RBI’s Master Direction

on Digital Payment
Security Controls
W: [Link]
E: info@[Link]
US Tel: +1-415-513-5261 | SG Tel: +65-3129-0397 |
IN Tel: +91 73045 57744

An ISO27001 Certified Company, CERT-IN Empanelled, PCI QSA | USA. SINGAPORE. INDIA. UK. MIDDLE EAST. CANADA.
Topics Covered Introduction
Sr. Titles Pg.
No. No.

01. Introduction 02

02. Key Highlights of Master Direction 03 Given the dynamic digital landscape and skyrocket
-ing online payment transactions, the industry has witne
-ssed huge spike in cybercrimes. Addressing the growing
03. Applicability of the Master Direction 03 need for stringent digital payment security controls in the industr-
y, RBI recently issued a comprehensive Master Direction for organiza-
tions to follow. The Master Direction works as a guideline for organiza-
04. Key Areas Covered in the Master Direction 04 tions to improve the security, and governance of payment gateways,
wallets, and other digital payment transactions that they deal with on a
day-to-day basis.
05. Digital Payment Security Controls in a Glance 06
The guidelines will help organizations establish a robust digital pay-
ment system and implement effective standards of security controls
06. Chapter II 07 for online payments. With this Master Direction, it is now expected that
entities like banks and NBFC’s emphasise on their quality of gover-
07. Chapter III 11 nance, risk management, and internal security controls for establishing
a safer digital payment environment. The issued guidelines specify
security protocols to be implemented in mobile applications, internet
08. Chapter IV 11 banking, and card payments by scheduled commercial banks, small
financial and payment banks, and card issuing institutes.

09. Chapter V 12 The Master Direction is issued at crucial time when the financial indus-
try is in the mid of its rapid digital transformation and evolving security
landscape. The guidelines issued is a technological and applica-
10. Going Ahead with the Master Direction 14 tion-based framework that improves the digital payment environment
Plan of Action & Key Recommendat- for customers to securely embrace the evolving digitization of the finan-
ions for Businesses cial industry. While this initiative is seen as a positive move to towards
strengthening the regulations and supervision, it is yet to be seen as to
how the enforcement of the security framework takes it course.

[Link] 02
 It provides a comprehensive gover-
Key Highlights of the Master nance structure and minimum-securi-
ty control standards for systems like
Direction internet banking, mobile banking,
card payment, etc.

It provides a comprehensive governance structure and mini- Scheduled Commercial Banks

mum-security control standards for systems like internet bank- (excluding Regional Rural Banks)
ing, mobile banking, card payment, etc.
Small Finance Banks
It is a Standard driven by secure and robust security gover- Payments Banks
nance controls of international standards and guidelines like
OWASP, NIST, ISO, PCI to name a few. Credit card issuing NBFCs.

It contains requirements for strong governance, implementa- Typically speaking the issued guide-
tion, and monitoring of security control standards by sched- lines will also affect the business
uled commercial banks, small financial and payment banks, models of several payment gateways.
and card issuing institutes. The directions will have implications
Applicability on third-party payment applications
The Master Directions will also have implications on the such as Google Pay, PhonePe, etc.
third-party payment applications such as Google Pay, Pho- of the Master
nePe, etc. Timeline
Direction The guidelines is set to come into full
RBI’s Master Direction covers a diverse area, including import- effect from August 2021 (6 months
ant security controls concerning the Governance and Manage- post-release of the guidelines)
ment of Security Risks, Generic Security Controls, Application
Security Life Cycle (ASLC), Authentication Framework, Fraud
Risk Management, Reconciliation Mechanism, Customer Pro-
Objective of the Master
tection, Awareness and Grievance Redressal Mechanism relat- Direction
ed to Internet Banking, Mobile Payments Application Security
Controls, and Card Payments Security. The guideline aims is to
strengthen the regulations and
supervision of non-cash, digital
It will come into effect on August which is six months from the
payments in the industry.
day they are placed on the official website of the Reserve Bank
of India (RBI). The timeline would be with immediate effect
Improve the security, and gov-
from thereon.
ernance of payment gateways,
wallets, and other digital pay-
ment transactions.

