the third financial year after authorisation, maintained thereafter. The directions also cover governance, KYC of merchants, escrow-account operation, security and reporting.

RBI circular DPSS.CO.OD No.2785/06.08.005/2017-2018 (6 April 2018) requires payment system providers to store the entire data relating to their payment systems only in India, with compliance within six months (by October 2018). End-to-end transaction data is covered.

Circular number cited for retrieval via RBI's notification search; we deliberately avoid deep-linking RBI's session-bound URLs.

Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices (RBI/DoS/2023-24/107) issued 7 November 2023; effective 1 April 2024. NO LONGER IN FORCE: repealed on 31 July 2026 and replaced, with the 2016 Cyber Security Framework and other circulars, by the entity-specific RBI (Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026.

Direction number cited for retrieval via RBI notification search; RBI deep links are session-bound.

Master Direction on Outsourcing of Information Technology Services (RBI/2023-24/102) issued 10 April 2023; effective 1 October 2023. Governs material IT outsourcing by regulated entities, including vendor risk, audit rights and concentration risk.

Direction number cited for retrieval via RBI notification search.

Issued 18 February 2021: minimum security standards for digital payment channels — internet banking, mobile payments and card payments — binding scheduled commercial banks, small finance banks, payments banks and card-issuing NBFCs.

Direction cited by title and date for retrieval via RBI notification search.

RBI’s Cyber Security Framework in Banks (2 June 2016) requires scheduled commercial banks to report cyber incidents to RBI within 2 to 6 hours of detection, alongside board-approved cyber security policy, SOC capability and cyber crisis management plans.