IIBF Emerging Technologies cheat sheet

Digital transformation in an FI means re-engineering customer journeys onto digital channels supported by API-based integration, cloud hosting, data analytics and straight-through processing, not merely launching a mobile app.

Core building blocks: core banking API layer, digital onboarding with e-KYC/video-KYC, unified payment interfaces (UPI, IMPS, NEFT, RTGS, AePS), open banking APIs, and a data platform feeding analytics and risk models.

JAM trinity (Jan Dhan accounts, Aadhaar identity, Mobile connectivity) plus UPI is the public digital infrastructure layer Indian banks and NBFCs build on; UPI is operated by NPCI.

India Stack components relevant to FIs: Aadhaar e-KYC, DigiLocker for document verification, eSign for digital signatures, and UPI/BBPS for payments and bill payments.

Co-lending and digital partnership models let banks and NBFCs share risk; outsourcing and third-party arrangements remain governed by RBI outsourcing and IT outsourcing directions, with the regulated entity retaining full accountability.

Business correspondents and digital service providers extend reach, but the regulated entity stays responsible for KYC, grievance redressal and data handling performed by the agent.

A digital transformation business case is judged on cost-to-serve, turnaround time, straight-through-processing rate, digital channel share and customer acquisition cost, not on number of features shipped.

Regulatory sandboxes (e.g., RBI's Enabling Framework for Regulatory Sandbox) allow controlled testing of innovative products with relaxed compliance for a defined period and cohort size.

Supervised learning maps labelled inputs to outputs (credit default prediction); unsupervised learning finds structure without labels (customer segmentation, anomaly detection); reinforcement learning optimises sequential decisions.

Classification predicts a discrete label (default / no default); regression predicts a continuous value (loss given default, exposure). Model choice follows the target variable type.

Key credit-risk metrics: KS statistic, AUC-ROC, Gini = 2*AUC - 1, and population stability index (PSI) for detecting score distribution drift; PSI above roughly 0.25 conventionally signals significant shift.

Discriminatory power metrics (AUC, KS, Gini) measure ranking ability; calibration metrics (Brier score, observed-to-expected ratio) measure whether predicted probabilities match observed default rates. Both must be validated.

Overfitting: model performs well in-sample but poorly out-of-sample. Controls are train/validation/test splits, cross-validation, regularisation (L1/L2), and out-of-time validation on later vintages.

Explainability tools: SHAP values attribute a prediction to features; LIME gives local approximations; feature importance and partial dependence plots summarise global behaviour. RBI expects explainable, auditable models.

Model risk management lifecycle: inventory, tiering by materiality, development documentation, independent validation, approval, monitoring (PSI, KS, calibration), periodic revalidation and decommissioning.

Fairness testing compares outcomes across protected groups using metrics such as disparate impact ratio; proxy variables (pincode, device type) can encode discrimination even when protected attributes are excluded.

Generative AI and LLM use cases in banking (chatbots, document summarisation, code assistance) require human oversight, prompt/data leakage controls, hallucination testing and vendor due diligence.

CIA triad: confidentiality (only authorised access), integrity (accuracy and completeness), availability (timely access). Security controls are justified by which leg they protect.

Defence in depth layers identity and access management, network segmentation, endpoint protection, encryption, logging/SIEM monitoring, and incident response so no single failure compromises the estate.

Phishing, vishing and smishing are social-engineering attacks; technical controls include DMARC/SPF/DKIM for email, MFA, and user reporting buttons, while awareness training addresses the human vector.

Ransomware defence: offline/immutable backups, tested restore procedures, least privilege, patching, network segmentation and endpoint detection and response; paying ransom is discouraged and reportable to CERT-In.

CERT-In directions require reporting of specified cyber incidents within 6 hours of noticing, and maintenance of logs for 180 days within India; breach reporting to RBI and CERT-In runs in parallel.

OWASP Top 10 categories relevant to banking apps include broken access control, injection, insecure design, security misconfiguration and vulnerable components; secure SDLC and periodic VAPT address these.

VAPT (vulnerability assessment and penetration testing) should cover internet-facing, mobile, API and internal systems; findings are risk-ranked and tracked to closure with retesting.

Zero trust replaces perimeter trust with continuous verification: authenticate and authorise every request, apply least privilege, micro-segment networks, and assume breach.