[Link] 03
The guideline aims is to strengthen the regulations
and supervision of non-cash, digital payments in
the industry.
Key Areas Covered in
Improve the security, and governance of payment
the RBI’s Master Direction
gateways, wallets, and other digital payment trans-
actions. The Master Direction is a detailed 21-page dossier issued by the RBI
which specifies security protocols to be implemented in mobile applica-
Aims to ensure regulated entities prioritize and
focus on the quality of governance, risk manage- The Master Direction is a detailed 21-page dossier
ment, and internal security controls for building a issued by the RBI which specifies security pro
safer digital payment environment. tocols to be implemented in mobile appli
cations, internet banking, and card
payments by scheduled com-
Strengthen and improve the internal grievance mercial banks, small finan-
redress mechanism with enhanced disclosures on cial and payment banks,
customer complaints. and card issuing institutes.
The guide line includes spe-
Effective implementation and monitoring of certain cifications on diverse areas,
minimum standards on security controls. including important Securi-
ty Controls concerning:-
Overall, aim is to ensure secure online payment
transactions and prevent incidents of a data
breach, theft, or data leakage of sensitive customer
information.

[Link] 04
 Governance and Management of Security Risks

Generic Security Controls

Application Security Life Cycle (ASLC)

Authentication Framework

Fraud Risk Management,

Reconciliation Mechanism

Customer Protection

Awareness and Grievance Redressal Mechanism related to Internet

Banking, Mobile Payments Application Security Controls, and Card
Payments Security.

Special emphasis on following various Payment Card Security Stan-

dards as per Payment Card Industry (PCI).

RBI aims to push the regulated financial institutes and NBFC’s to

improve the overall operations, security controls and customer care
services.

[Link] 05
 Digital Payment Security Controls
CHAPTER II
Governance & Management of Security Risks
Policy for Digital Risk Controls for Risk Capacity Management Plan Data Recovery
Payment Products & Management & Monitoring the Assessment System & Procedure
Services Governance Ac�vi�es of the
Program Third Party

Generic Security Controls

Communica�on Storage of Implementa�on Renewal of Logging and Monitoring Ac�vi�es
Protocols Sensi�ve Data of Firewalls & Digital
DDoS Cer�ficates
Protec�on

Applica�on Security Lifecycle

Mul�-�er Applica�on Threat Modeling Security Tes�ng Ac�vity Security Controls for Digital Payment Applica�ons
Architecture Approach Monitoring
Mechanism

Authen�ca�on Framework
Mul�-factor Authen�ca�on Authentica�on A�empts
System Fraud Management

Digital Payment Security System Alerts Fraud Analysis

Mechanism
Train Staff

Reconcilia�on Mechanism
Incident Response

Controls In A Glance Usage Guidelines & Training

Real-�me reconcilia�on Mechanism
Customer Protec�on, Awareness, Grievance Redressal Mechanism
Update & Educate Mechanism for Mechanism for Alerts & No�fica�on
Material Customers Consumer
Grievance &
Redressal
CHAPTER III
Internet Banking Security Controls
Secure internet System Time-outs Password Genera�on
banking website
CHAPTER IV
Mobile Applica�on Security Controls
Mechanism for Controls for Mobile Device Authentica� Storage of Sensi�ve Data Security
Reinstalling and Applica�ons Binding on & Re- considera�ons
Verifying Mobile authen�ca�
Applica�on on
Mechanism
CHAPTER V
Card Payment Security
Follow PCI Standards PCI P2PE Certified Secure Card Security Security Robust Transac Card
Terminal Payment Controls at Controls Surveillance/ �on Data
Installa�on Infrastructure HSM at ATM’s Monitoring of Limits Scanning
Card Tools
Transac�ons

[Link] 06
 Minimal customer service disruption with high availability of
CHAPTER II systems/ channels.

