Information Technology in Banking
Information Technology in Banking tests the systems and controls behind modern banking: core banking, payment channels, digital onboarding, cybersecurity, outsourcing and business continuity.
Core rules
- The core banking system is the record of truth; channels such as ATM, POS, internet/mobile and agent banking must reconcile to it.
- Pakistan’s payment rails include RTGS/PRISM for high-value settlement, NIFT for clearing, 1Link/IBFT for interbank retail transfers, and Raast for instant person-to-person and merchant payments.
- Digital onboarding still requires CDD/KYC, liveness checks, CNIC verification, risk profiling and transaction monitoring.
- SBP cybersecurity and enterprise technology governance rules require board-approved policy, segregation of duties, incident response, patch management and third-party risk oversight.
- Data protection, access control, encryption and logging are controls; business continuity requires tested backups and disaster recovery.
Worked example
A customer complains that an IBFT transfer left the account but did not reach the beneficiary. The officer checks the core banking entry, the switch/1Link status, and the beneficiary bank’s response. If the transaction failed at the switch, a reversal is initiated through settlement with dual authorisation; the customer gets a complaint reference and a timeline. The incident is logged, and repeated failures are escalated to IT for root-cause analysis. The officer never asks for the customer’s OTP or PIN.
Traps
- Sharing OTPs, passwords or screenshots of customer data.
- Installing unapproved software or using production data in testing.
- Assuming a pending transaction is complete without checking the switch.
- Ignoring third-party or cloud outsourcing risk because the vendor is reputable.