Third-party and supply-chain risk: assess vendors before onboarding, include security and audit clauses, monitor for breaches, and treat critical service providers as part of the FI's own control environment.

IT risk management cycle: identify assets and threats, assess likelihood and impact, treat (mitigate, transfer, avoid, accept), monitor, and report to the board or IT strategy committee.

RBI's IT governance guidance expects board-level oversight, a documented IT strategy, a cyber security policy approved by the board, and an IT/business continuity plan tested periodically.

Business impact analysis identifies critical systems and recovery objectives: RTO (maximum tolerable downtime) and RPO (maximum tolerable data loss). BCP/DR drills validate that these are achievable.

The three lines model: business owns risk (first line), risk and compliance functions oversee (second line), internal audit provides independent assurance (third line).

Change management controls: segregation of development, test and production environments; documented approvals; user acceptance testing; rollback plans; and post-implementation review.

Key risk indicators for IT: patch latency, privileged account count, phishing failure rate, incident mean time to detect and to recover, backup restore success rate, unresolved critical vulnerabilities.

Outsourcing and cloud arrangements remain the regulated entity's risk; RBI expects due diligence, exit plans, data localisation assessment, audit rights and board reporting for material arrangements.

Incident management stages: preparation, detection, containment, eradication, recovery, and lessons learned; post-incident review feeds control improvements and regulatory reporting.

RBI's Digital Lending Guidelines require all loan disbursals and repayments to flow directly between the borrower's bank account and the regulated entity, with no pass-through pool account of the LSP.

Lending Service Providers (LSPs) are agents of the regulated entity; the RE remains responsible for the product, pricing, KYC, grievance redressal and compliance, and must conduct due diligence on the LSP.

All fees payable to the LSP must be paid directly by the regulated entity, not by the borrower, and must be disclosed in the Key Fact Statement.

A Key Fact Statement (KFS) must be given in a standard format before loan execution, disclosing APR, all-inclusive interest, fees, penalties, cooling-off period and grievance officer details.

Borrowers have a cooling-off or look-up period during which they can exit the loan by repaying principal plus proportionate APR-linked charges, without penalty.

Digital lending apps must have a direct link to the regulated entity's website; the RE's name must appear in the app; unregulated or unregistered apps cannot be used for lending.

Data collection must be need-based with explicit borrower consent; access to contacts, media, files and phone resources is prohibited, and one-time access permissions are required instead.

Loan disbursement and servicing must be done by the regulated entity or its authorised service provider; recovery agents must follow the RBI Fair Practices Code and contact only between 8 am and 7 pm.

Under the Digital Lending Guidelines, the regulated entity must maintain a list of LSPs and DLAs on its website, and report to credit bureaus and to RBI as required.

The Digital Personal Data Protection Act, 2023 applies to digital personal data processed in India and to processing outside India related to offering goods or services to Data Principals in India.

Core actors: Data Principal (the individual), Data Fiduciary (determines purpose and means), Data Processor (processes on behalf of the fiduciary), and Consent Manager (registered intermediary managing consent.

Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and limited to the specified purpose.

Consent notices must be in clear language, available in English and the languages listed in the Eighth Schedule, and state the purpose, data collected, and how to withdraw consent and complain.

Data Principals have rights to access information, correction and erasure, grievance redressal, and nomination; the right to erasure is subject to legal retention obligations.

Data Fiduciaries must implement security safeguards, notify the Data Protection Board and affected Data Principals of a personal data breach, and erase data when purpose is served unless retention is legally required.

Significant Data Fiduciaries carry extra duties: appoint a Data Protection Officer based in India, an independent auditor, conduct DPIAs, and observe algorithmic due diligence.

Penalties under the DPDP Act can reach up to INR 250 crore for failure to take security safeguards; the Data Protection Board of India adjudicates breaches and can impose penalties.

Cross-border transfer is permitted except to countries restricted by the Central Government; the Act does not mandate localisation of all personal data.

RBI's data localisation direction requires payment system data to be stored only in India, with processing permitted abroad if brought back within the specified time and no foreign mirror copy retained.

Consent Managers must be registered with the Data Protection Board and maintain records of consent, acting as a single point for giving, managing, reviewing and withdrawing consent.

