IIBF Certified Information System Banker cheat sheet

Core Banking Solution (CBS): centralised, customer-centric system holding CIF (Customer Information File), deposits, loans, GL; branches act as front-end nodes with no local data ownership.

CBS deployment models: in-house data centre, hosted/ASP, or cloud (private/public); hosted models shift infrastructure risk to the vendor but data ownership and regulatory accountability stay with the bank.

Delivery channels: branch, ATM, POS, internet banking, mobile banking, SMS/USSD, call centre, agency banking, API/open banking; each channel is a separate attack surface requiring its own controls.

Straight-Through Processing (STP): transaction flows end-to-end without manual intervention; STP rate = (transactions processed without manual touch / total transactions) x 100.

CBS interfaces typically include switch (ATM/POS/UPI), payment gateways, SWIFT, RTGS/NEFT, treasury, AML/fraud monitoring, regulatory reporting, and CRM; interface failures are the most common cause of downstream reconciliation breaks.

Middleware (message queues, ESB, API gateways) decouples CBS from channels; asynchronous queuing protects the core from channel spikes but introduces message-loss and duplicate-posting risks requiring idempotency keys.

Batch vs real-time: end-of-day (EOD) batch runs interest accrual, GL posting and reports; BOD (beginning of day) opens the next business date. Failed EOD halts next-day business and is a high-severity incident.

Data centre tiering: Tier I-IV per Uptime Institute; Tier III = concurrently maintainable, Tier IV = fault tolerant; most bank DCs target Tier III minimum with DR in a separate seismic/geographic zone.

CIA triad: Confidentiality (encryption, access control), Integrity (hashing, checksums, maker-checker), Availability (redundancy, DDoS protection).

Defence in depth layers: perimeter (firewall, IPS), network segmentation (VLAN, DMZ), host hardening, application controls, data encryption, identity and monitoring.

AAA: Authentication (something you know/have/are), Authorisation (role-based entitlements), Accounting (logs, audit trail). MFA is mandatory for privileged and remote access.

Encryption standards: AES-256 for data at rest, TLS 1.2+ for data in transit, SHA-256 for hashing; key management lifecycle (generation, distribution, rotation, destruction) under dual control.

Patch management: classify by CVSS severity; critical patches typically applied within 7-15 days, high within 30 days; emergency change process for zero-days.

Segregation of duties and maker-checker: no single user can initiate, approve and reconcile the same transaction; privileged access reviewed at least quarterly.

Cyber incident response lifecycle: preparation, identification, containment, eradication, recovery, lessons learned; reportable incidents escalated to regulator within mandated timelines (e.g., 2-6 hours for major incidents in many jurisdictions).

SOC functions: 24x7 monitoring, SIEM correlation, threat intelligence, use-case tuning; SIEM false-positive rate is a key operational metric.

Compensating controls apply when a primary control cannot be implemented; they must be documented, risk-accepted at the right authority level, and time-bound.

IT governance: the framework of leadership, structures and processes ensuring IT sustains and extends the organisation's strategy and objectives; accountable to the Board, not to IT management alone.

COBIT 2019: governance and management objectives across EDM (Evaluate, Direct, Monitor) and APO/BAI/DSS/MEA domains; used to design a tailored governance system.

Three lines model: 1st line = business/IT operations (own risk), 2nd line = risk and compliance (oversee), 3rd line = internal audit (independent assurance).

Board IT Strategy Committee and IT Steering Committee: the former sets direction and risk appetite, the latter prioritises projects, allocates resources and monitors delivery.

IT risk appetite: expressed in quantitative thresholds (e.g., max downtime hours, max loss per incident); controls are calibrated to appetite, not to zero risk.

IT balanced scorecard perspectives: corporate contribution, user orientation, operational excellence, future orientation.

Key governance metrics: IT spend as % of revenue, % of IT budget on run vs change, project on-time/on-budget rate, % of strategic projects aligned to business plan.

Policy hierarchy: Board-approved policy > standards > procedures > guidelines; exceptions require documented, time-bound risk acceptance.

