Digital Banking
Digital banking tests channel controls: authentication, transaction limits, device and session security, consent, availability, fraud monitoring, outsourcing, and dispute handling. The exam expects you to know what happens when a mobile or internet banking transfer is disputed, and which control failed.
Core rules and controls
- Use two-factor authentication, device binding, session timeouts, encryption, and real-time alerts. Limits are set by channel, customer profile, and risk.
- e-KYC and digital onboarding must still satisfy CDD: identify the customer, verify the document, and record consent.
- Maintain immutable logs of login, device, IP, OTP events, and transaction status. These logs decide liability in disputes.
- Outsource only with NRB-compliant agreements, vendor risk assessment, exit plans, and clear responsibility for incidents.
- Report material cyber incidents and outages promptly; test business continuity and cyber recovery.
Worked example
A customer reports an unauthorised mobile transfer of NPR 85,000. Logs show the OTP went to the registered number, but the device ID changed two days earlier and no alert was sent. The bank must freeze the channel, preserve logs, check for SIM swap or phishing, and decide provisional credit under its policy. The device change without notification is a control gap; the customer’s sharing of an OTP, if proven, affects liability. Record the outcome and fix the alert rule.
Traps
Assuming SMS OTP is sufficient, ignoring SIM-swap indicators, failing to log device changes, treating a disputed transaction as a “customer problem” without investigation, and letting vendors hold logs the bank cannot access.