Efficient and effective dispute resolution mechanism and handling

Governance & Management of customer grievance.

of Security Risk Adequate and appropriate review mechanism followed by swift cor-
rective action.

Mechanism for conducting User Acceptance Tests (UAT) in multiple

stages before roll out, sign off from multiple stakeholders.

2. Risk management & Governance Program - Establish

a robust Governance and Risk Management program for identifying, ana-
lyzing, monitoring, and managing the specific risks. This would include
having in place
Compliance risk and Fraud risk assessment program.
Performance monitoring systems
Key performance indicators for assessing operational and security
norms
Quantitative benchmarks for evaluating the effectiveness of securi-
1. Policy for Digital Payment Products & Services - ty built.
The regulated entity is expected to have in place a comprehensive policy
for the Digital Payment Products & Services approved by the Board of 3. Controls for Monitoring the Activities of the Third
Directors and the Senior Management. The policy should explicitly con- Party - Regulated Entities who are dependent on third party service
tain payment security requirements covering the areas of functionality, providers must have in place adequate measures to oversee and con-
security & performance of products and services. This would include trols for monitoring the activities of the third party personnel. The enti-
having in place- ties shall implement necessary measures in line with RBI guidelines on
outsourcing to the third-party.
Controls to protect the confidentiality of customer, data integrity
of data and processes associated with the digital product/ services.
Availability of requisite infrastructure.
4. Risk Assessment - The Regulated entities are required to per-
form Risk Assessment at regular intervals to ensure safety and security
Payment products built securely offering robust performance, of digital payment products and associated processes and services. This
safety, and consistency. is to ensure entities protect the integrity, confidentiality and security of
the payment data and evaluate the resilience of their systems. They are
Process for capacity building and expansion with scalability.
also required to maintain database of all systems and applications stor-
[Link] 07
 secure standards and implement appropriate
level of encryption and security.

2. Storage of Sensitive Data - Web

applications providing the digital payment prod-
ucts and services should not store sensitive infor-
mation to prevent compromise in the integrity of
the data.

ing customer data in the payment ecosystem and ensure compliance 3. Implementation of Firewalls &
with applicable PCI standards in each of the systems. DDoS Protection - Regulated Entities are
required to implement Web Application Firewall
5. Capacity Management Plan - Entities must have in place (WAF) and DDoS mitigation techniques to secure
appropriate Capacity Management Plan to ensure the established digital the digital payment products and services.
payment infrastructure is robust, scalable and resilient to meet the grow-
ing demands. 4. Renewal of Digital Certificates -
Digital certificates used in the ecosystem should
6. Data Recovery System & Procedure - Entities should be renewed on time by the Regulated Entities.
have procedures to periodically test systems and applications that
account data back-ups, and recovery pertaining to digital products and 5. Logging and Monitoring Activi-
services to ensure there is no loss of transactions or audit-trails. ties - Mobile Application and Internet Banking
Application should have effective logging and
Generic Security Controls monitoring capabilities to track user activity, secu-
rity changes and identify anomalous behavior
1. Communication Protocols - Entities should adhere to a and transactions.
[Link] 08
Application Security Lifecycle Authentication Framework

1. Multi-tier Application Architecture - Entities must

implement a multi-tier application architecture, segregating application, 1. Multi-factor Authentication - Entities should implement
database and presentation layer adopting a secure by design practice for multi-factor authentication for payment through electronic modes and
developing digital payment products and services. fund transfers.