Audit risk model: Audit Risk = Inherent Risk x Control Risk x Detection Risk; auditor reduces detection risk by increasing substantive testing.

Audit evidence hierarchy: externally generated evidence > internally generated > oral; system-generated logs are stronger than manual reports unless completeness and integrity are verified.

IT audit types: general controls review (ITGC), application controls review, information systems audit, IS audit of outsourced services, and cyber/regulatory audits.

ITGC domains: access to programs and data, program changes, program development, computer operations; application controls: input, processing, output, and interface controls.

Continuous auditing and CAATs (Computer-Assisted Audit Techniques): ACL, SQL scripts, data analytics; test 100% of population when feasible instead of sampling.

Regulatory expectations: annual IS audit, concurrent audit of high-risk branches, quarterly vulnerability assessment, annual penetration testing, and independent audit of service providers.

Audit findings must be tracked to closure with owner, due date and severity; overdue high-risk findings escalated to Audit Committee of the Board.

Regulatory reporting: incident reporting, cyber-security returns, outsourcing register, and audit committee minutes; non-reporting is itself a compliance breach.

BCM lifecycle per ISO 22301: policy and planning, business impact analysis (BIA), risk assessment, strategy, plan development, testing, and continuous improvement.

RTO (Recovery Time Objective): maximum tolerable downtime; RPO (Recovery Point Objective): maximum tolerable data loss, measured in time. RTO drives DR architecture, RPO drives replication strategy.

BIA outputs: critical business functions, dependencies, MTD (Maximum Tolerable Downtime), and recovery priorities; MTD >= RTO always.

DR site options: cold (space only), warm (partial kit), hot (mirrored, near-zero RTO); active-active for mission-critical payment systems.

Backup 3-2-1 rule: 3 copies, 2 different media, 1 off-site; backups must be encrypted and restore-tested at least annually.

Testing types: tabletop, walkthrough, simulation, parallel, full failover; results must produce a corrective action plan with owners and dates.

Crisis management: alternate site activation, communication tree, customer and regulator notification, and media handling; plan must be reviewed at least annually and after major change.

ITIL 4 service value chain: Plan, Improve, Engage, Design and Transition, Obtain/Build, Deliver and Support; incident, problem, change and service level management are core practices.

Incident vs problem: incident is an unplanned interruption restored via workaround; problem is the underlying root cause managed to closure via RCA.

Change management: standard (pre-approved), normal (CAB review), emergency (expedited approval); change success rate and % emergency changes are key metrics.

SLA and OLA: SLA is with the customer, OLA is internal between support groups; underpinning contracts (UC) bind external suppliers. Service credits are the remedy for SLA breach.

Availability formula: Availability % = (Agreed Service Time - Downtime) / Agreed Service Time x 100; measured over an agreed window.

Vendor risk lifecycle: due diligence, risk rating, contract with security and audit clauses, onboarding, ongoing monitoring, periodic independent review, and exit strategy.

Outsourcing contracts must include: right to audit, data ownership and confidentiality, sub-contractor approval, breach notification timelines, BCP/DR obligations, and termination/transition assistance.

Concentration risk: over-reliance on a single vendor or single geography; monitored in the outsourcing register and reported to the Board.

Digital channels: internet banking, mobile banking, UPI/instant payments, wallets, API/open banking, and assisted digital (tablet banking, video KYC).

Onboarding controls: KYC/Customer Due Diligence, liveness and document verification, Aadhaar/e-ID based e-KYC, and periodic re-KYC based on risk category.

Authentication: MFA for login and high-value transactions; device binding, OTP with short TTL, biometrics, and transaction risk scoring.

Customer protection: no liability for unauthorised electronic transactions when the customer has not shared credentials and reports promptly; limited liability otherwise; grievance redressal with defined turnaround times.

API security: OAuth 2.0/OpenID Connect, mutual TLS, rate limiting, input validation, and API gateway logging; never expose core banking APIs directly to the internet.

Digital fraud typologies: phishing, vishing, SIM swap, account takeover, card-not-present fraud, mule accounts, and social engineering; monitor with behavioural analytics.

Digital lending and BNPL: automated credit decisioning, e-mandate for recurring payments, and consent-based data sharing under account aggregator frameworks.

