Information Security and Digital Banking Risks
What the exam tests
This domain tests information-security controls and the regulatory guardrails around digital channels, cards, lending and data sharing.
Core rules
- Information security rests on confidentiality, integrity and availability, supported by data classification, encryption, access control, segregation of duties, logging, DLP and business continuity.
- The Digital Personal Data Protection Act, 2023 introduces Data Fiduciary, Data Principal, Consent Manager and the Data Protection Board, with penalties running to ₹250 crore for failure to safeguard data. The older SPDI Rules, 2011 under Section 43A of the IT Act still matter for sensitive personal data.
- RBI's Digital Lending Guidelines (2022) require direct disbursal and repayment through the borrower's and lender's bank accounts, no handling of funds by LSPs, a Key Fact Statement, cooling-off period, consent-based data use and lender accountability for LSP conduct.
- Card-on-file tokenisation, additional factor of authentication (AFA), Account Aggregator consent architecture and cloud/third-party risk controls are core digital banking safeguards.
Worked example
A merchant stores full card numbers in its app database. Since 1 October 2022, only card issuers and card networks may store actual card data; the merchant must use tokenisation. The bank should require purging of stored PANs, verify tokenised processing, and review the merchant's data-flow. The issue is both RBI card-storage non-compliance and a data-protection exposure.
Traps
AFA is not optional for card-not-present transactions. LSPs cannot hold loan funds. Account Aggregators cannot retain data indefinitely. Do not merge DPDP Act and SPDI Rules into one regime.