{"what_this_is":"The machine-readable twin of the BankPulse page for one RBI rulebook. Same points, same dates, same paragraph references as the page a person reads. RBI's own wording is not reproduced here: each point names the RBI paragraph, the character offset into the text BankPulse read and the sha256 of that text, so the claim can be checked against RBI's own document.","schema_version":1,"release_id":"d653cdb0a5","generated_at":"2026-09-15T00:33:59.117975+00:00","id":"md12715","title":"Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators","document_kind":"Master Direction","page":"https://bankpulse.ai/rule/md12715","status":"In force","importance":{"code":"MR","label":"MUST READ","weight":"Must read","why":"Binding instrument, class not named: applies broadly","layer":"bankpulse_inference"},"applies_to":{"shown":"All regulated entities","class_code":"ALL","from":"the document's own title","layer":"bankpulse_inference"},"dates":{"prid":"md12715","mode":"four_dates_v1","published":{"label":"Published","value":"Jul 30, 2024","stated":true,"why":"The day RBI put this document out."},"effective":{"label":"Starts to apply","value":"","stated":false,"why":"Not stated separately in this document. Read the rule itself before you assume a start date."},"transition":{"label":"Time to get ready","value":"","stated":false,"why":"Cannot be worked out until the day it starts to apply is known."},"deadline":{"label":"Last date to act","value":"","stated":false,"why":"No date to act by was found in this document. Other dates may sit inside single paragraphs."},"sources":{"published":"doc_date in data/highlights/md12715.json","effective":"none held","transition":"none held","deadline":"none held"}},"rbi_source":{"url":"https://rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=12715","document_date":"Jul 30, 2024","read_by_bankpulse":"2026-08-21 16:26:37 UTC","text_sha256":"b7d62a1b8b2dc88df342d5092c4cd24fe915c016acaff3d80d50f8870d0844c9","word_count":4625,"standing_last_checked":"Standing checked on RBI’s Master Directions index, 15 September 2026, 5:58 am IST."},"counts":{"points_shown":98,"points_naming_an_rbi_paragraph":98,"points_stored":98,"actions":0,"amendments":0},"points":[{"n":1,"claim":"md12715-c4f92984","page_group":"Must know","stored_section":"WHAT CHANGES","heading":"Escrow if you cannot","plain_english":"Where the source code cannot be had, it must be placed in escrow.","rbi_paragraph":"Para 17","rbi_char_offset":13664,"weight":"MUST KNOW","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p1","layer":"bankpulse"},{"n":2,"claim":"md12715-48de9036","page_group":"Must know","stored_section":"KEY DATES","heading":"Test backups half yearly","plain_english":"Backed up data must be tested at least once every six months.","rbi_paragraph":"Para 20","rbi_char_offset":16518,"weight":"MUST KNOW","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p2","layer":"bankpulse"},{"n":3,"claim":"md12715-9459a5fb","page_group":"Must know","stored_section":"KEY DATES","heading":"Six hours to report","plain_english":"An unusual incident must be reported to RBI within 6 hours of detection.","rbi_paragraph":"Para 22","rbi_char_offset":18345,"weight":"MUST KNOW","role":"Compliance","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p3","layer":"bankpulse"},{"n":4,"claim":"md12715-dbdbe397","page_group":"Must know","stored_section":"WHAT CHANGES","heading":"Score below the mark","plain_english":"A staff member scoring below the mark may be barred from the information assets.","rbi_paragraph":"Para 25","rbi_char_offset":20591,"weight":"MUST KNOW","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p4","layer":"bankpulse"},{"n":5,"claim":"md12715-07c8f044","page_group":"Must know","stored_section":"WHAT CHANGES","heading":"Keep tenants apart","plain_english":"A shared cloud must be guarded so the data of different users never mixes.","rbi_paragraph":"Para 26","rbi_char_offset":21355,"weight":"MUST KNOW","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p5","layer":"bankpulse"},{"n":6,"claim":"md12715-066fde42","page_group":"Must know","stored_section":"KEY DATES","heading":"Keep logs five years","plain_english":"Audit logs must be kept for at least five years.","rbi_paragraph":"Para 27","rbi_char_offset":23111,"weight":"MUST KNOW","role":"Audit","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p6","layer":"bankpulse"},{"n":7,"claim":"md12715-a6ca443a","page_group":"Must know","stored_section":"KEY DATES","heading":"Twelve hour cooling period","plain_english":"After a change of mobile number or email, no online payment is allowed for at least 12 hours.","rbi_paragraph":"Para 31","rbi_char_offset":27620,"weight":"MUST