Payment rails: RTGS (high-value, real-time, gross settlement), NEFT/ACH (batch, net settlement), UPI/instant payments (24x7, real-time), SWIFT (cross-border messaging; SWIFT is a messaging network, not a settlement system).

Card networks: Visa/Mastercard/RuPay; EMV chip with dynamic cryptogram, tokenisation replaces PAN with a surrogate token, 3-D Secure adds an authentication layer.

Blockchain/DLT: distributed, append-only, cryptographically linked; consensus mechanisms (PoW, PoS, PBFT); permissioned DLT (Hyperledger, Corda) is preferred for banking consortia.

Cloud computing: IaaS, PaaS, SaaS; shared responsibility model; data residency, exit strategy and concentration risk require regulator notification in many jurisdictions.

AI/ML in banking: credit scoring, AML transaction monitoring, fraud detection, chatbots; explainability, model risk management, bias testing and periodic model validation are mandatory.

RPA: rule-based automation of repetitive tasks; requires exception handling, audit logging and change control; unsuitable for judgement-heavy processes.

Open banking and account aggregators: consent-based, purpose-limited data sharing with revocable consent and audit trail; consent artefact is the legal record.

CBDC and stablecoins: central bank digital currency is a sovereign liability; stablecoins are private liabilities backed by reserves; both raise AML, monetary policy and settlement finality questions.

Core Banking Solution (CBS): centralised, customer-centric system holding CIF (Customer Information File), deposits, loans, GL; branches act as front-end nodes with no local data ownership.

CBS deployment models: in-house data centre, hosted/ASP, or cloud (private/public); hosted models shift infrastructure risk to the vendor but data ownership and regulatory accountability stay with the bank.

Delivery channels: branch, ATM, POS, internet banking, mobile banking, SMS/USSD, call centre, agency banking, API/open banking; each channel is a separate attack surface requiring its own controls.

Straight-Through Processing (STP): transaction flows end-to-end without manual intervention; STP rate = (transactions processed without manual touch / total transactions) x 100.

CBS interfaces typically include switch (ATM/POS/UPI), payment gateways, SWIFT, RTGS/NEFT, treasury, AML/fraud monitoring, regulatory reporting, and CRM; interface failures are the most common cause of downstream reconciliation breaks.

Middleware (message queues, ESB, API gateways) decouples CBS from channels; asynchronous queuing protects the core from channel spikes but introduces message-loss and duplicate-posting risks requiring idempotency keys.

Batch vs real-time: end-of-day (EOD) batch runs interest accrual, GL posting and reports; BOD (beginning of day) opens the next business date. Failed EOD halts next-day business and is a high-severity incident.

Data centre tiering: Tier I-IV per Uptime Institute; Tier III = concurrently maintainable, Tier IV = fault tolerant; most bank DCs target Tier III minimum with DR in a separate seismic/geographic zone.

CIA triad: Confidentiality (encryption, access control), Integrity (hashing, checksums, maker-checker), Availability (redundancy, DDoS protection).

Defence in depth layers: perimeter (firewall, IPS), network segmentation (VLAN, DMZ), host hardening, application controls, data encryption, identity and monitoring.

AAA: Authentication (something you know/have/are), Authorisation (role-based entitlements), Accounting (logs, audit trail). MFA is mandatory for privileged and remote access.

Encryption standards: AES-256 for data at rest, TLS 1.2+ for data in transit, SHA-256 for hashing; key management lifecycle (generation, distribution, rotation, destruction) under dual control.

Patch management: classify by CVSS severity; critical patches typically applied within 7-15 days, high within 30 days; emergency change process for zero-days.

Segregation of duties and maker-checker: no single user can initiate, approve and reconcile the same transaction; privileged access reviewed at least quarterly.

Cyber incident response lifecycle: preparation, identification, containment, eradication, recovery, lessons learned; reportable incidents escalated to regulator within mandated timelines (e.g., 2-6 hours for major incidents in many jurisdictions).

SOC functions: 24x7 monitoring, SIEM correlation, threat intelligence, use-case tuning; SIEM false-positive rate is a key operational metric.

