Information Technology and Digital Banking
What the exam tests
This domain tests core banking, digital channels, cybersecurity, outsourcing risk, customer liability for unauthorised electronic transactions and incident response.
Core rules
- CBS access must be role-based and unique. Enforce strong passwords, two-factor authentication for digital channels, encryption and timely patching. Shared admin IDs are a control failure.
- Monitor UPI, IMPS, NEFT, RTGS, card and ATM transactions for fraud patterns. Hotlist compromised accounts and devices promptly.
- Report cyber incidents to CERT-In within six hours of noticing them, and follow RBI incident-reporting requirements. Maintain an incident response plan and forensic evidence.
- Outsourcing does not transfer accountability. Apply vendor due diligence, contractual security clauses, data-protection controls and exit plans.
- Under RBI's limited-liability framework, customer liability for unauthorised electronic transactions depends on whether the customer shared credentials and whether the bank's systems were at fault.
Worked example
A customer reports a ₹20,000 unauthorised UPI debit within hours. The bank should hotlist the account, acknowledge the complaint, investigate device and transaction logs, and apply the RBI limited-liability framework. If the bank's systems were compromised and the customer did not share credentials, liability is zero; provisional credit follows the prescribed timeline. Telling the customer to file an FIR without investigating is not sufficient.
Traps that cost marks
Sharing OTPs, delaying CERT-In reporting, allowing shared admin IDs, ignoring patch management and treating outsourcing as a transfer of accountability are frequent errors.