IIBF Emerging Technologies flashcards

37 cards. Read the term and the definition here. The deck at the top of this page is optional.

Digital Transformation Definition

Re-engineering customer journeys onto digital channels using APIs, cloud, analytics and straight-through processing, rather than merely launching a mobile app or website.

India Stack

Public digital infrastructure comprising Aadhaar e-KYC, DigiLocker, eSign, UPI and BBPS, used by Indian banks and NBFCs for identity, documentation and payments.

UPI Operator

The Unified Payments Interface is operated by the National Payments Corporation of India (NPCI), which sets participation rules for banks, PSPs and third-party app providers.

Straight-Through Processing

End-to-end automated processing of a transaction or loan without manual intervention, measured as STP rate and used as a key digital transformation efficiency metric.

Regulatory Sandbox

A controlled testing framework allowing innovative fintech products to be piloted on a limited cohort with relaxed compliance for a defined period, subject to the regulator's approval.

Business Correspondent Model

An arrangement where an agent delivers banking services on behalf of a regulated entity, which remains accountable for KYC, data handling and grievance redressal by that agent.

Supervised Learning

Machine learning that maps labelled input data to known outputs, such as predicting loan default using historical borrowers with known repayment outcomes.

Gini Coefficient Formula

A credit scorecard discrimination metric computed as Gini = 2 × AUC − 1, where AUC is the area under the receiver operating characteristic curve.

Population Stability Index

A drift metric comparing score distributions between a development sample and a later population; values above roughly 0.25 conventionally signal significant shift requiring investigation.

KS Statistic

The Kolmogorov-Smirnov statistic measures the maximum separation between cumulative distributions of good and bad borrowers; higher values indicate stronger discriminatory power.

Overfitting

A model fits training data noise and performs poorly out-of-sample; controlled by train/test splits, cross-validation, regularisation and out-of-time validation on later vintages.

SHAP Values

Shapley-value-based attributions that quantify each feature's contribution to an individual prediction, supporting explainability and auditability of machine learning models.

Model Risk Management Lifecycle

Inventory, tiering by materiality, documented development, independent validation, approval, ongoing monitoring, periodic revalidation and eventual decommissioning of models.

Calibration versus Discrimination

Discrimination (AUC, KS, Gini) measures ranking ability; calibration (Brier score, observed-to-expected ratio) measures whether predicted probabilities match observed default rates.

CIA Triad

Confidentiality, integrity and availability: the three core information security objectives used to justify and categorise security controls in a financial institution.

CERT-In Incident Reporting

Directions require reporting specified cyber incidents to CERT-In within six hours of noticing, and maintaining logs for 180 days within India for investigation.

Ransomware Defence

Offline or immutable backups with tested restores, least privilege, patching, network segmentation and endpoint detection and response; ransom payment is discouraged and reportable.

Zero Trust

A security model replacing perimeter trust with continuous verification: authenticate and authorise every request, apply least privilege, micro-segment networks and assume breach.

VAPT

Vulnerability assessment and penetration testing covering internet-facing, mobile, API and internal systems; findings are risk-ranked, remediated and retested to closure.

Defence in Depth

Layering identity, network, endpoint, encryption, monitoring and response controls so that failure of any single control does not compromise the whole environment.

RTO and RPO

Recovery time objective is the maximum tolerable downtime; recovery point objective is the maximum tolerable data loss. Both are set from business impact analysis.

Three Lines Model

Business owns and manages risk as the first line; risk and compliance oversight is the second; internal audit provides independent assurance as the third line.

Business Impact Analysis

A process identifying critical systems, dependencies and recovery objectives, forming the basis for business continuity and disaster recovery planning and testing.

Change Management Controls

Segregation of development, test and production environments, documented approvals, user acceptance testing, rollback plans and post-implementation review before production release.

IT Key Risk Indicators

Measurable signals such as patch latency, privileged account count, phishing failure rate, incident detection time and unresolved critical vulnerabilities used to monitor IT risk.

Outsourcing Accountability

Outsourcing and cloud arrangements do not transfer regulatory responsibility; the regulated entity retains due diligence, audit rights, exit planning and board reporting duties.

Digital Lending Fund Flow

Disbursals and repayments must flow directly between borrower bank accounts and the regulated entity, without any pass-through pool account of the lending service provider.

Lending Service Provider

An agent of the regulated entity that performs sourcing or servicing functions; the regulated entity remains responsible for product, pricing, KYC and compliance.

Key Fact Statement

A standard-format pre-contract disclosure stating the annual percentage rate, all-inclusive interest, fees, penalties, cooling-off period and grievance officer details.

Cooling-Off Period

A look-up window during which a digital borrower may exit the loan by repaying principal plus proportionate APR-linked charges, without penalty.

Digital Lending Data Rules

Data collection must be need-based with explicit consent; access to contacts, media, files and phone resources is prohibited, and one-time permissions are required.

Data Fiduciary

Under the DPDP Act, the entity that alone or with others determines the purpose and means of processing personal data, and bears primary compliance obligations.

Consent Manager

A person registered with the Data Protection Board that acts as a single point for a Data Principal to give, manage, review and withdraw consent.

Significant Data Fiduciary

A notified Data Fiduciary with extra duties: an India-based Data Protection Officer, an independent auditor, data protection impact assessments and algorithmic due diligence.

DPDP Breach Notification

Data Fiduciaries must notify the Data Protection Board of India and affected Data Principals of a personal data breach, in the form and manner prescribed.

Payment Data Localisation

RBI requires payment system data to be stored only in India; processing abroad is permitted if data is brought back promptly with no foreign mirror copy retained.

DPDP Penalty Ceiling

The DPDP Act allows penalties up to INR 250 crore for failure to take reasonable security safeguards to prevent a personal data breach, imposed by the Data Protection Board.