Home › Circulars › RBI/2010-11/563

System Audit Rules Clarified for Payment System Operators

Current · Source: Reserve Bank of India · RBI/2010-11/563 · issued 14 Jun 2011 · ~2 min read
Quick answerRBI clarifies that system audit requirements from a CISA-qualified auditor apply only to entities operating a payment system under the Payment and Settlement Systems Act, 2007, not to participants in systems like RTGS, NEFT, or card networks.
The rule, in the simplest words
How it plays out — a real example

Rahul, a payments & clearing officer in Indore, works for a bank that participates in the RTGS system. He doesn't need to submit a system audit report from a CISA-qualified auditor because his bank is just a participant, not the operator of the payment system.

What changed

This circular clarifies that the earlier December 2010 directive on system audits applies solely to payment system operators, not to banks or entities that are merely participants in payment systems such as RTGS, NEFT, CFMS, ECS, NECS, card networks, or ATM networks. It removes any ambiguity about the scope of the audit requirement.

What it means for you

Banks that are participants in payment systems do not need to submit system audit reports from a CISA-qualified auditor for those systems. Only entities that operate a payment system under the Payment and Settlement Systems Act, 2007, must comply. This reduces compliance burden for most scheduled commercial banks.

What you must do

Who it affects

All scheduled commercial banks, Payment system operators under the Payment and Settlement Systems Act, 2007, Banks participating in RTGS, NEFT, CFMS, ECS, NECS, card payment systems, and ATM networks

❓ Common questions

Does this circular require my bank to get a system audit if we use RTGS or NEFT?

No. If your bank is only a participant in RTGS, NEFT, or other listed payment systems, the system audit requirement does not apply. It applies only to entities that operate a payment system under the Payment and Settlement Systems Act, 2007.

What is the effective date of this clarification?

The circular was issued on June 14, 2011, and clarifies the earlier circular dated December 27, 2010. It is effective from the date of issuance.

Who needs to submit a system audit report from a CISA-qualified auditor?

Only entities that operate a payment system under the Payment and Settlement Systems Act, 2007, need to submit such reports. Participants in payment systems are exempt from this requirement.

📜 Read the original circular — full text as issued by RBI
RBI/2010-11/563 DPSS.CO.OSD. No. 2764/06.11.001/2010-2011 June 14, 2011 To All Scheduled Commercial Banks Dear Sir, Directions for submission of system audit reports from CISA qualified Auditor Please refer to our circular Ref No. DPSS.1444/ 06.11.001/ 2010-2011 dated December 27, 2010 on the captioned subject. It is clarified that the contents of the above circular are applicable to only those entities which operate a payment system under the Payment and Settlement Systems Act, 2007. Accordingly, the requirement of system audits is not applicable where a bank/entity is a participant in various payment systems such as RTGS, NEFT, CFMS, ECS, NECS, Card payment systems (Visa, MasterCard, etc.), ATM networks (illustratively like NFS, BANCS) etc. Please acknowledge receipt. Yours faithfully G. Srinivas (General Manager)
Reproduced for reference with acknowledgment — Source: Reserve Bank of India · RBI/2010-11/563 · issued 14 Jun 2011. The plain-English explanation above is BankPulse’s own independent summary.
🧰 Tools — save, print, templates & related
Most relevant forCompliance TeamInternal AuditIT & Cyber SecuritySenior Management / BoardBusiness Head / Vertical HeadProduct Manager (Digital & Lending)
🛠 Banker’s toolkit — checklists & reply templates →
Related circulars · Payment & Settlement Systems
RBI mandates settlement accounts for payment intermediariesRBI Revises Cheque Collection Charges from April 2011NECS Expansion: Banks Must Onboard All NEFT BranchesMandatory electronic payments for large-value transactionsStandardised RTGS Return Process and Customer Alerts
Browse all departments →
Who does what — compliance checklist
⚙️ Operations
  • Verify whether your bank operates a payment system under the Payment and Settlement Systems Act, 2007, or is only a participant.
💻 IT / Systems
  • If your bank is only a participant in systems like RTGS, NEFT, or card networks, no system audit report is required under this circular.
  • If your bank operates a payment system, ensure system audits are conducted by a CISA-qualified auditor as per the December 2010 circular.
📜 Compliance
  • Acknowledge receipt of this circular to the RBI as instructed.
Grouped from the action items above — a single circular may involve more than one team.
Worked example & action-note template

Example: if you are an Operations officer at a bank this circular applies to (All scheduled commercial banks, Payment system operators under the Payment and Settlement Systems Act, 2007, Banks participating in RTGS, NEFT, CFMS, ECS, NECS, card payment systems, and ATM networks), your first concrete step on “System Audit Rules Clarified for Payment System Operators” is: “Verify whether your bank operates a payment system under the Payment and Settlement Systems Act, 2007, or is only a participant.” (RBI issued this 14 Jun 2011).

  1. Circular: RBI/2010-11/563 -- System Audit Rules Clarified for Payment System Operators
  2. Issued: 14 Jun 2011
  3. Action required: Verify whether your bank operates a payment system under the Payment and Settlement Systems Act, 2007, or is only a participant.
  4. Action required: If your bank is only a participant in systems like RTGS, NEFT, or card networks, no system audit report is required under this circular.
  5. Action required: If your bank operates a payment system, ensure system audits are conducted by a CISA-qualified auditor as per the December 2010 circular.
  6. Action required: Acknowledge receipt of this circular to the RBI as instructed.
  7. Owner: ____________ Target date: ____________
  8. Board/committee approval needed? Y / N
  9. Evidence filed in compliance register on: ____________
Built only from this circular’s own published fields — not legal advice; always confirm against the official RBI source.

💬 Banker Discussion

Discuss this circular with fellow bankers — reply, upvote what helps, report what doesn’t belong. Be professional; no client data. Views are the commenter’s own, not BankPulse’s.

Loading comments…
BankPulse Compliance Evidence Pack — generated 03 Aug 2026 · status cross-checked against RBI’s official withdrawal register (refreshed weekly).
Official RBI source: https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=6457&Mode=0 — Plain-English summary by BankPulse (bankpulse.ai), reviewed by our expert reviewer, CA Amit Jain. Independent platform, not affiliated with the Reserve Bank of India; is our own plain-English paraphrase, not RBI’s original wording.
Public beta — plain-English informational summaries. Always verify against the official RBI source (circular number cited on every page) before making compliance, credit, treasury, audit, or operational decisions. · Join our WhatsApp channel ↗
—