Digital transformation in an FI means re-engineering customer journeys onto digital channels supported by API-based integration, cloud hosting, data analytics and straight-through processing, not merely launching a mobile app.

Core building blocks: core banking API layer, digital onboarding with e-KYC/video-KYC, unified payment interfaces (UPI, IMPS, NEFT, RTGS, AePS), open banking APIs, and a data platform feeding analytics and risk models.

JAM trinity (Jan Dhan accounts, Aadhaar identity, Mobile connectivity) plus UPI is the public digital infrastructure layer Indian banks and NBFCs build on; UPI is operated by NPCI.

India Stack components relevant to FIs: Aadhaar e-KYC, DigiLocker for document verification, eSign for digital signatures, and UPI/BBPS for payments and bill payments.

Co-lending and digital partnership models let banks and NBFCs share risk; outsourcing and third-party arrangements remain governed by RBI outsourcing and IT outsourcing directions, with the regulated entity retaining full accountability.

Business correspondents and digital service providers extend reach, but the regulated entity stays responsible for KYC, grievance redressal and data handling performed by the agent.

A digital transformation business case is judged on cost-to-serve, turnaround time, straight-through-processing rate, digital channel share and customer acquisition cost, not on number of features shipped.

Regulatory sandboxes (e.g., RBI's Enabling Framework for Regulatory Sandbox) allow controlled testing of innovative products with relaxed compliance for a defined period and cohort size.

Supervised learning maps labelled inputs to outputs (credit default prediction); unsupervised learning finds structure without labels (customer segmentation, anomaly detection); reinforcement learning optimises sequential decisions.

Classification predicts a discrete label (default / no default); regression predicts a continuous value (loss given default, exposure). Model choice follows the target variable type.

Key credit-risk metrics: KS statistic, AUC-ROC, Gini = 2*AUC - 1, and population stability index (PSI) for detecting score distribution drift; PSI above roughly 0.25 conventionally signals significant shift.

Discriminatory power metrics (AUC, KS, Gini) measure ranking ability; calibration metrics (Brier score, observed-to-expected ratio) measure whether predicted probabilities match observed default rates. Both must be validated.

Overfitting: model performs well in-sample but poorly out-of-sample. Controls are train/validation/test splits, cross-validation, regularisation (L1/L2), and out-of-time validation on later vintages.

Explainability tools: SHAP values attribute a prediction to features; LIME gives local approximations; feature importance and partial dependence plots summarise global behaviour. RBI expects explainable, auditable models.

Model risk management lifecycle: inventory, tiering by materiality, development documentation, independent validation, approval, monitoring (PSI, KS, calibration), periodic revalidation and decommissioning.

Fairness testing compares outcomes across protected groups using metrics such as disparate impact ratio; proxy variables (pincode, device type) can encode discrimination even when protected attributes are excluded.

Generative AI and LLM use cases in banking (chatbots, document summarisation, code assistance) require human oversight, prompt/data leakage controls, hallucination testing and vendor due diligence.

CIA triad: confidentiality (only authorised access), integrity (accuracy and completeness), availability (timely access). Security controls are justified by which leg they protect.

Defence in depth layers identity and access management, network segmentation, endpoint protection, encryption, logging/SIEM monitoring, and incident response so no single failure compromises the estate.

Phishing, vishing and smishing are social-engineering attacks; technical controls include DMARC/SPF/DKIM for email, MFA, and user reporting buttons, while awareness training addresses the human vector.

Ransomware defence: offline/immutable backups, tested restore procedures, least privilege, patching, network segmentation and endpoint detection and response; paying ransom is discouraged and reportable to CERT-In.

CERT-In directions require reporting of specified cyber incidents within 6 hours of noticing, and maintenance of logs for 180 days within India; breach reporting to RBI and CERT-In runs in parallel.

OWASP Top 10 categories relevant to banking apps include broken access control, injection, insecure design, security misconfiguration and vulnerable components; secure SDLC and periodic VAPT address these.

VAPT (vulnerability assessment and penetration testing) should cover internet-facing, mobile, API and internal systems; findings are risk-ranked and tracked to closure with retesting.

Zero trust replaces perimeter trust with continuous verification: authenticate and authorise every request, apply least privilege, micro-segment networks, and assume breach.