2. Threat Modeling Approach - The Regulated entities must 2. Authentication Attempts - Regulated Entities should set
adopt and incorporate a threat modelling approach into their policies, maximum number of failed log-in or authentication attempts after which
processes, guidelines and procedures during the course of Application access to the digital payment product/ service shall be blocked.
Lifecycle Management.
Fraud Risk Management
3. Security Testing - Entities must conduct various security testing
including review of source code, Vulnerability Assessment (VA) and Pene- 1. System Alerts - Entities must have in place parameterized and
tration Testing (PT) of their digital payment applications at a regular inter- monitored alert systems to alert the customers in case of failed authenti-
val to ensure that the application is secure. cation, fund transfers, cash withdrawals, payments through electronic
modes, adding new beneficiaries etc.
4. Activity Monitoring Mechanism - Entities must imple-
ment a mechanism to actively monitor non-genuine/ unauthorized/ mali- 2. Fraud Analysis Mechanism - Fraud analysis mechanism
cious Payment Applications on app stores and webs and respond accord- must be in place to identify fraud occurrence and determine mechanism
ingly to bring them down. to prevent such frauds.

5. Security controls for Digital Payment Applica- 3. Train staff - Regular training should be provided to staff in the
tions - Considering various OWASP standards, security and data pro- fraud control function to educate and train them with skills and areas of
tection guidelines in ISO 12812, threat catalogues and guides developed expertise in-
by NIST, entities must accordingly deploy the best Security controls for
digital payment applications.
[Link] 09
 Fraud control tools and their usage;

Investigative techniques and procedures;

Cardholder and merchant education
techniques to prevent fraud; Customer
Scheme/ Card operating regulations; Protection,
Data processing and analysis Awareness
and liaising or communicating and Grievance
with law enforcement agencies; Redressal Mechanism
1. Usage Guidelines & Training
4. Incident Response - Regulated Enti- Material - Regulated Entities must provide usage guidelines and train-
ties must have in place mechanism for handling ing materials for end users and make it mandatory for users to go through
and responding to Incidents related to payment secure guidelines.
ecosystem and mitigate the loss either to the
customer or Regulated Entities. 2. Update and Educate Customers - Regulated entities must
educate customers and keep them updated about the best usage practice
Reconciliation Mechanism of digital payment applications.

1. Real-time Reconciliation Mecha- 3. Mechanism for Consumer Grievance & Redressal -

Entities are expected to have in place an effective mechanism for address-
nism - Regulated Entities must establish an
ing consumer grievance & redressal. This should include clearly specifying
effective, real-time reconciliation mechanism
the respond timelines, process and procedure (with forms/ contact infor-
(not later than 24 hours from the time of receipt
mation, etc.) to lodge consumer grievances and a mechanism to keep this
of settlement file(s)) for all digital payment trans-
information periodically updated.
actions between the Regulated Entities all other
stakeholders such as payment system opera-
tors, business correspondents, card networks,
4. Mechanism for Alerts & Notification - Entities must estab-
lish a mechanism for sending out immediate alerts and notification of
payment system processors, payment aggrega-
fraudulent transactions for instant reporting to the corresponding benefi-
tors, payment gateways, third party technology
ciary/ counterparty’s Regulated Entities. This is to accelerate early detec-
service providers, other participants, etc. This is
tion and quickly trace the transaction trail and mitigate the loss to the
for better detection and prevention of suspi-
defrauded customer at the earliest possible time.
cious transactions.

[Link] 10
 2. Controls for Mobile Applications - Entities must
CHAPTER III implement the below mentioned controls for their mobile applica-
tions -
Internet Banking Security Device policy enforcement;
Controls Application secure download/ install;
1. Secure Internet Banking Websites - Entitles must Deactivating older application versions in a phased but time
ensure securing the internet banking websites against authentica- bound manner and maintain only one version of the mobile
tion-related attacks such as the DOS and brute force attacks by imple-
application on a platform/ operating system;
ment additional levels of authentication such as adaptive authentica- Storage of Customer Data;
tion, strong CAPTCHA (preferably with anti-bot features) with serv-
Device or Application Encryption;
er-side validation, etc. Further, measures to be taken to prevent DNS
cache poisoning attacks and for secure handling of cookies. Ensuring minimal data collection/ app permissions;

Application sandbox/ containerisation;

2. System Time-outs - Establish a mechanism of automated
time-out of a sessions after a fixed period of inactivity. Identify remote access applications and prohibit login access
to the mobile application, as a matter of precaution;
3. Password Generation - Entities must ensure secure genera- Code obfuscation.
tion and dispatching of sensitive passwords with validity for a limited
period from the date and time of its creation.
3. Device Binding - Regulated Entities shall ensure Device
Binding of Mobile Applications.