Compensating controls apply when a primary control cannot be implemented; they must be documented, risk-accepted at the right authority level, and time-bound.

IT governance: the framework of leadership, structures and processes ensuring IT sustains and extends the organisation's strategy and objectives; accountable to the Board, not to IT management alone.

COBIT 2019: governance and management objectives across EDM (Evaluate, Direct, Monitor) and APO/BAI/DSS/MEA domains; used to design a tailored governance system.

Three lines model: 1st line = business/IT operations (own risk), 2nd line = risk and compliance (oversee), 3rd line = internal audit (independent assurance).

Board IT Strategy Committee and IT Steering Committee: the former sets direction and risk appetite, the latter prioritises projects, allocates resources and monitors delivery.

IT risk appetite: expressed in quantitative thresholds (e.g., max downtime hours, max loss per incident); controls are calibrated to appetite, not to zero risk.

IT balanced scorecard perspectives: corporate contribution, user orientation, operational excellence, future orientation.

Key governance metrics: IT spend as % of revenue, % of IT budget on run vs change, project on-time/on-budget rate, % of strategic projects aligned to business plan.

Policy hierarchy: Board-approved policy > standards > procedures > guidelines; exceptions require documented, time-bound risk acceptance.

Audit risk model: Audit Risk = Inherent Risk x Control Risk x Detection Risk; auditor reduces detection risk by increasing substantive testing.

Audit evidence hierarchy: externally generated evidence > internally generated > oral; system-generated logs are stronger than manual reports unless completeness and integrity are verified.

IT audit types: general controls review (ITGC), application controls review, information systems audit, IS audit of outsourced services, and cyber/regulatory audits.

ITGC domains: access to programs and data, program changes, program development, computer operations; application controls: input, processing, output, and interface controls.

Continuous auditing and CAATs (Computer-Assisted Audit Techniques): ACL, SQL scripts, data analytics; test 100% of population when feasible instead of sampling.

Regulatory expectations: annual IS audit, concurrent audit of high-risk branches, quarterly vulnerability assessment, annual penetration testing, and independent audit of service providers.

Audit findings must be tracked to closure with owner, due date and severity; overdue high-risk findings escalated to Audit Committee of the Board.

Regulatory reporting: incident reporting, cyber-security returns, outsourcing register, and audit committee minutes; non-reporting is itself a compliance breach.

BCM lifecycle per ISO 22301: policy and planning, business impact analysis (BIA), risk assessment, strategy, plan development, testing, and continuous improvement.

RTO (Recovery Time Objective): maximum tolerable downtime; RPO (Recovery Point Objective): maximum tolerable data loss, measured in time. RTO drives DR architecture, RPO drives replication strategy.

BIA outputs: critical business functions, dependencies, MTD (Maximum Tolerable Downtime), and recovery priorities; MTD >= RTO always.

DR site options: cold (space only), warm (partial kit), hot (mirrored, near-zero RTO); active-active for mission-critical payment systems.

Backup 3-2-1 rule: 3 copies, 2 different media, 1 off-site; backups must be encrypted and restore-tested at least annually.

Testing types: tabletop, walkthrough, simulation, parallel, full failover; results must produce a corrective action plan with owners and dates.

Crisis management: alternate site activation, communication tree, customer and regulator notification, and media handling; plan must be reviewed at least annually and after major change.

ITIL 4 service value chain: Plan, Improve, Engage, Design and Transition, Obtain/Build, Deliver and Support; incident, problem, change and service level management are core practices.

Incident vs problem: incident is an unplanned interruption restored via workaround; problem is the underlying root cause managed to closure via RCA.

Change management: standard (pre-approved), normal (CAB review), emergency (expedited approval); change success rate and % emergency changes are key metrics.

SLA and OLA: SLA is with the customer, OLA is internal between support groups; underpinning contracts (UC) bind external suppliers. Service credits are the remedy for SLA breach.

Availability formula: Availability % = (Agreed Service Time - Downtime) / Agreed Service Time x 100; measured over an agreed window.