KNOW","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":"A customer changes the mobile number on her wallet at nine in the morning. RBI sets a cooling period of minimum 12 hours. So no online payment from that wallet can go through until nine at night. A payment she tries at six in the evening is refused.","anchor":"https://bankpulse.ai/rule/md12715#p7","layer":"bankpulse"},{"n":1,"claim":"md12715-d337381d","page_group":"Do it","stored_section":"WHO IT APPLIES TO","heading":"Partners must comply too","plain_english":"The operator must make its unregulated partners follow these rules by agreement.","rbi_paragraph":"Para 5","rbi_char_offset":5889,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p8","layer":"bankpulse"},{"n":2,"claim":"md12715-ffaae337","page_group":"Do it","stored_section":"WHO SHOULD ACT","heading":"Board policy for partners","plain_english":"A Board approved policy must set out how those partners are held to the rules.","rbi_paragraph":"Para 5","rbi_char_offset":5999,"weight":"DO IT","role":"Board","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p9","layer":"bankpulse"},{"n":3,"claim":"md12715-6e400888","page_group":"Do it","stored_section":"WHO SHOULD ACT","heading":"Board owns cyber risk","plain_english":"The Board must oversee information security risk, cyber risk and cyber resilience.","rbi_paragraph":"Para 7","rbi_char_offset":6375,"weight":"DO IT","role":"Board","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p10","layer":"bankpulse"},{"n":4,"claim":"md12715-a8c30e19","page_group":"Do it","stored_section":"WHO SHOULD ACT","heading":"Who chairs it","plain_english":"That sub-committee must be headed by a member who knows information and cyber security.","rbi_paragraph":"Para 7","rbi_char_offset":6581,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p11","layer":"bankpulse"},{"n":5,"claim":"md12715-8c37d86a","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Board approved security policy","plain_english":"The operator must have a Board approved information security policy.","rbi_paragraph":"Para 8","rbi_char_offset":6706,"weight":"DO IT","role":"Board","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p12","layer":"bankpulse"},{"n":6,"claim":"md12715-d8c23c3e","page_group":"Do it","stored_section":"KEY DATES","heading":"Review the policy yearly","plain_english":"That policy must be reviewed once a year.","rbi_paragraph":"Para 8","rbi_char_offset":6940,"weight":"DO IT","role":"Compliance","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p13","layer":"bankpulse"},{"n":7,"claim":"md12715-19c9100e","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"What the policy covers","plain_english":"The policy must set out roles and how cyber risk is found, judged and managed.","rbi_paragraph":"Para 8","rbi_char_offset":6979,"weight":"DO IT","role":"Compliance","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p14","layer":"bankpulse"},{"n":8,"claim":"md12715-c3ebdb86","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Write a crisis plan","plain_english":"The operator must have a separate Board approved cyber crisis management plan.","rbi_paragraph":"Para 9","rbi_char_offset":7404,"weight":"DO IT","role":"Board","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p15","layer":"bankpulse"},{"n":9,"claim":"md12715-af893e6b","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Set risk and performance measures","plain_english":"The operator must set risk indicators and performance measures for its controls.","rbi_paragraph":"Para 11","rbi_char_offset":8116,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p16","layer":"bankpulse"},{"n":10,"claim":"md12715-7173eb6b","page_group":"Do it","stored_section":"KEY DATES","heading":"Reports go to the committee","plain_english":"Audit and test reports must go to the oversight sub-committee at its next meeting.","rbi_paragraph":"Para 12","rbi_char_offset":8407,"weight":"DO IT","role":"Audit","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p17","layer":"bankpulse"},{"n":11,"claim":"md12715-7e3a8fa8","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Assess before a launch","plain_english":"The operator must assess cyber risk before a new product or a major change.","rbi_paragraph":"Para 13","rbi_char_offset":8626,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p18","layer":"bankpulse"},{"n":12,"claim":"md12715-eec85bbb","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Keep an asset record","plain_english":"The operator must record every key role, asset, process and outside provider.","rbi_paragraph":"Para 