Third-party and supply-chain risk: assess vendors before onboarding, include security and audit clauses, monitor for breaches, and treat critical service providers as part of the FI's own control environment.

IT risk management cycle: identify assets and threats, assess likelihood and impact, treat (mitigate, transfer, avoid, accept), monitor, and report to the board or IT strategy committee.

RBI's IT governance guidance expects board-level oversight, a documented IT strategy, a cyber security policy approved by the board, and an IT/business continuity plan tested periodically.

Business impact analysis identifies critical systems and recovery objectives: RTO (maximum tolerable downtime) and RPO (maximum tolerable data loss). BCP/DR drills validate that these are achievable.

The three lines model: business owns risk (first line), risk and compliance functions oversee (second line), internal audit provides independent assurance (third line).

Change management controls: segregation of development, test and production environments; documented approvals; user acceptance testing; rollback plans; and post-implementation review.

Key risk indicators for IT: patch latency, privileged account count, phishing failure rate, incident mean time to detect and to recover, backup restore success rate, unresolved critical vulnerabilities.

Outsourcing and cloud arrangements remain the regulated entity's risk; RBI expects due diligence, exit plans, data localisation assessment, audit rights and board reporting for material arrangements.

Incident management stages: preparation, detection, containment, eradication, recovery, and lessons learned; post-incident review feeds control improvements and regulatory reporting.

RBI's Digital Lending Guidelines require all loan disbursals and repayments to flow directly between the borrower's bank account and the regulated entity, with no pass-through pool account of the LSP.

Lending Service Providers (LSPs) are agents of the regulated entity; the RE remains responsible for the product, pricing, KYC, grievance redressal and compliance, and must conduct due diligence on the LSP.

All fees payable to the LSP must be paid directly by the regulated entity, not by the borrower, and must be disclosed in the Key Fact Statement.

A Key Fact Statement (KFS) must be given in a standard format before loan execution, disclosing APR, all-inclusive interest, fees, penalties, cooling-off period and grievance officer details.

Borrowers have a cooling-off or look-up period during which they can exit the loan by repaying principal plus proportionate APR-linked charges, without penalty.

Digital lending apps must have a direct link to the regulated entity's website; the RE's name must appear in the app; unregulated or unregistered apps cannot be used for lending.

Data collection must be need-based with explicit borrower consent; access to contacts, media, files and phone resources is prohibited, and one-time access permissions are required instead.

Loan disbursement and servicing must be done by the regulated entity or its authorised service provider; recovery agents must follow the RBI Fair Practices Code and contact only between 8 am and 7 pm.

Under the Digital Lending Guidelines, the regulated entity must maintain a list of LSPs and DLAs on its website, and report to credit bureaus and to RBI as required.

The Digital Personal Data Protection Act, 2023 applies to digital personal data processed in India and to processing outside India related to offering goods or services to Data Principals in India.

Core actors: Data Principal (the individual), Data Fiduciary (determines purpose and means), Data Processor (processes on behalf of the fiduciary), and Consent Manager (registered intermediary managing consent).

Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and limited to the specified purpose.

Consent notices must be in clear language, available in English and the languages listed in the Eighth Schedule, and state the purpose, data collected, and how to withdraw consent and complain.

Data Principals have rights to access information, correction and erasure, grievance redressal, and nomination; the right to erasure is subject to legal retention obligations.

Data Fiduciaries must implement security safeguards, notify the Data Protection Board and affected Data Principals of a personal data breach, and erase data when purpose is served unless retention is legally required.

Significant Data Fiduciaries carry extra duties: appoint a Data Protection Officer based in India, an independent auditor, conduct DPIAs, and observe algorithmic due diligence.

Penalties under the DPDP Act can reach up to INR 250 crore for failure to take security safeguards; the Data Protection Board of India adjudicates breaches and can impose penalties.

Cross-border transfer is permitted except to countries restricted by the Central Government; the Act does not mandate localisation of all personal data.

RBI's data localisation direction requires payment system data to be stored only in India, with processing permitted abroad if brought back within the specified time and no foreign mirror copy retained.

Consent Managers must be registered with the Data Protection Board and maintain records of consent, acting as a single point for giving, managing, reviewing and withdrawing consent.

