Singapore primary region: payment data localisation, sub-outsourcing and a four-hour detection lag
Meridian Bank's mobile banking app runs on public cloud infrastructure. Transaction and customer data for the app are written to a primary region in Singapore; a Mumbai region is used only for disaster recovery with asynchronous replication that lags 40 minutes. The cloud managed-service provider subcontracted monitoring to a third-party firm whose engineers access production logs from Manila. Meridian's last vendor audit was 26 months ago, and there is no exit plan - the bank estimates nine months to migrate. On 2 April an exposed API key was used to query 1.2 million customer records; the bank detected the issue after four hours following a customer complaint. The incident was not reported to RBI. The CTO says the data is encrypted, so localisation does not apply, and that the matter can wait for the annual report.
1. Which outsourcing and cyber-incident obligations has the bank breached, and how should remediation be sequenced?
Read the worked answer
Outsourcing breaches (under RBI's IT outsourcing direction): no due diligence or documented risk assessment before the arrangement; sub-outsourcing to the Manila firm without approval or flow-down obligations; no audit for 26 months despite the materiality of the activity; no exit strategy or credible transition plan; concentration risk unassessed; and no contractual right to inspect the sub-contractor's access.
Incident-response breaches: a four-hour detection lag against a system of record holding customer data; no reporting to RBI under the cyber security framework, which expects incidents to be notified within a short window (typically 2–6 hours of detection) and to CERT-In within 6 hours; no root-cause analysis; and a proposal to disclose only in the annual report, which is not incident reporting.
Sequencing:
- Immediate (0–24 hours): revoke and rotate the exposed key and all dependent secrets; contain the query path; preserve logs; notify RBI and CERT-In; begin forensic scoping of the 1.2 million records and whether exfiltration occurred; assess customer notification duties.
- 72 hours: containment report, preliminary root cause, board risk committee briefing, and a communication plan.
- 30 days: full forensic report; contract amendments for audit rights, sub-outsourcing consent and data handling; inventory of all cross-border data flows; on-site review of the Manila operation.
- 90 days: India-primary architecture with a migration plan submitted to the Board and to RBI; tested DR with a defined RPO/RTO; exit plan and tested transition.
- Ongoing: restore the annual audit cycle, key-management hygiene and API inventory scanning.
2. The CTO proposes to keep the Singapore primary and add tokenisation and field-level encryption as a substitute for moving data to India. Assess this proposal.
Read the worked answer
It does not work. Tokenisation - replacing card or account identifiers with surrogates - is a data-minimisation control, and field-level encryption is a confidentiality control. Neither changes where the underlying record resides. The localisation requirement is a residency rule; it is satisfied by storage in India, not by storing an unreadable copy abroad.
There is also a practical trap: token vaults, keys and mapping tables themselves become in-scope payment data. If the token vault or the key management service sits in Singapore, the residency problem has simply been moved, not solved. Key custody abroad also concentrates operational risk: a key compromise or a jurisdictional freeze affects every record at once.
What a legitimate architecture looks like:
- India as the system of record for all in-scope data, with keys in Indian HSMs under the bank's control.
- Singapore compute, if retained at all, treated as transient processing only, with verified deletion and no local persistence, and repatriation within 24 hours.
- Tokenisation applied on top, as defence in depth for downstream systems and for card-on-file flows, not as the compliance answer.
The CTO should also note that a supervisor assessing this will look for evidence of the data-flow inventory, an assertion from the cloud provider on region configuration, and audit testing - none of which exist today. Presenting encryption as a substitute risks being read as an unwillingness to comply, which is a worse supervisory position than a documented remediation plan.