14","rbi_char_offset":9039,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p19","layer":"bankpulse"},{"n":13,"claim":"md12715-50819efb","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Draw the data flow","plain_english":"A full diagram of the network, its links and its data flows must be kept current.","rbi_paragraph":"Para 14","rbi_char_offset":9315,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p20","layer":"bankpulse"},{"n":14,"claim":"md12715-7b284c38","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"What the record holds","plain_english":"Each asset record must show its address, its place, its owner and its support end date.","rbi_paragraph":"Para 14","rbi_char_offset":9525,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p21","layer":"bankpulse"},{"n":15,"claim":"md12715-b45c6882","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Check kit nearing end","plain_english":"Any asset nearing the end of support must be assessed for the risk of running on.","rbi_paragraph":"Para 14","rbi_char_offset":9700,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p22","layer":"bankpulse"},{"n":16,"claim":"md12715-41ad6751","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"One identity per person","plain_english":"Everyone with access must be given a digital identity, watched until they leave.","rbi_paragraph":"Para 15","rbi_char_offset":10040,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p23","layer":"bankpulse"},{"n":17,"claim":"md12715-9ed10b8f","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Kill default settings","plain_english":"Default sign in settings must be switched off and changed before a system goes live.","rbi_paragraph":"Para 15","rbi_char_offset":10136,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p24","layer":"bankpulse"},{"n":18,"claim":"md12715-a8abbc20","page_group":"Do it","stored_section":"THE CORE IDEA","heading":"Least privilege access","plain_english":"Access must follow need to have, need to know and least privilege.","rbi_paragraph":"Para 15","rbi_char_offset":10365,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p25","layer":"bankpulse"},{"n":19,"claim":"md12715-ec72466d","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Privileged accounts need two factors","plain_english":"A privileged account needs more than one sign in factor and must be watched closely.","rbi_paragraph":"Para 15","rbi_char_offset":10460,"weight":"DO IT","role":"Branch","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p26","layer":"bankpulse"},{"n":20,"claim":"md12715-73b34f87","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Control removable media","plain_english":"Removable media and portable devices must be controlled from one central list.","rbi_paragraph":"Para 15","rbi_char_offset":10658,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p27","layer":"bankpulse"},{"n":21,"claim":"md12715-786be45a","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Close idle sessions","plain_english":"Sessions must be limited, locked and closed after a set time with no activity.","rbi_paragraph":"Para 15","rbi_char_offset":10978,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p28","layer":"bankpulse"},{"n":22,"claim":"md12715-c3937460","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Guard the physical site","plain_english":"Physical safeguards, tested from time to time, must protect assets from disaster.","rbi_paragraph":"Para 15","rbi_char_offset":11120,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p29","layer":"bankpulse"},{"n":23,"claim":"md12715-b9c21d98","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Check network devices","plain_english":"Network devices must be set up correctly and checked from time to time.","rbi_paragraph":"Para 16","rbi_char_offset":11408,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p30","layer":"bankpulse"},{"n":24,"claim":"md12715-5c9a670e","page_group":"Do it","stored_section":"WHO SHOULD ACT","heading":"Run a security centre","plain_english":"A security operations centre must watch network and system logs from one place.","rbi_paragraph":"Para 16","rbi_char_offset":11489,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p31","layer":"bankpulse"},{"n":25,"claim":"md12715-ad785cfe","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Tie the alerts together","plain_english":"An automatic system must tie alerts together across the business to spot an attack.","rbi_paragraph":"Para 16","rbi_char_offset":11729,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p32","layer":"bankpulse"},{"n":26,"claim":"md12715-80198c77","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Layer the boundary defence","plain_english":"Boundary defences must be layered to watch traffic in and out of the