Digital transformation in an FI means re-engineering customer journeys onto digital channels supported by API-based integration, cloud hosting, data analytics and straight-through processing, not merely launching a mobile app.

Core building blocks: core banking API layer, digital onboarding with e-KYC/video-KYC, unified payment interfaces (UPI, IMPS, NEFT, RTGS, AePS), open banking APIs, and a data platform feeding analytics and risk models.

JAM trinity (Jan Dhan accounts, Aadhaar identity, Mobile connectivity) plus UPI is the public digital infrastructure layer Indian banks and NBFCs build on; UPI is operated by NPCI.

India Stack components relevant to FIs: Aadhaar e-KYC, DigiLocker for document verification, eSign for digital signatures, and UPI/BBPS for payments and bill payments.

Co-lending and digital partnership models let banks and NBFCs share risk; outsourcing and third-party arrangements remain governed by RBI outsourcing and IT outsourcing directions, with the regulated entity retaining full accountability.

Business correspondents and digital service providers extend reach, but the regulated entity stays responsible for KYC, grievance redressal and data handling performed by the agent.

A digital transformation business case is judged on cost-to-serve, turnaround time, straight-through-processing rate, digital channel share and customer acquisition cost, not on number of features shipped.

Regulatory sandboxes (e.g., RBI's Enabling Framework for Regulatory Sandbox) allow controlled testing of innovative products with relaxed compliance for a defined period and cohort size.

Supervised learning maps labelled inputs to outputs (credit default prediction); unsupervised learning finds structure without labels (customer segmentation, anomaly detection); reinforcement learning optimises sequential decisions.

Classification predicts a discrete label (default / no default); regression predicts a continuous value (loss given default, exposure). Model choice follows the target variable type.

Key credit-risk metrics: KS statistic, AUC-ROC, Gini = 2*AUC - 1, and population stability index (PSI) for detecting score distribution drift; PSI above roughly 0.25 conventionally signals significant shift.

Discriminatory power metrics (AUC, KS, Gini) measure ranking ability; calibration metrics (Brier score, observed-to-expected ratio) measure whether predicted probabilities match observed default rates. Both must be validated.

Overfitting: model performs well in-sample but poorly out-of-sample. Controls are train/validation/test splits, cross-validation, regularisation (L1/L2), and out-of-time validation on later vintages.

Explainability tools: SHAP values attribute a prediction to features; LIME gives local approximations; feature importance and partial dependence plots summarise global behaviour. RBI expects explainable, auditable models.

Model risk management lifecycle: inventory, tiering by materiality, development documentation, independent validation, approval, monitoring (PSI, KS, calibration), periodic revalidation and decommissioning.

Fairness testing compares outcomes across protected groups using metrics such as disparate impact ratio; proxy variables (pincode, device type) can encode discrimination even when protected attributes are excluded.

Generative AI and LLM use cases in banking (chatbots, document summarisation, code assistance) require human oversight, prompt/data leakage controls, hallucination testing and vendor due diligence.

CIA triad: confidentiality (only authorised access), integrity (accuracy and completeness), availability (timely access). Security controls are justified by which leg they protect.

Defence in depth layers identity and access management, network segmentation, endpoint protection, encryption, logging/SIEM monitoring, and incident response so no single failure compromises the estate.

Phishing, vishing and smishing are social-engineering attacks; technical controls include DMARC/SPF/DKIM for email, MFA, and user reporting buttons, while awareness training addresses the human vector.

Ransomware defence: offline/immutable backups, tested restore procedures, least privilege, patching, network segmentation and endpoint detection and response; paying ransom is discouraged and reportable to CERT-In.

CERT-In directions require reporting of specified cyber incidents within 6 hours of noticing, and maintenance of logs for 180 days within India; breach reporting to RBI and CERT-In runs in parallel.

OWASP Top 10 categories relevant to banking apps include broken access control, injection, insecure design, security misconfiguration and vulnerable components; secure SDLC and periodic VAPT address these.

VAPT (vulnerability assessment and penetration testing) should cover internet-facing, mobile, API and internal systems; findings are risk-ranked and tracked to closure with retesting.

Zero trust replaces perimeter trust with continuous verification: authenticate and authorise every request, apply least privilege, micro-segment networks, and assume breach.

