{"what_this_is":"The machine-readable twin of the BankPulse page for one RBI rulebook. Same points, same dates, same paragraph references as the page a person reads. RBI's own wording is not reproduced here: each point names the RBI paragraph, the character offset into the text BankPulse read and the sha256 of that text, so the claim can be checked against RBI's own document.","schema_version":1,"release_id":"d653cdb0a5","generated_at":"2026-09-15T00:33:59.117975+00:00","id":"md13624","title":"Reserve Bank of India (Payments Banks – Digital Payment Security Controls) Directions, 2026","document_kind":"Directions","page":"https://bankpulse.ai/rule/md13624","status":"In force","importance":{"code":"MR","label":"MUST READ","weight":"Must read","why":"Binding RBI Directions naming this institution class in the title","layer":"bankpulse_inference"},"applies_to":{"shown":"Payments banks","class_code":"PB","from":"the document's own title","layer":"bankpulse_inference"},"dates":{"prid":"md13624","mode":"four_dates_v1","published":{"label":"Published","value":"Jul 31, 2026","stated":true,"why":"The day RBI put this document out."},"effective":{"label":"Starts to apply","value":"","stated":false,"why":"Not stated separately in this document. Read the rule itself before you assume a start date."},"transition":{"label":"Time to get ready","value":"","stated":false,"why":"Cannot be worked out until the day it starts to apply is known."},"deadline":{"label":"Last date to act","value":"","stated":false,"why":"No date to act by was found in this document. Other dates may sit inside single paragraphs."},"sources":{"published":"doc_date in data/highlights/md13624.json","effective":"none held","transition":"none held","deadline":"none held"}},"rbi_source":{"url":"https://rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=13624","document_date":"Jul 31, 2026","read_by_bankpulse":"2026-08-21 16:24:59 UTC","text_sha256":"0b52674dc18c81418ca1a73707b27f0d694d2a6f6f4b383d5ec4e011efa9f5a3","word_count":7454,"standing_last_checked":"Standing checked on RBI’s Master Directions index, 15 September 2026, 5:58 am IST."},"counts":{"points_shown":98,"points_naming_an_rbi_paragraph":98,"points_stored":98,"actions":0,"amendments":0},"points":[{"n":1,"claim":"md13624-fdb213b0","page_group":"Chapter I. Preliminary","stored_section":"THE CORE IDEA","heading":"Payment security, payments banks","plain_english":"This paper sets the digital payment security rules for payments banks.","rbi_paragraph":"Para 1","rbi_char_offset":3158,"weight":"BACKGROUND","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p1","layer":"bankpulse"},{"n":2,"claim":"md13624-0e747d72","page_group":"Chapter I. Preliminary","stored_section":"KEY DATES","heading":"Start date","plain_english":"These Directions took effect at once.","rbi_paragraph":"Para 2","rbi_char_offset":3313,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":"There is no gap here between issue and effect. The Directions come into effect immediately upon issuance. A bank cannot wait for a separate start date, because there is none.","anchor":"https://bankpulse.ai/rule/md13624#p2","layer":"bankpulse"},{"n":3,"claim":"md13624-b187d028","page_group":"Chapter I. Preliminary","stored_section":"WHO IT APPLIES TO","heading":"Who is covered","plain_english":"These Directions apply to every payments bank.","rbi_paragraph":"Para 3","rbi_char_offset":3383,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p3","layer":"bankpulse"},{"n":4,"claim":"md13624-618da674","page_group":"Chapter I. Preliminary","stored_section":"WHO IT APPLIES TO","heading":"What counts as payment","plain_english":"These rules cover every digital payment product the bank offers a customer.","rbi_paragraph":"Para 4","rbi_char_offset":3519,"weight":"BACKGROUND","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p4","layer":"bankpulse"},{"n":1,"claim":"md13624-81fb9a3b","page_group":"Chapter II. Role of the Board","stored_section":"WHO SHOULD ACT","heading":"Board approves the policy","plain_english":"The Board must approve the policy for digital payment products and services.","rbi_paragraph":"Para 7","rbi_char_offset":7700,"weight":"DO IT","role":"Board","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p5","layer":"bankpulse"},{"n":2,"claim":"md13624-70caf818","page_group":"Chapter II. Role of the Board","stored_section":"KEY DATES","heading":"Board reviews it yearly","plain_english":"Those policies must go back to the Board at least once a year.","rbi_paragraph":"Para 7","rbi_char_offset":7777,"weight":"DO IT","role":"Board","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p6","layer":"bankpulse"},{"n":1,"claim":"md13624-0029dd14","page_group":"Chapter III. General Controls","stored_section":"KEY DATES","heading":"Test backups half