RBI's Cybersecurity Mandates
The Reserve Bank of India has issued multiple circulars and master directions on cybersecurity. If you're a bank, NBFC, payment aggregator, or any RBI-regulated entity, compliance is not optional — it's a licensing condition.
₹5 CrAverage fine for non-compliance with RBI IT directives (RBI Annual Report 2025)
127Cyber fraud cases reported to RBI per day in FY 2025 (RBI Financial Stability Report)
45%Increase in UPI-related frauds YoY (RBI Payment Systems Report 2025)
90 daysMaximum timeline for completing recommended security remediation (RBI Master Direction)
Key RBI Circulars You Must Know
| Circular | Year | Applies To | Key Requirement |
|---|---|---|---|
| Master Direction on IT Governance | 2023 | All regulated entities | IT governance framework mandatory |
| Cyber Security Framework for Banks | 2016 | Banks, UCBs | CISO appointment, SOC, VAPT |
| Guidelines on Digital Lending | 2022 | NBFCs, fintech | Data storage, consent, security |
| Master Direction on Outsourcing | 2023 | All regulated entities | Vendor risk assessment mandatory |
| Payment Aggregator Guidelines | 2020 | PAs, payment gateways | PCI-DSS + additional RBI requirements |
The 6 Pillars of RBI Cyber Compliance
graph TD
A[RBI Cybersecurity
Compliance] --> B[1. IT Governance
Board-level oversight] A --> C[2. VAPT
Quarterly scans mandatory] A --> D[3. SOC
24x7 monitoring] A --> E[4. Incident Response
6-hour reporting] A --> F[5. Data Security
Encryption + access control] A --> G[6. Vendor Risk
Third-party assessment] style A fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style C fill:#1e5f3a,stroke:#10B981,color:#e2e8f0
Compliance] --> B[1. IT Governance
Board-level oversight] A --> C[2. VAPT
Quarterly scans mandatory] A --> D[3. SOC
24x7 monitoring] A --> E[4. Incident Response
6-hour reporting] A --> F[5. Data Security
Encryption + access control] A --> G[6. Vendor Risk
Third-party assessment] style A fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style C fill:#1e5f3a,stroke:#10B981,color:#e2e8f0
1. IT Governance
- Board-approved IT strategy with cybersecurity as a standing agenda item
- CISO appointment — must report directly to the Board, not just IT head
- Annual IT audit by an independent qualified auditor
2. Vulnerability Assessment and Penetration Testing (VAPT)
This is where most entities fall short:
| Requirement | Frequency | Scope |
|---|---|---|
| External VAPT | Quarterly | All internet-facing systems |
| Internal VAPT | Semi-annually | Internal network, databases |
| Web application VAPT | After every major release | Customer-facing apps |
| Mobile app VAPT | After every major release | Banking/payment apps |
| API VAPT | Quarterly | All payment and data APIs |
WARNING
RBI examiners specifically ask for VAPT reports during inspections. Not having current reports (< 90 days old) is a material observation that can lead to monetary penalties and operating restrictions.
3. Security Operations Centre (SOC)
- 24x7 monitoring of security events
- Log aggregation from all critical systems
- Automated alerting for anomalous behaviour
- Minimum 5-year log retention
4. Incident Response
graph LR
A[🚨 Incident
Detected] -->|Immediate| B[Contain
& Assess] B -->|Within 6 hrs| C[Report to
CERT-In] C -->|Within 24 hrs| D[Report to
RBI CSITE] D -->|Within 7 days| E[Submit
Root Cause] E -->|Within 30 days| F[Remediation
Complete] style A fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style C fill:#1e3a5f,stroke:#F97316,color:#e2e8f0 style F fill:#1e5f3a,stroke:#10B981,color:#e2e8f0
Detected] -->|Immediate| B[Contain
& Assess] B -->|Within 6 hrs| C[Report to
CERT-In] C -->|Within 24 hrs| D[Report to
RBI CSITE] D -->|Within 7 days| E[Submit
Root Cause] E -->|Within 30 days| F[Remediation
Complete] style A fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style C fill:#1e3a5f,stroke:#F97316,color:#e2e8f0 style F fill:#1e5f3a,stroke:#10B981,color:#e2e8f0
5. Data Security
- Encryption: AES-256 at rest, TLS 1.2+ in transit
- Access controls: Role-based, MFA mandatory for admin access
- Data masking: PAN, Aadhaar, and account numbers masked in logs and non-production environments
- Data localisation: Payment data must be stored in India (RBI mandate)
6. Vendor Risk Management
- All critical vendors must undergo annual security assessment
- Contractual obligation for vendors to notify of breaches
- Right to audit clause in all vendor contracts
- VAPT of vendor-hosted systems
Know your vulnerabilities before attackers do
Run a free VAPT scan — takes 5 minutes, no signup required.
Book Your Free ScanRBI Compliance Checklist for NBFCs
| # | Requirement | Priority | Status |
|---|---|---|---|
| 1 | Board-approved IT policy | Critical | ☐ |
| 2 | CISO appointed | Critical | ☐ |
| 3 | Quarterly VAPT — external | Critical | ☐ |
| 4 | Semi-annual VAPT — internal | High | ☐ |
| 5 | Incident response plan documented | Critical | ☐ |
| 6 | CERT-In reporting process in place | Critical | ☐ |
| 7 | Data encryption at rest and in transit | Critical | ☐ |
| 8 | MFA for all admin/privileged access | High | ☐ |
| 9 | Security awareness training (annual) | Medium | ☐ |
| 10 | Vendor risk assessment (annual) | High | ☐ |
| 11 | Cyber insurance policy | Medium | ☐ |
| 12 | Business continuity plan tested | High | ☐ |
Key Takeaway
RBI compliance is a continuous process, not a one-time project. The quarterly VAPT requirement alone means you need a reliable, affordable security partner. Bachao.AI offers VAPT-as-a-service specifically designed for RBI-regulated entities.
How Bachao.AI Helps RBI-Regulated Entities
- Quarterly VAPT scans meeting RBI's scope requirements
- Audit-ready reports formatted for RBI examiner review
- CERT-In compliance mapping in every report
- API security testing covering payment and data endpoints
- Remediation support with code-level fix suggestions
INFO
Start with a free external VAPT scan to see your current security posture. Visit bachao.ai and get your risk score in minutes.
Written by Shouvik Mukherjee, Founder of Bachao.AI. 15+ years in software engineering, now building AI-powered security products for Indian fintech and enterprise. Fourth-time founder. DPIIT Recognised Startup. Contact: ceo@bachao.ai