business.","rbi_paragraph":"Para 16","rbi_char_offset":12164,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p33","layer":"bankpulse"},{"n":27,"claim":"md12715-c8140531","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Split the network","plain_english":"The network must be split by role, place and environment to separate critical systems.","rbi_paragraph":"Para 16","rbi_char_offset":12420,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p34","layer":"bankpulse"},{"n":28,"claim":"md12715-5fab69e4","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Whitelist the applications","plain_english":"Only permitted applications and services may run, and ports should be whitelisted.","rbi_paragraph":"Para 16","rbi_char_offset":12590,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p35","layer":"bankpulse"},{"n":29,"claim":"md12715-ec8ebbd0","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Devices must qualify first","plain_english":"A device may join the network only after it meets the security rules set for it.","rbi_paragraph":"Para 16","rbi_char_offset":12798,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p36","layer":"bankpulse"},{"n":30,"claim":"md12715-bbe41ca8","page_group":"Do it","stored_section":"THE CORE IDEA","heading":"Secure by design","plain_english":"The operator must design and build its products securely from the start.","rbi_paragraph":"Para 17","rbi_char_offset":13024,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p37","layer":"bankpulse"},{"n":31,"claim":"md12715-dac9d3ce","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Separate the database layer","plain_english":"The database layer must sit apart from the other layers of the application.","rbi_paragraph":"Para 17","rbi_char_offset":13261,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p38","layer":"bankpulse"},{"n":32,"claim":"md12715-7ccd5116","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Get the source code","plain_english":"The operator must obtain the source code of every critical application it buys.","rbi_paragraph":"Para 17","rbi_char_offset":13524,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p39","layer":"bankpulse"},{"n":33,"claim":"md12715-41f456df","page_group":"Do it","stored_section":"KEY DATES","heading":"Test at least yearly","plain_english":"Every application must be tested by qualified people at least once a year.","rbi_paragraph":"Para 18","rbi_char_offset":13784,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p40","layer":"bankpulse"},{"n":34,"claim":"md12715-36341526","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Certificate from the developer","plain_english":"Where the code is not owned, the developer must certify it carries no known flaw.","rbi_paragraph":"Para 18","rbi_char_offset":14057,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p41","layer":"bankpulse"},{"n":35,"claim":"md12715-bb45777a","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Fix what testing finds","plain_english":"A weakness found in testing must be closed in a time bound way.","rbi_paragraph":"Para 18","rbi_char_offset":14289,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p42","layer":"bankpulse"},{"n":36,"claim":"md12715-65f3c808","page_group":"Do it","stored_section":"WHO SHOULD ACT","heading":"Report repeat findings","plain_english":"A finding that comes back must go to the Board sub-committee with an analysis.","rbi_paragraph":"Para 18","rbi_char_offset":14377,"weight":"DO IT","role":"Board","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p43","layer":"bankpulse"},{"n":37,"claim":"md12715-09d178a7","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Guard the vendor door","plain_english":"Controls must stop anyone getting into the network through a vendor system.","rbi_paragraph":"Para 19","rbi_char_offset":15020,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p44","layer":"bankpulse"},{"n":38,"claim":"md12715-39733237","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Where the data may sit","plain_english":"The operator must follow the law on where systems sit and where data is held.","rbi_paragraph":"Para 19","rbi_char_offset":15146,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p45","layer":"bankpulse"},{"n":39,"claim":"md12715-7a5ed743","page_group":"Do it","stored_section":"WHO SHOULD ACT","heading":"Independent vendor assurance","plain_english":"For a vendor in a critical process, an independent auditor must certify its strength.","rbi_paragraph":"Para 19","rbi_char_offset":15425,"weight":"DO IT","role":"Audit","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p46","layer":"bankpulse"},{"n":40,"claim":"md12715-60945db2","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Stop