CHAPTER IV 4. Authentication & Re-authentication Mecha-

nism - Regulated Entities must have in place appropriate
Mobile Application Security authentication and re-authentication mechanism. This would
include -
Controls An alternatives to SMS-based OTP;
1. Mechanism for Reinstalling and Verifying Re-authentication for when the device or application
Mobile Application - In case of detection of any anomalies or remains unused for a designated period
exceptions for which the mobile application was not programmed, Authentication/ checks/ measures to identify new network
there should be a process in place that reinstall a new version and connections or connections from unsecured networks like
verify the before the transactions are enabled. unsecured Wi-Fi connections.
[Link] 11
5. Storage of Sensitive Data - Mobile Application should not 2. PCI P2PE Certified Terminal Installation - Entities should
store/ retain sensitive personal/ consumer authentication information such install terminals at merchant sites that are PCI P2PE certified.
as user IDs, passwords, keys, hashes, hard coded references on the device
and the application should securely wipe any sensitive customer informa- 3. Secure Card Payment Infrastructure - Acquirers shall
tion from memory when the customer/ user exits the application. secure their card payment infrastructure with Unique Key Per Terminal
(UKPT) or Derived Unique Key Per Transaction (DUKPT)/ Terminal Line
6. Security considerations - Entities must design anti-malware Encryption (TLE).
capabilities and secure the mobile application against vulnerabilities like
SQL injection.

CHAPTER V
Card Payment Security
1. Follow PCI Standards - Regulated Entities are
expected to follow various PCI Standards applicable to them
which includes -
PCI-PIN (secure management, processing, and transmission
of personal identification number (PIN) data);

PCI-PIN (secure management, processing, and transmission

of personal identification number (PIN) data);

PCI-PTS (security approval framework addresses the logical

and/ or physical protection of cardholder and other sensitive
data at point of interaction (POI) devices and hardware
security modules (HSMs);

PCI-HSM (securing cardholder-authentication applications

and processes including key generation, key injection, PIN
verification, secure encryption algorithm, etc.); and

PCI-P2PE (security standard that requires payment card

information to be encrypted instantly upon its initial swipe
and then securely transferred directly to the payment processor).
[Link] 12
4. Security Controls at HSM - The Security Controls expected Scan tools should be installed in the Regulated Entities premises
to be implemented at HSM include - and devices.
Log Management Card data scanning should not be done remotely.
Access Control Management
Exportable card data must be appropriately masked.
Secure Key Management.
No data, which is even masked, must be taken out of
5. Security Controls at ATM’s - The Security the RE’s premises/ infrastructure.
Controls expected to be implemented at ATM’s include –
Limited access to service providers to conduct
BIOS password
the scan or analyze the data or provide only
Latest Patches of Operating System on entities device.

Anti-Skimming & Whitelisting Solution

6. Robust Surveillance/
Monitoring of Card Transactions-
Entities must institute a mechanism to
monitor breaches, if any, on a 24x7 basis,
including weekends, long holidays and have
in place a robust incident response
mechanism to mitigate the fraud loss, on
account of suspicious transactions.

7. Transaction Limits -
Entities must have in place transaction limits for
domestic and international transactions at Card, BIN
as well as at the Regulated Entities levels, set at the card
network switch itself.

8. Card Data Scanning Tools –

Entities must adopt card data scanning tools to identify unencrypted pay-
ments card data in their ecosystem and adhere the following safety mea-
sures -

Test tools to understand the scope, impact and its capabilities in

a test environment.
[Link] 13
 Going Ahead with the Master
Direction
Plan of Action for Businesses -
Businesses should initially conduct a basic assessment of their
Digital Payment Ecosystem to understand where they stand
with their existing Compliance Program in place.