Third-party and supply-chain risk: assess vendors before onboarding, include security and audit clauses, monitor for breaches, and treat critical service providers as part of the FI's own control environment.

IT risk management cycle: identify assets and threats, assess likelihood and impact, treat (mitigate, transfer, avoid, accept), monitor, and report to the board or IT strategy committee.

RBI's IT governance guidance expects board-level oversight, a documented IT strategy, a cyber security policy approved by the board, and an IT/business continuity plan tested periodically.

Business impact analysis identifies critical systems and recovery objectives: RTO (maximum tolerable downtime) and RPO (maximum tolerable data loss). BCP/DR drills validate that these are achievable.

The three lines model: business owns risk (first line), risk and compliance functions oversee (second line), internal audit provides independent assurance (third line).

Change management controls: segregation of development, test and production environments; documented approvals; user acceptance testing; rollback plans; and post-implementation review.

Key risk indicators for IT: patch latency, privileged account count, phishing failure rate, incident mean time to detect and to recover, backup restore success rate, unresolved critical vulnerabilities.

Outsourcing and cloud arrangements remain the regulated entity's risk; RBI expects due diligence, exit plans, data localisation assessment, audit rights and board reporting for material arrangements.

Incident management stages: preparation, detection, containment, eradication, recovery, and lessons learned; post-incident review feeds control improvements and regulatory reporting.

RBI's Digital Lending Guidelines require all loan disbursals and repayments to flow directly between the borrower's bank account and the regulated entity, with no pass-through pool account of the LSP.

Lending Service Providers (LSPs) are agents of the regulated entity; the RE remains responsible for the product, pricing, KYC, grievance redressal and compliance, and must conduct due diligence on the LSP.

All fees payable to the LSP must be paid directly by the regulated entity, not by the borrower, and must be disclosed in the Key Fact Statement.

A Key Fact Statement (KFS) must be given in a standard format before loan execution, disclosing APR, all-inclusive interest, fees, penalties, cooling-off period and grievance officer details.

Borrowers have a cooling-off or look-up period during which they can exit the loan by repaying principal plus proportionate APR-linked charges, without penalty.

Digital lending apps must have a direct link to the regulated entity's website; the RE's name must appear in the app; unregulated or unregistered apps cannot be used for lending.

Data collection must be need-based with explicit borrower consent; access to contacts, media, files and phone resources is prohibited, and one-time access permissions are required instead.

Loan disbursement and servicing must be done by the regulated entity or its authorised service provider; recovery agents must follow the RBI Fair Practices Code and contact only between 8 am and 7 pm.

Under the Digital Lending Guidelines, the regulated entity must maintain a list of LSPs and DLAs on its website, and report to credit bureaus and to RBI as required.

The Digital Personal Data Protection Act, 2023 applies to digital personal data processed in India and to processing outside India related to offering goods or services to Data Principals in India.

Core actors: Data Principal (the individual), Data Fiduciary (determines purpose and means), Data Processor (processes on behalf of the fiduciary), and Consent Manager (registered intermediary managing consent).

Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and limited to the specified purpose.

Consent notices must be in clear language, available in English and the languages listed in the Eighth Schedule, and state the purpose, data collected, and how to withdraw consent and complain.

Data Principals have rights to access information, correction and erasure, grievance redressal, and nomination; the right to erasure is subject to legal retention obligations.

Data Fiduciaries must implement security safeguards, notify the Data Protection Board and affected Data Principals of a personal data breach, and erase data when purpose is served unless retention is legally required.

Significant Data Fiduciaries carry extra duties: appoint a Data Protection Officer based in India, an independent auditor, conduct DPIAs, and observe algorithmic due diligence.

Penalties under the DPDP Act can reach up to INR 250 crore for failure to take security safeguards; the Data Protection Board of India adjudicates breaches and can impose penalties.

Cross-border transfer is permitted except to countries restricted by the Central Government; the Act does not mandate localisation of all personal data.

RBI's data localisation direction requires payment system data to be stored only in India, with processing permitted abroad if brought back within the specified time and no foreign mirror copy retained.

Consent Managers must be registered with the Data Protection Board and maintain records of consent, acting as a single point for giving, managing, reviewing and withdrawing consent.