data leaks","plain_english":"The operator must have a full policy to stop the leak of business and customer data.","rbi_paragraph":"Para 20","rbi_char_offset":15559,"weight":"DO IT","role":"Compliance","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p47","layer":"bankpulse"},{"n":41,"claim":"md12715-b809f5b2","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Trace your data assets","plain_english":"The operator must be able to trace and see its data assets.","rbi_paragraph":"Para 20","rbi_char_offset":15916,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p48","layer":"bankpulse"},{"n":42,"claim":"md12715-8a61ad28","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Build a security system","plain_english":"An information security management system must be built on a recognised standard.","rbi_paragraph":"Para 20","rbi_char_offset":16010,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p49","layer":"bankpulse"},{"n":43,"claim":"md12715-c2d66d90","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Encrypt data both ways","plain_english":"Data must be encrypted while it moves and while it is stored.","rbi_paragraph":"Para 20","rbi_char_offset":16295,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p50","layer":"bankpulse"},{"n":44,"claim":"md12715-ce1c5ebc","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Card data needs PCI-DSS","plain_english":"An operator that stores card data must hold PCI-DSS certification.","rbi_paragraph":"Para 20","rbi_char_offset":16441,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p51","layer":"bankpulse"},{"n":45,"claim":"md12715-ef401488","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Have a patch policy","plain_english":"The operator must have a written policy for finding and applying patches.","rbi_paragraph":"Para 21","rbi_char_offset":16761,"weight":"DO IT","role":"Compliance","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p52","layer":"bankpulse"},{"n":46,"claim":"md12715-6ea5bb62","page_group":"Do it","stored_section":"KEY DATES","heading":"Critical patches go at once","plain_english":"A patch for a well known attack must be applied at once.","rbi_paragraph":"Para 21","rbi_char_offset":17035,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p53","layer":"bankpulse"},{"n":47,"claim":"md12715-7b6d9217","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Manage every change","plain_english":"Every change must go through a change process that keeps the whole set up sound.","rbi_paragraph":"Para 21","rbi_char_offset":17237,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p54","layer":"bankpulse"},{"n":48,"claim":"md12715-cbe3aea7","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Board approved response plan","plain_english":"The operator must have a Board approved plan for answering an incident.","rbi_paragraph":"Para 22","rbi_char_offset":17566,"weight":"DO IT","role":"Board","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p55","layer":"bankpulse"},{"n":49,"claim":"md12715-636584c5","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Find the root cause","plain_english":"After an incident the operator must work out its impact and its root cause.","rbi_paragraph":"Para 22","rbi_char_offset":18002,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p56","layer":"bankpulse"},{"n":50,"claim":"md12715-7dd29bb2","page_group":"Do it","stored_section":"WHO SHOULD ACT","heading":"Tell CERT-In as well","plain_english":"A cyber security incident must also be reported to CERT-In.","rbi_paragraph":"Para 22","rbi_char_offset":18513,"weight":"DO IT","role":"Compliance","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p57","layer":"bankpulse"},{"n":51,"claim":"md12715-981e45da","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Plan for the worst","plain_english":"A continuity plan must cover extreme but possible cyber events.","rbi_paragraph":"Para 23","rbi_char_offset":18619,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p58","layer":"bankpulse"},{"n":52,"claim":"md12715-02234371","page_group":"Do it","stored_section":"KEY DATES","heading":"Review the plan yearly","plain_english":"The continuity plan must be reviewed at least once a year.","rbi_paragraph":"Para 23","rbi_char_offset":18749,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p59","layer":"bankpulse"},{"n":53,"claim":"md12715-854dfdc0","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Aim for no data loss","plain_english":"The operator must aim for near zero data loss on recovery.","rbi_paragraph":"Para 23","rbi_char_offset":19185,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p60","layer":"bankpulse"},{"n":54,"claim":"md12715-3e98d363","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Recovery