Vendor risk lifecycle: due diligence, risk rating, contract with security and audit clauses, onboarding, ongoing monitoring, periodic independent review, and exit strategy.

Outsourcing contracts must include: right to audit, data ownership and confidentiality, sub-contractor approval, breach notification timelines, BCP/DR obligations, and termination/transition assistance.

Concentration risk: over-reliance on a single vendor or single geography; monitored in the outsourcing register and reported to the Board.

Digital channels: internet banking, mobile banking, UPI/instant payments, wallets, API/open banking, and assisted digital (tablet banking, video KYC).

Onboarding controls: KYC/Customer Due Diligence, liveness and document verification, Aadhaar/e-ID based e-KYC, and periodic re-KYC based on risk category.

Authentication: MFA for login and high-value transactions; device binding, OTP with short TTL, biometrics, and transaction risk scoring.

Customer protection: no liability for unauthorised electronic transactions when the customer has not shared credentials and reports promptly; limited liability otherwise; grievance redressal with defined turnaround times.

API security: OAuth 2.0/OpenID Connect, mutual TLS, rate limiting, input validation, and API gateway logging; never expose core banking APIs directly to the internet.

Digital fraud typologies: phishing, vishing, SIM swap, account takeover, card-not-present fraud, mule accounts, and social engineering; monitor with behavioural analytics.

Digital lending and BNPL: automated credit decisioning, e-mandate for recurring payments, and consent-based data sharing under account aggregator frameworks.

Payment rails: RTGS (high-value, real-time, gross settlement), NEFT/ACH (batch, net settlement), UPI/instant payments (24x7, real-time), SWIFT (cross-border messaging; SWIFT is a messaging network, not a settlement system).

Card networks: Visa/Mastercard/RuPay; EMV chip with dynamic cryptogram, tokenisation replaces PAN with a surrogate token, 3-D Secure adds an authentication layer.

Blockchain/DLT: distributed, append-only, cryptographically linked; consensus mechanisms (PoW, PoS, PBFT); permissioned DLT (Hyperledger, Corda) is preferred for banking consortia.

Cloud computing: IaaS, PaaS, SaaS; shared responsibility model; data residency, exit strategy and concentration risk require regulator notification in many jurisdictions.

AI/ML in banking: credit scoring, AML transaction monitoring, fraud detection, chatbots; explainability, model risk management, bias testing and periodic model validation are mandatory.

RPA: rule-based automation of repetitive tasks; requires exception handling, audit logging and change control; unsuitable for judgement-heavy processes.

Open banking and account aggregators: consent-based, purpose-limited data sharing with revocable consent and audit trail; consent artefact is the legal record.

CBDC and stablecoins: central bank digital currency is a sovereign liability; stablecoins are private liabilities backed by reserves; both raise AML, monetary policy and settlement finality questions.

Core Banking Solution (CBS): centralised, customer-centric system holding CIF (Customer Information File), deposits, loans, GL; branches act as front-end nodes with no local data ownership.

CBS deployment models: in-house data centre, hosted/ASP, or cloud (private/public); hosted models shift infrastructure risk to the vendor but data ownership and regulatory accountability stay with the bank.

Delivery channels: branch, ATM, POS, internet banking, mobile banking, SMS/USSD, call centre, agency banking, API/open banking; each channel is a separate attack surface requiring its own controls.

Straight-Through Processing (STP): transaction flows end-to-end without manual intervention; STP rate = (transactions processed without manual touch / total transactions) x 100.

CBS interfaces typically include switch (ATM/POS/UPI), payment gateways, SWIFT, RTGS/NEFT, treasury, AML/fraud monitoring, regulatory reporting, and CRM; interface failures are the most common cause of downstream reconciliation breaks.

Middleware (message queues, ESB, API gateways) decouples CBS from channels; asynchronous queuing protects the core from channel spikes but introduces message-loss and duplicate-posting risks requiring idempotency keys.

Batch vs real-time: end-of-day (EOD) batch runs interest accrual, GL posting and reports; BOD (beginning of day) opens the next business date. Failed EOD halts next-day business and is a high-severity incident.

