IIBF Digital Banking cheat sheet

RTGS settles high-value, time-critical interbank payments individually in real time; NEFT settles in half-hourly batches with deferred net settlement, so NEFT timing depends on batch windows while RTGS timing is immediate.

UPI is a real-time, 24x7 overlay on IMPS built by NPCI; a UPI ID (VPA) maps to an account or wallet, and each transaction is authenticated by a UPI PIN or biometric, not by card credentials.

IMPS handles interbank transfers up to INR 5 lakh per transaction, 24x7 including holidays; UPI has a separate per-transaction limit set by NPCI (commonly INR 1 lakh, higher for specified categories such as certain capital-market and insurance payments).

AEPS authenticates customers by Aadhaar number plus biometric at a banking correspondent or micro-ATM; it therefore needs no card and no smartphone, and is capped by RBI/NPCI limits per transaction and per day.

The RBI's Basic Payment Account and small-account rules govern KYC-lite onboarding: a customer may open a small account with simplified KYC subject to balance and turnover caps and a timeline for full KYC compliance.

Two-factor authentication for card-not-present transactions combines something the customer knows (PIN/password/OTP) with something the customer has (card or registered device); OTP is delivered to the registered mobile number, and re-authentication is required for repeat transactions under RBI's e-mandate rules.

A banking correspondent (BC) model lets banks deliver basic banking at low cost through agents; the BC can accept deposits, facilitate withdrawals and remittances, and perform account opening and KYC collection, but cannot grant loans or approve credit.

Digital KYC uses Aadhaar-based e-KYC, video-based customer identification, or DigiLocker documents; the bank must retain audit trails and re-verify periodically, and face-to-face verification is generally required for high-risk categories.

Aadhaar-based e-KYC returns demographic data and a photograph after OTP or biometric authentication; the consent artefact must be captured and stored, and the Aadhaar number must be masked in printed and digital records unless the customer requests otherwise.

The RBI's Digital Lending Guidelines (2021) apply to all lending through digital channels: loans must be credited directly to the borrower's bank account and repaid directly to the lender, with no pass-through pool account of a lending service provider.

Under the digital lending rules, a Key Fact Statement (KFS) must be given before loan execution, disclosing the annual percentage rate, all fees, recovery agent details, and grievance redressal officer; the APR must include all charges, not just interest.

Lending service providers (LSPs) and digital lending apps must have a contractual relationship with a regulated entity, be disclosed on the regulated entity's website, and cannot charge borrowers directly without disclosure; the regulated entity remains accountable for conduct.

A payment aggregator (PA) facilitates e-commerce payments and holds funds only in a nodal/escrow account with a scheduled commercial bank; a payment gateway (PG) is only the technical interface, and a merchant must be onboarded by an authorised PA to accept online payments.

Tokenisation replaces a card number with a surrogate token mapped to the card, device and merchant; PCI-DSS scope shrinks because the merchant never stores the primary account number, and the token cannot be used on another device or merchant.

A chargeback is a cardholder-initiated reversal processed through the network's dispute rules; the merchant must respond within the network's deadline with evidence such as proof of delivery and authorisation logs, or the transaction is reversed.

QR codes in India follow UPI or Bharat QR standards; a static QR is reusable and carries no amount, while a dynamic QR is generated per transaction with amount and reference, reducing misdirected-payment and tampering risk.

Open banking in India is delivered through the Account Aggregator (AA) framework: an AA is an NBFC regulated by RBI that, with explicit customer consent, fetches financial data from FIPs and shares it with FIUs; consent is purpose-bound and time-limited.

A semi-closed prepaid instrument (wallet) can be used only at a defined group of merchants and cannot be redeemed for cash; a closed-system instrument is redeemable only for goods or services of the issuer and needs no RBI authorisation.

RBI's cyber security framework for banks requires a board-approved cyber security policy, a separate cyber security function headed by a CISO, and a Security Operations Centre; incidents must be reported to RBI within the prescribed window (currently 2-6 hours for major incidents).

The CERT-In directions (2022) require reporting of specified cyber incidents within 6 hours of noticing, and maintenance of ICT and log records for 180 days within India; VPN and cloud service providers must keep subscriber records for 5 years.

A business continuity plan must define the recovery time objective (RTO) and recovery point objective (RPO); RTO is the maximum tolerable downtime, RPO is the maximum tolerable data loss measured in time.

A penetration test differs from a vulnerability assessment: a vulnerability assessment enumerates and ranks weaknesses, while a penetration test exploits them in a controlled way to prove business impact; both are distinct from a red-team exercise, which tests people, process and detection.