site, other zone","plain_english":"The recovery site must sit in a different earthquake zone from the main data centre.","rbi_paragraph":"Para 23","rbi_char_offset":19232,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p61","layer":"bankpulse"},{"n":55,"claim":"md12715-425c3baa","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Reconcile on switchover","plain_english":"A set method must reconcile data so nothing is lost when the recovery site takes over.","rbi_paragraph":"Para 23","rbi_char_offset":19343,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p62","layer":"bankpulse"},{"n":56,"claim":"md12715-486d75ed","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Follow API standards","plain_english":"The operator must follow recognised standards for interface security.","rbi_paragraph":"Para 24","rbi_char_offset":20203,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p63","layer":"bankpulse"},{"n":57,"claim":"md12715-51a696cd","page_group":"Do it","stored_section":"WHO SHOULD ACT","heading":"Train staff and vendors","plain_english":"The operator must train staff and vendors on information security again and again.","rbi_paragraph":"Para 25","rbi_char_offset":20332,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p64","layer":"bankpulse"},{"n":58,"claim":"md12715-c22b0629","page_group":"Do it","stored_section":"WHO SHOULD ACT","heading":"Train the Board too","plain_english":"Board members and senior staff must be trained on information security and cyber risk.","rbi_paragraph":"Para 25","rbi_char_offset":20715,"weight":"DO IT","role":"Board","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p65","layer":"bankpulse"},{"n":59,"claim":"md12715-77b47faa","page_group":"Do it","stored_section":"KEY DATES","heading":"Audit the cloud provider","plain_english":"The cloud provider must be audited by an independent party at least once a year.","rbi_paragraph":"Para 26","rbi_char_offset":21510,"weight":"DO IT","role":"Audit","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p66","layer":"bankpulse"},{"n":60,"claim":"md12715-7e7059ca","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Watch fraud in real time","plain_english":"The operator must run a fraud monitoring system that works in near real time.","rbi_paragraph":"Para 27","rbi_char_offset":22402,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p67","layer":"bankpulse"},{"n":61,"claim":"md12715-97af50b3","page_group":"Do it","stored_section":"WHO SHOULD ACT","heading":"Manned desk all year","plain_english":"A manned desk must run 24x7x365 to settle fraudulent payments customers report.","rbi_paragraph":"Para 27","rbi_char_offset":22552,"weight":"DO IT","role":"Compliance","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p68","layer":"bankpulse"},{"n":62,"claim":"md12715-dff7390e","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"What a log must show","plain_english":"A log must show who acted, what they did and with what settings.","rbi_paragraph":"Para 27","rbi_char_offset":22894,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p69","layer":"bankpulse"},{"n":63,"claim":"md12715-66056df9","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Design for the volume","plain_english":"The payment design must be strong and able to grow with the volume it carries.","rbi_paragraph":"Para 27","rbi_char_offset":23186,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p70","layer":"bankpulse"},{"n":64,"claim":"md12715-96b3d944","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Secure the mail","plain_english":"Mail and messaging going in and out of the operator must be secure.","rbi_paragraph":"Para 27","rbi_char_offset":23379,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p71","layer":"bankpulse"},{"n":65,"claim":"md12715-979e5621","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Buy anti phishing help","plain_english":"The operator must buy a service to take down fake sites and rogue apps.","rbi_paragraph":"Para 27","rbi_char_offset":23532,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p72","layer":"bankpulse"},{"n":66,"claim":"md12715-84df5cbe","page_group":"Do it","stored_section":"WHO SHOULD ACT","heading":"Warn the public","plain_english":"The operator must build public awareness of fraud and cyber threats.","rbi_paragraph":"Para 27","rbi_char_offset":23766,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p73","layer":"bankpulse"},{"n":67,"claim":"md12715-bd20ecec","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Mask numbers in alerts","plain_english":"Account and card numbers must be masked in an alert sent