The key to achieving Compliance is understanding your Digital

Payment Ecosystem and accordingly establishing security
measures aligning with the new Master Direction.

Again, for those businesses that are compliant to some or most

of the international standards like PCI, NIST, ISO, OWASP, etc
should map their Compliance Program with the RBI’s Master
Direction to determine the GAP areas.

For your business to stay ahead in the industry, understanding

the law is crucial

Gaining such insight will help you design a compliance program

that aligns well with your business and compliance goals, making
the road ahead for Compliance more achievable.

Preparing ahead of the time before the new master direction

comes into effect will save you from the last minute hassle.
The earlier your business takes steps towards initiating the Digital
Payment Security Program, your business will be in a far better
position to deal with the regulation when it comes into effect.

We also recommend businesses to approach an experienced

Cyber Security Consulting firm for assisting you in navigating
through the process.

Consulting an expert from the industry will help your business

make an informed decision when designing a Digital Payment
Security Program.

[Link] 14
About Us
VISTA lnfoSec is a Global Cyber Security
Consulting firm offering exceptional Cyber
Security Consulting & Audit Service, Regulat-
ory & Compliance Consulting Services and
Infrastructure Advisory Solutions. With stro-
ng industrial presence since 2004, we
have been serving clients from across the
world with our robust, end-to-end security
services and solutions. We are a 100% vendor neut-
ral company with strict no outsourcing policy and built on
our core values of strict code of ethics, transparency and
professionalism.

[Link]
 OUR SERVICES OFFERINGS

Compliance & Governance Technical Assessment Managed Service

• SOC 1 Consulting & Audit • Vulnerability Assessment • Adaptive Security Managment Pro
gram
• SOC 2 Consulting & Audit • Penetration Testing
• DPO Consultancy Services
• PCI DSS Advisory and Certification • Web App Security Assessment
• CISO Advisory
• PCI PIN Advisory and Certification
• Mobile Security Assessment • Managed Compliance Services
• PA SSF Advisory and Certification
• Thick Client Application Security • Managed Security Services
• ISO 27001 Advisory and Certification
Assessment
• ISO 20000 Advisory and Certification
• Virtualization Risk Assessment
• Business Continuity Management IT Audit & Advisory
(ISO22301)
• Secure Configuration Assessment
• Cloud Risk CCM / CStar / ISO27017 • Infrastructure Audit
• • Source Code Review
lnformation Security Audit • Infrastructure Design & Advisory
• Software License Audit • Datacenter Design & Consultancy
Services
• ATM Security Assessment Regulatory And Compliance
• GDPR Consulting and Audit
Training & Skill Development
• HIPAA Consulting and Audit
• CCPA Consulting and Audit • Training & Skill Development
• NESA Consulting and Audit
• MAS-TRM Consulting and Audit
• NCA ECC Compliance
• SAMA Compliance

[Link]
 OUR OFFICES

USA SINGAPORE INDIA UK

VISTA INFOSEC LLC VISTA INFOS EC PTE. LTD VISTA INFOSEC PVT. LTD 6 AMBER COURT
24007 VENTURA BLVD 20 COLLYER QUAY 001, NORTH WING, GOLDSMITH CLOSE
SUITE 285 #09-01 2ND FLOOR, HARROW, GREATER LONDON
CALABASAS CA 91302 20 COLLYER QUAY NEOSHINE HOUSE, UNITED KINGDOM
SINGAPORE (049319) LINK ROAD, ANDHERI (W) HA20EZ
MUMBAI - 400053

+1-415-513-5261 +65-3129-0397 +91 99872 44769 +447405816761

+91-22-26300683

USSALES@[Link] SGSALES@[Link] SALES@[Link] UKSALES@[Link]

[Link]
Webinar : RBI’s Master Direction
on Digital Payment Security
Controls

CONTACT US

US Tel: +1-415-513-5261 | SG Tel: +65-3129-0397 | IN Tel: +91 73045 57744

W: [Link] | E: info@[Link]

You can reach us on