yearly","plain_english":"Backup data and applications must be tested at least once every six months.","rbi_paragraph":"Para 20","rbi_char_offset":16240,"weight":"MUST KNOW","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p7","layer":"bankpulse"},{"n":2,"claim":"md13624-a3382ab4","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Nothing sensitive in the page","plain_english":"A web application must not keep sensitive data in hidden fields or cookies.","rbi_paragraph":"Para 22","rbi_char_offset":16642,"weight":"MUST KNOW","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p8","layer":"bankpulse"},{"n":3,"claim":"md13624-4ae50a88","page_group":"Chapter III. General Controls","stored_section":"KEY DATES","heading":"Six months, then a year","plain_english":"A scan must be run at least every six months and an attack test at least once a year.","rbi_paragraph":"Para 32(1)","rbi_char_offset":20053,"weight":"MUST KNOW","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p9","layer":"bankpulse"},{"n":4,"claim":"md13624-fb05d9b3","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"No hidden bundling","plain_english":"A digital channel may be given only on the customer's clear wish, never bundled.","rbi_paragraph":"Para 62","rbi_char_offset":33767,"weight":"MUST KNOW","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p10","layer":"bankpulse"},{"n":5,"claim":"md13624-299750bb","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Write the product policy","plain_english":"The bank must write a digital payment policy and get its Board to approve it.","rbi_paragraph":"Para 8","rbi_char_offset":7931,"weight":"DO IT","role":"Board","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p11","layer":"bankpulse"},{"n":6,"claim":"md13624-0d2ef971","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Get an outside check","plain_english":"The bank must set out when an outside party must check the build and its security.","rbi_paragraph":"Para 11","rbi_char_offset":10297,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p12","layer":"bankpulse"},{"n":7,"claim":"md13624-3872b6f3","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Set a limit per product","plain_english":"The bank must set a limit for each product on the security risk it will accept.","rbi_paragraph":"Para 13","rbi_char_offset":11108,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p13","layer":"bankpulse"},{"n":8,"claim":"md13624-c14d764e","page_group":"Chapter III. General Controls","stored_section":"WHO SHOULD ACT","heading":"Trained staff for payments","plain_english":"The bank must have trained staff with the skill to run its payment systems.","rbi_paragraph":"Para 14","rbi_char_offset":12312,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p14","layer":"bankpulse"},{"n":9,"claim":"md13624-52455eb6","page_group":"Chapter III. General Controls","stored_section":"KEY DATES","heading":"Assess before you launch","plain_english":"The bank must assess the risk before a service starts and at set times after.","rbi_paragraph":"Para 15","rbi_char_offset":12605,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p15","layer":"bankpulse"},{"n":10,"claim":"md13624-20eaa6e3","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Cover the whole chain","plain_english":"The risk work must cover the wider chain and the safety of payment data.","rbi_paragraph":"Para 16","rbi_char_offset":13790,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p16","layer":"bankpulse"},{"n":11,"claim":"md13624-49cddec0","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"List systems holding data","plain_english":"The bank must list every system that holds customer data in the payment chain.","rbi_paragraph":"Para 16","rbi_char_offset":14250,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p17","layer":"bankpulse"},{"n":12,"claim":"md13624-fdcd40c8","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Weigh the platform risk","plain_english":"The bank must weigh the risk in the platforms and design it picks, at both ends.","rbi_paragraph":"Para 17","rbi_char_offset":14728,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p18","layer":"bankpulse"},{"n":13,"claim":"md13624-002e6a64","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Build internal controls","plain_english":"The bank must build internal controls and weigh operational risk before a launch.","rbi_paragraph":"Para 18","rbi_char_offset":15255,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p19","layer":"bankpulse"},{"n":14,"claim":"md13624-79f5b3d6","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Design for the volume","plain_english":"The payment design must be strong and able to grow with volume and customers.","rbi_paragraph":"Para 