to a customer.","rbi_paragraph":"Para 29","rbi_char_offset":24865,"weight":"DO IT","role":"Branch","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p74","layer":"bankpulse"},{"n":68,"claim":"md12715-1fc43dda","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Name the merchant","plain_english":"An alert for an online payment must name the merchant, not the payment gateway.","rbi_paragraph":"Para 29","rbi_char_offset":24978,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p75","layer":"bankpulse"},{"n":69,"claim":"md12715-78b2d2ae","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Code at the end","plain_english":"Where a one time code is used, it must sit at the end of the message.","rbi_paragraph":"Para 29","rbi_char_offset":25320,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p76","layer":"bankpulse"},{"n":70,"claim":"md12715-185cebff","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Mark a payment fraud","plain_english":"The customer must be able to mark a payment as fraud and tell the issuer at once.","rbi_paragraph":"Para 30","rbi_char_offset":25469,"weight":"DO IT","role":"Branch","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p77","layer":"bankpulse"},{"n":71,"claim":"md12715-664e4b1a","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"No odd behaviour","plain_english":"The mobile application must be free of behaviour it was not built for.","rbi_paragraph":"Para 31","rbi_char_offset":26076,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p78","layer":"bankpulse"},{"n":72,"claim":"md12715-b57915e1","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Keep the session whole","plain_english":"A signed in session must stay whole. If it breaks, the session must be closed and the payments hit put right or reversed.","rbi_paragraph":"Para 31","rbi_char_offset":26240,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p79","layer":"bankpulse"},{"n":73,"claim":"md12715-a99f3ca6","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Bind app to device","plain_english":"The mobile application must be bound to the device and its SIM.","rbi_paragraph":"Para 31","rbi_char_offset":26551,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p80","layer":"bankpulse"},{"n":74,"claim":"md12715-dd69ede3","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Close idle mobile sessions","plain_english":"A mobile session must close on its own after a fixed idle time.","rbi_paragraph":"Para 31","rbi_char_offset":26802,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p81","layer":"bankpulse"},{"n":75,"claim":"md12715-16dcc4a6","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Cap failed sign ins","plain_english":"The operator must fix how many failed sign in tries will block the application.","rbi_paragraph":"Para 31","rbi_char_offset":26996,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p82","layer":"bankpulse"},{"n":76,"claim":"md12715-e727ded8","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Tell the customer at once","plain_english":"The customer must be told at once about a failed sign in try.","rbi_paragraph":"Para 31","rbi_char_offset":27215,"weight":"DO IT","role":"Branch","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p83","layer":"bankpulse"},{"n":77,"claim":"md12715-02b4fa37","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Block remote access apps","plain_english":"The application must be blocked while a remote access tool is running on the phone.","rbi_paragraph":"Para 31","rbi_char_offset":27313,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p84","layer":"bankpulse"},{"n":78,"claim":"md12715-880ae102","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Approved card terminals","plain_english":"Merchant terminals must be validated under the card industry programmes.","rbi_paragraph":"Para 32","rbi_char_offset":27771,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p85","layer":"bankpulse"},{"n":79,"claim":"md12715-57054636","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Limits at the switch","plain_english":"Card transaction limits must be set at the card network switch itself.","rbi_paragraph":"Para 33","rbi_char_offset":28088,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p86","layer":"bankpulse"},{"n":80,"claim":"md12715-32fd453c","page_group":"Do it","stored_section":"KEY DATES","heading":"Alert the issuer always","plain_english":"The card network must alert the card issuer about a suspicious event 24x7x365.","rbi_paragraph":"Para 33","rbi_char_offset":28307,"weight":"DO IT","role":"Compliance","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p87","layer":"bankpulse"},{"n":81,"claim":"md12715-8c941f92","page_group":"Do