Data centre tiering: Tier I-IV per Uptime Institute; Tier III = concurrently maintainable, Tier IV = fault tolerant; most bank DCs target Tier III minimum with DR in a separate seismic/geographic zone.

CIA triad: Confidentiality (encryption, access control), Integrity (hashing, checksums, maker-checker), Availability (redundancy, DDoS protection).

Defence in depth layers: perimeter (firewall, IPS), network segmentation (VLAN, DMZ), host hardening, application controls, data encryption, identity and monitoring.

AAA: Authentication (something you know/have/are), Authorisation (role-based entitlements), Accounting (logs, audit trail). MFA is mandatory for privileged and remote access.

Encryption standards: AES-256 for data at rest, TLS 1.2+ for data in transit, SHA-256 for hashing; key management lifecycle (generation, distribution, rotation, destruction) under dual control.

Patch management: classify by CVSS severity; critical patches typically applied within 7-15 days, high within 30 days; emergency change process for zero-days.

Segregation of duties and maker-checker: no single user can initiate, approve and reconcile the same transaction; privileged access reviewed at least quarterly.

Cyber incident response lifecycle: preparation, identification, containment, eradication, recovery, lessons learned; reportable incidents escalated to regulator within mandated timelines (e.g., 2-6 hours for major incidents in many jurisdictions).

SOC functions: 24x7 monitoring, SIEM correlation, threat intelligence, use-case tuning; SIEM false-positive rate is a key operational metric.

Compensating controls apply when a primary control cannot be implemented; they must be documented, risk-accepted at the right authority level, and time-bound.

IT governance: the framework of leadership, structures and processes ensuring IT sustains and extends the organisation's strategy and objectives; accountable to the Board, not to IT management alone.

COBIT 2019: governance and management objectives across EDM (Evaluate, Direct, Monitor) and APO/BAI/DSS/MEA domains; used to design a tailored governance system.

Three lines model: 1st line = business/IT operations (own risk), 2nd line = risk and compliance (oversee), 3rd line = internal audit (independent assurance).

Board IT Strategy Committee and IT Steering Committee: the former sets direction and risk appetite, the latter prioritises projects, allocates resources and monitors delivery.

IT risk appetite: expressed in quantitative thresholds (e.g., max downtime hours, max loss per incident); controls are calibrated to appetite, not to zero risk.

IT balanced scorecard perspectives: corporate contribution, user orientation, operational excellence, future orientation.

Key governance metrics: IT spend as % of revenue, % of IT budget on run vs change, project on-time/on-budget rate, % of strategic projects aligned to business plan.

Policy hierarchy: Board-approved policy > standards > procedures > guidelines; exceptions require documented, time-bound risk acceptance.

Audit risk model: Audit Risk = Inherent Risk x Control Risk x Detection Risk; auditor reduces detection risk by increasing substantive testing.

Audit evidence hierarchy: externally generated evidence > internally generated > oral; system-generated logs are stronger than manual reports unless completeness and integrity are verified.

IT audit types: general controls review (ITGC), application controls review, information systems audit, IS audit of outsourced services, and cyber/regulatory audits.

ITGC domains: access to programs and data, program changes, program development, computer operations; application controls: input, processing, output, and interface controls.

Continuous auditing and CAATs (Computer-Assisted Audit Techniques): ACL, SQL scripts, data analytics; test 100% of population when feasible instead of sampling.

Regulatory expectations: annual IS audit, concurrent audit of high-risk branches, quarterly vulnerability assessment, annual penetration testing, and independent audit of service providers.

Audit findings must be tracked to closure with owner, due date and severity; overdue high-risk findings escalated to Audit Committee of the Board.

Regulatory reporting: incident reporting, cyber-security returns, outsourcing register, and audit committee minutes; non-reporting is itself a compliance breach.

BCM lifecycle per ISO 22301: policy and planning, business impact analysis (BIA), risk assessment, strategy, plan development, testing, and continuous improvement.

RTO (Recovery Time Objective): maximum tolerable downtime; RPO (Recovery Point Objective): maximum tolerable data loss, measured in time. RTO drives DR architecture, RPO drives replication strategy.