19","rbi_char_offset":15545,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p20","layer":"bankpulse"},{"n":15,"claim":"md13624-8e539ccf","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Use a secure protocol","plain_english":"The link used by a digital payment channel must follow a secure standard.","rbi_paragraph":"Para 21","rbi_char_offset":16345,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p21","layer":"bankpulse"},{"n":16,"claim":"md13624-2ce290ea","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Firewall and DDoS cover","plain_english":"The bank must run a web application firewall and steps to blunt a flood attack.","rbi_paragraph":"Para 23","rbi_char_offset":16842,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p22","layer":"bankpulse"},{"n":17,"claim":"md13624-b6116a50","page_group":"Chapter III. General Controls","stored_section":"KEY DATES","heading":"Renew certificates in time","plain_english":"The bank must renew the digital certificates used in its payment systems in time.","rbi_paragraph":"Para 25","rbi_char_offset":17635,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p23","layer":"bankpulse"},{"n":18,"claim":"md13624-c1311e06","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Log what users do","plain_english":"The mobile and net banking applications must log user activity and odd behaviour.","rbi_paragraph":"Para 26","rbi_char_offset":17843,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p24","layer":"bankpulse"},{"n":19,"claim":"md13624-ad6050bc","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Split the application layers","plain_english":"The application, the database and the screen must sit in separate layers.","rbi_paragraph":"Para 27","rbi_char_offset":18041,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p25","layer":"bankpulse"},{"n":20,"claim":"md13624-21818c5b","page_group":"Chapter III. General Controls","stored_section":"THE CORE IDEA","heading":"Secure by design","plain_english":"The bank must build security into a payment product from the design stage.","rbi_paragraph":"Para 28","rbi_char_offset":18210,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p26","layer":"bankpulse"},{"n":21,"claim":"md13624-5b3013aa","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Set security aims early","plain_english":"Security aims must be set at each stage, from gathering needs to shutting down.","rbi_paragraph":"Para 29","rbi_char_offset":18468,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p27","layer":"bankpulse"},{"n":22,"claim":"md13624-39fc396e","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Model the threats","plain_english":"The bank must use threat modelling through the whole life of an application.","rbi_paragraph":"Para 30","rbi_char_offset":18892,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p28","layer":"bankpulse"},{"n":23,"claim":"md13624-2054e8f4","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Escrow the vendor code","plain_english":"For software licensed from a vendor, the bank must place the source code in escrow.","rbi_paragraph":"Para 31","rbi_char_offset":19126,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p29","layer":"bankpulse"},{"n":24,"claim":"md13624-91cc1e86","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Test the code itself","plain_english":"The bank must review source code and run scans and attack tests on its applications.","rbi_paragraph":"Para 32","rbi_char_offset":19311,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p30","layer":"bankpulse"},{"n":25,"claim":"md13624-b4d20660","page_group":"Chapter III. General Controls","stored_section":"KEY DATES","heading":"Code review each year","plain_english":"A source code review or a certificate must be repeated each year if the code changed.","rbi_paragraph":"Para 32(2)","rbi_char_offset":20356,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p31","layer":"bankpulse"},{"n":26,"claim":"md13624-bc927817","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Penalty in the contract","plain_english":"The vendor contract must carry a penalty clause if the application provider fails.","rbi_paragraph":"Para 32(4)","rbi_char_offset":20834,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p32","layer":"bankpulse"},{"n":27,"claim":"md13624-347b462c","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Scan with full rights","plain_english":"A scan must be run with sign in rights, by a local agent or a scanner with admin rights.","rbi_paragraph":"Para 35","rbi_char_offset":21566,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p33","layer":"bankpulse"},{"n":28,"claim":"md13624-2071a181","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Test before it goes live","plain_english":"The bank must test both the working and the security controls before a launch.","rbi_paragraph":"Para 