it","stored_section":"WHAT CHANGES","heading":"Encrypt stored card data","plain_english":"A card network must hold customer card details in encrypted form on every server.","rbi_paragraph":"Para 33","rbi_char_offset":28452,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p88","layer":"bankpulse"},{"n":82,"claim":"md12715-e40f5e55","page_group":"Do it","stored_section":"KEY DATES","heading":"Cooling period after loading","plain_english":"A prepaid issuer must set a cooling period after money is loaded on the instrument.","rbi_paragraph":"Para 35","rbi_char_offset":28910,"weight":"DO IT","role":"All staff","team":null,"products_covered":["digital-payment"],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p89","layer":"bankpulse"},{"n":1,"claim":"md12715-790fab92","page_group":"Background","stored_section":"THE CORE IDEA","heading":"Cyber rules for operators","plain_english":"This paper sets the cyber and payment security rules for non-bank payment system operators.","rbi_paragraph":"Para 2","rbi_char_offset":4959,"weight":"BACKGROUND","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p90","layer":"bankpulse"},{"n":2,"claim":"md12715-28e08b32","page_group":"Background","stored_section":"KEY DATES","heading":"Start date","plain_english":"These Directions took effect the day RBI placed them on its website.","rbi_paragraph":"Para 3","rbi_char_offset":5151,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p91","layer":"bankpulse"},{"n":3,"claim":"md12715-299b1c27","page_group":"Background","stored_section":"KEY DATES","heading":"Three phases by size","plain_english":"Large operators had to comply by 1 April 2025 and medium ones by 1 April 2026. Small operators have until 1 April 2028.","rbi_paragraph":"Para 3","rbi_char_offset":5409,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p92","layer":"bankpulse"},{"n":4,"claim":"md12715-f2a7a6fd","page_group":"Background","stored_section":"WHO IT APPLIES TO","heading":"Who is covered","plain_english":"These Directions apply to every authorised non-bank payment system operator.","rbi_paragraph":"Para 4","rbi_char_offset":5535,"weight":"BACKGROUND","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p93","layer":"bankpulse"},{"n":5,"claim":"md12715-54a68622","page_group":"Background","stored_section":"KEY DATES","heading":"Sub-committee each quarter","plain_english":"Oversight may pass to a Board sub-committee that meets at least once a quarter.","rbi_paragraph":"Para 7","rbi_char_offset":6513,"weight":"BACKGROUND","role":"Board","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p94","layer":"bankpulse"},{"n":6,"claim":"md12715-5cf6bf00","page_group":"Background","stored_section":"WHAT CHANGES","heading":"New certificate on change","plain_english":"A fresh certificate is needed whenever the source code changes.","rbi_paragraph":"Para 18","rbi_char_offset":14221,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p95","layer":"bankpulse"},{"n":7,"claim":"md12715-93c74ea0","page_group":"Background","stored_section":"WHAT CHANGES","heading":"Audit before you deploy","plain_english":"A new or changed critical service goes live only after an audit and a test.","rbi_paragraph":"Para 18","rbi_char_offset":14682,"weight":"BACKGROUND","role":"Audit","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p96","layer":"bankpulse"},{"n":8,"claim":"md12715-fc8feeec","page_group":"Background","stored_section":"WHAT CHANGES","heading":"Test before going live","plain_english":"A patch or a change goes live only after it is tested somewhere else first.","rbi_paragraph":"Para 21","rbi_char_offset":17374,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p97","layer":"bankpulse"},{"n":9,"claim":"md12715-b131555e","page_group":"Background","stored_section":"WHAT CHANGES","heading":"Alerts in your language","plain_english":"Prepaid issuers are urged to send codes and alerts in the language a user picks.","rbi_paragraph":"Para 34","rbi_char_offset":28723,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":["digital-payment"],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12715#p98","layer":"bankpulse"}],"actions":[],"amendments":[],"layers":{"rbi_source":"Facts taken from RBI's own document.","bankpulse":"BankPulse's plain-English summary of RBI's document.","bankpulse_inference":"BankPulse's own inference, not stated by RBI."},"rbi_wording_not_included":"By design. BankPulse never republishes RBI's exact sentences. Use rbi_paragraph with rbi_source.url to read RBI's own words.","terms":"BankPulse's plain-English summaries are BankPulse's own work. The underlying regulation is the Reserve Bank of India's. Always check the RBI document named in rbi_source before acting."}