Phishing, vishing and smishing are social-engineering attacks delivered by email, voice call and SMS respectively; anti-phishing controls include DMARC/SPF/DKIM on the bank's domain, customer awareness, and device binding for transaction authorisation.

SIM swap fraud defeats SMS OTP: the attacker ports the victim's number to a new SIM; mitigations include device binding, in-app authorisation, and a cooling period after SIM change before high-value transactions are allowed.

Under RBI's limited liability framework, a customer who reports an unauthorised electronic transaction within 3 working days bears zero liability; liability increases with delay, and the customer's liability is capped under the prescribed tiered schedule.

A digital signature uses asymmetric cryptography: the signer encrypts the hash with the private key, and the verifier decrypts it with the public key and compares hashes; a digital certificate binds the public key to an identity and is issued by a Certifying Authority under the IT Act.

The Reserve Bank's storage-of-payment-data directive requires that the full end-to-end transaction data of payment systems be stored only in India; foreign processing is allowed but the data must be brought back to India within 24 hours and deleted abroad.

NEFT has no per-transaction ceiling for most retail transactions (banks may set internal caps), while RTGS has a minimum of INR 2 lakh and no maximum; RTGS is a gross, real-time system and NEFT is a net, batched system.

IMPS is operated by NPCI and works 24x7; it is accessible through mobile banking, internet banking, ATM and UPI, and its per-transaction cap is INR 5 lakh for most channels.

UPI's transaction flow is: payer app sends a pay request to the payer PSP, which routes it via NPCI to the payee PSP; the payer authenticates with the UPI PIN, and NPCI debits and credits the banks in a deferred net settlement cycle.

A UPI mandate (Autopay) is a pre-authorised recurring debit with a maximum amount per debit; the customer can modify or revoke it, and the payer must be notified in advance of each debit under NPCI rules.

NACH is NPCI's bulk clearing system for high-volume, low-value credits and debits, used for salaries, subsidies and loan EMIs; it replaced ECS and operates on presentation and return cycles.

A card's EMV chip generates a cryptogram per transaction using the card's secret key; the issuer verifies the cryptogram, which is why skimming a magnetic stripe alone cannot easily produce a valid chip transaction.

The card network's 3-D Secure protocol adds an issuer authentication step for card-not-present payments; version 2 supports risk-based authentication and app-based approval, reducing friction compared with OTP-only flows.

Bharat BillPay (BBPS) is NPCI's interoperable bill-payment platform; a biller is registered on the platform, and a customer can pay through any BBPS-enabled channel, with the complaint handled by the biller's nodal officer.

The National Financial Switch (NFS) connects ATMs and white-label ATMs across banks; an interbank ATM transaction is switched by NPCI, and the issuer and acquirer settle through the RBI settlement system.

KYC is a risk-based process: customer due diligence must be proportionate to assessed risk, and enhanced due diligence applies to high-risk customers such as politically exposed persons and non-face-to-face customers.

The Customer Acceptance Policy, Customer Identification Procedure and monitoring form the three pillars of a bank's AML/KYC programme; a Money Laundering Reporting Officer (MLRO) and a designated director oversee implementation.

Suspicious Transaction Reports (STRs) go to FIU-IND; the bank must not tip off the customer, and STRs are filed within 7 days of establishing suspicion, with continuing transactions reported as and when they occur.

Cash Transaction Reports (CTRs) are filed with FIU-IND for cash transactions above INR 10 lakh in a month for a customer, and for a series of transactions integrally connected and below the threshold if they appear designed to evade reporting.

A wire transfer under the FATF framework must carry originator and beneficiary information (name, account, address or national ID); missing information triggers enhanced scrutiny and possible rejection by the beneficiary institution.

Periodic KYC updation is risk-based: high-risk customers are re-verified more frequently (commonly every 2 years) than low-risk customers (commonly every 10 years); simplified measures are allowed for low-risk customers but never exemption from identification.

The Prevention of Money Laundering Act (PMLA) and the Unlawful Activities (Prevention) Act (UAPA) underpin India's AML/CFT regime; banks must screen against UNSC and MHA sanctions lists and freeze accounts of designated persons.

Video-based customer identification (V-CIP) is permitted for onboarding: it requires a live video call, PAN or equivalent, geo-tagging, and recording of the interaction, and must be done by a trained official of the regulated entity.

A beneficial owner under the PMLA rules is a natural person who ultimately owns or controls the customer; the threshold is 10% or more of shares or capital for companies, and 15% or more for partnerships and unincorporated associations.