Information technology, cyber security and digital banking risks
Information technology, cyber security and digital banking risks
This domain tests RBI's IT governance and cyber security expectations and the risk profile of digital channels and cards.
IT governance and controls
RBI's Master Direction on IT Governance, Risk, Controls and Assurance Practices requires board-approved IT and information security policies, a documented IT risk assessment, segregation between IT operations and IT security, change and patch management, privileged access management, backup and restoration testing, and independent IT audit. The cyber security framework expects a cyber security policy, a cyber crisis management plan, a security operations centre, tested incident response, and baseline system hardening.
Cyber and digital banking risks
Principal threats: phishing and vishing, SIM swap, card skimming and cloning, ATM jackpotting, ransomware, man-in-the-middle attacks, unauthorised electronic transactions, and social engineering of staff. Controls include multi-factor authentication, tokenisation, transaction velocity limits, real-time fraud analytics, device binding, customer awareness, and reporting of reportable cyber incidents to CERT-In within six hours.
Customer liability
Under RBI's rules on unauthorised electronic banking transactions, liability turns on whether the failure was at the bank's end and whether the customer was negligent. Third-party breach without customer negligence means zero liability for the customer. The customer must notify the bank promptly, the bank must credit the amount within the prescribed short timeline where it is liable, and complaints must be finally resolved within the outer limit.
Worked example
A customer's SIM is swapped and the fraudster receives OTPs, moving ₹1.5 lakh. Because the bank accepted an OTP flow without re-authentication after the SIM change, the loss sits with the bank: zero customer liability, reimbursement, and a control fix such as a mandatory cooling-off period after any SIM change.
Traps
- Treating OTP entry as automatic proof of customer negligence.
- Missing the six-hour CERT-In reporting clock.
- Assuming IT outsourcing transfers cyber accountability.
- Confusing device binding with authentication of the underlying transaction.