What RBI IT examiners actually check during an inspection
RBI IT examinations follow a structured framework across eight domains: IT Governance, Information Security, IS Audit, IT Operations, IT Service Management, Cyber Fraud Risk Management, Business Continuity, and Outsourcing / Third-Party Risk. Examiners arrive with a standard questionnaire and request evidence for each domain. The most common finding at NBFCs: Board-approved IS policy exists but has not been reviewed in 12+ months; VAPT was conducted once several years ago with no subsequent testing; incident response plan exists as a template but has not been tested; DR drills were conducted but not documented. These are the exact gaps Bachao.AI's engagement package is designed to close.
Scale-based regulation: which NBFCs face the most scrutiny
RBI's scale-based regulation framework categorises NBFCs into Base Layer (BL), Middle Layer (ML), Upper Layer (UL), and Top Layer (TL). Upper Layer and Top Layer NBFCs face the most intensive IT examination scrutiny — annual examinations, mandatory IS audit by empanelled auditors, and board-level IT governance requirements. Middle Layer NBFCs face periodic examinations. Base Layer NBFCs have lighter requirements but are not exempt. Payment aggregators are subject to RBI's PA Guidelines (2020) which have their own IT security requirements — including annual VAPT and security audit.
The VAPT requirement in RBI IT Framework — what it says exactly
The RBI IT Framework for NBFCs explicitly requires: 'Periodic vulnerability assessment and penetration testing of the IT systems, applications, and infrastructure.' The frequency is not defined as a fixed calendar period — it is 'periodic', which in examination practice means at least annually for most systems, with quarterly scans for internet-facing applications. Examiners ask for the last VAPT report, the list of findings, evidence of remediation for critical and high findings, and confirmation that follow-up testing was conducted. A Bachao.AI VAPT report package delivers all four evidence items.
Incident reporting to CERT-In: what happens if you miss the 6-hour window
The April 2022 CERT-In direction mandates that covered entities report cybersecurity incidents within 6 hours of becoming aware of them. This applies to NBFCs and payment aggregators. RBI IT examiners now verify CERT-In compliance as part of the incident management domain review — they ask if there is a documented notification procedure and whether any incidents in the previous period were reported on time. Missing the 6-hour window is a finding that goes into the examination report and can trigger follow-up directives from RBI. Bachao.AI's engagement includes an IR workflow template with the CERT-In notification process documented and tested.
Third-party risk and cloud: what RBI checks for NBFCs
RBI's IT Framework and PA Guidelines both include third-party risk management requirements — vendors and cloud service providers that handle customer data or support critical operations must be assessed for security posture. Examiners specifically check for: data localisation (is customer financial data stored in India-resident infrastructure?), vendor security questionnaires, contractual data protection clauses, and right-to-audit provisions. Bachao.AI's Cloud Security Posture Management (CSPM) assessment covers cloud misconfigurations and data residency verification — producing the evidence RBI examiners look for during the outsourcing risk review.
How long before your RBI examination should you engage Bachao.AI
RBI IT examinations are announced with limited notice — typically 2-4 weeks advance notice, or sometimes unannounced for specific targeted reviews. The right time to prepare is not when the examination notice arrives — it is at least 3 months before your next scheduled examination cycle. This gives: 10 days for VAPT completion, 3-4 weeks for remediation of critical findings, 1-2 weeks for retest and closure certificate, and 4-6 weeks to address any IS policy, BCP, or vendor risk gaps identified. Engaging after the examination notice arrives means answering 'in progress' on examination questions — which is a worse outcome than a clean report.