BIA outputs: critical business functions, dependencies, MTD (Maximum Tolerable Downtime), and recovery priorities; MTD >= RTO always.

DR site options: cold (space only), warm (partial kit), hot (mirrored, near-zero RTO); active-active for mission-critical payment systems.

Backup 3-2-1 rule: 3 copies, 2 different media, 1 off-site; backups must be encrypted and restore-tested at least annually.

Testing types: tabletop, walkthrough, simulation, parallel, full failover; results must produce a corrective action plan with owners and dates.

Crisis management: alternate site activation, communication tree, customer and regulator notification, and media handling; plan must be reviewed at least annually and after major change.

ITIL 4 service value chain: Plan, Improve, Engage, Design and Transition, Obtain/Build, Deliver and Support; incident, problem, change and service level management are core practices.

Incident vs problem: incident is an unplanned interruption restored via workaround; problem is the underlying root cause managed to closure via RCA.

Change management: standard (pre-approved), normal (CAB review), emergency (expedited approval); change success rate and % emergency changes are key metrics.

SLA and OLA: SLA is with the customer, OLA is internal between support groups; underpinning contracts (UC) bind external suppliers. Service credits are the remedy for SLA breach.

Availability formula: Availability % = (Agreed Service Time - Downtime) / Agreed Service Time x 100; measured over an agreed window.

Vendor risk lifecycle: due diligence, risk rating, contract with security and audit clauses, onboarding, ongoing monitoring, periodic independent review, and exit strategy.

Outsourcing contracts must include: right to audit, data ownership and confidentiality, sub-contractor approval, breach notification timelines, BCP/DR obligations, and termination/transition assistance.

Concentration risk: over-reliance on a single vendor or single geography; monitored in the outsourcing register and reported to the Board.

Digital channels: internet banking, mobile banking, UPI/instant payments, wallets, API/open banking, and assisted digital (tablet banking, video KYC).

Onboarding controls: KYC/Customer Due Diligence, liveness and document verification, Aadhaar/e-ID based e-KYC, and periodic re-KYC based on risk category.

Authentication: MFA for login and high-value transactions; device binding, OTP with short TTL, biometrics, and transaction risk scoring.

Customer protection: no liability for unauthorised electronic transactions when the customer has not shared credentials and reports promptly; limited liability otherwise; grievance redressal with defined turnaround times.

API security: OAuth 2.0/OpenID Connect, mutual TLS, rate limiting, input validation, and API gateway logging; never expose core banking APIs directly to the internet.

Digital fraud typologies: phishing, vishing, SIM swap, account takeover, card-not-present fraud, mule accounts, and social engineering; monitor with behavioural analytics.

Digital lending and BNPL: automated credit decisioning, e-mandate for recurring payments, and consent-based data sharing under account aggregator frameworks.

Payment rails: RTGS (high-value, real-time, gross settlement), NEFT/ACH (batch, net settlement), UPI/instant payments (24x7, real-time), SWIFT (cross-border messaging; SWIFT is a messaging network, not a settlement system).

Card networks: Visa/Mastercard/RuPay; EMV chip with dynamic cryptogram, tokenisation replaces PAN with a surrogate token, 3-D Secure adds an authentication layer.

Blockchain/DLT: distributed, append-only, cryptographically linked; consensus mechanisms (PoW, PoS, PBFT); permissioned DLT (Hyperledger, Corda) is preferred for banking consortia.

Cloud computing: IaaS, PaaS, SaaS; shared responsibility model; data residency, exit strategy and concentration risk require regulator notification in many jurisdictions.

AI/ML in banking: credit scoring, AML transaction monitoring, fraud detection, chatbots; explainability, model risk management, bias testing and periodic model validation are mandatory.

RPA: rule-based automation of repetitive tasks; requires exception handling, audit logging and change control; unsuitable for judgement-heavy processes.

Open banking and account aggregators: consent-based, purpose-limited data sharing with revocable consent and audit trail; consent artefact is the legal record.

CBDC and stablecoins: central bank digital currency is a sovereign liability; stablecoins are private liabilities backed by reserves; both raise AML, monetary policy and settlement finality questions.