36","rbi_char_offset":21831,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p34","layer":"bankpulse"},{"n":29,"claim":"md13624-0100975a","page_group":"Chapter III. General Controls","stored_section":"WHO SHOULD ACT","heading":"Hunt for fake apps","plain_english":"The bank must watch app stores for fake copies of its application and take them down.","rbi_paragraph":"Para 37","rbi_char_offset":22094,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p35","layer":"bankpulse"},{"n":30,"claim":"md13624-e3c9ae3d","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Server blocks fake apps","plain_english":"The bank server must refuse a payment sent from an application that is not genuine.","rbi_paragraph":"Para 38","rbi_char_offset":22317,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p36","layer":"bankpulse"},{"n":31,"claim":"md13624-d72d9850","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Mask numbers in messages","plain_english":"Account and card numbers must be masked when sent by text message or by email.","rbi_paragraph":"Para 40","rbi_char_offset":23614,"weight":"DO IT","role":"Branch","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p37","layer":"bankpulse"},{"n":32,"claim":"md13624-1480ad57","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"One factor must change","plain_english":"At least one of those factors must change each time or be impossible to copy.","rbi_paragraph":"Para 41","rbi_char_offset":24087,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p38","layer":"bankpulse"},{"n":33,"claim":"md13624-5e136dbe","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Design the sign in well","plain_english":"The sign in method must deter fraud, resist attack and guard payment data.","rbi_paragraph":"Para 42","rbi_char_offset":24521,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p39","layer":"bankpulse"},{"n":34,"claim":"md13624-3ed7f29d","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Match method to risk","plain_english":"The sign in method must match the risk of the customer, the payment and the amount.","rbi_paragraph":"Para 44","rbi_char_offset":25117,"weight":"DO IT","role":"Branch","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p40","layer":"bankpulse"},{"n":35,"claim":"md13624-c8461323","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Name the merchant","plain_english":"The alert and the one time code must name the merchant, not the payment agent.","rbi_paragraph":"Para 47","rbi_char_offset":26282,"weight":"DO IT","role":"All staff","team":null,"products_covered":["digital-payment"],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p41","layer":"bankpulse"},{"n":36,"claim":"md13624-e39c84cc","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Stop the middleman attack","plain_english":"The bank must take steps to blunt a man in the middle attack on a payment.","rbi_paragraph":"Para 48","rbi_char_offset":26584,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p42","layer":"bankpulse"},{"n":37,"claim":"md13624-b6fd0baf","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Keep the session whole","plain_english":"A signed in session must stay whole. If it breaks, the session must be closed and the payments hit put right or reversed.","rbi_paragraph":"Para 49","rbi_char_offset":26951,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p43","layer":"bankpulse"},{"n":38,"claim":"md13624-6c164cf5","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Cap the failed tries","plain_english":"The bank must fix how many failed sign in tries will block the service.","rbi_paragraph":"Para 50","rbi_char_offset":27405,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p44","layer":"bankpulse"},{"n":39,"claim":"md13624-ea9e04cc","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Safe way to unblock","plain_english":"The bank must have a safe way to unblock a service and must tell the customer.","rbi_paragraph":"Para 51","rbi_char_offset":27567,"weight":"DO IT","role":"Branch","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p45","layer":"bankpulse"},{"n":40,"claim":"md13624-43547007","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Rules to spot fraud","plain_english":"The bank must write down the rules that flag a suspect payment and act on them.","rbi_paragraph":"Para 52","rbi_char_offset":27779,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p46","layer":"bankpulse"},{"n":41,"claim":"md13624-7f03b027","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Watch the alert settings","plain_english":"The bank must set and watch alert settings such as speed, place and merchant type.","rbi_paragraph":"Para 53","rbi_char_offset":28064,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p47","layer":"bankpulse"},{"n":42,"claim":"md13624-b334d1c9","page_group":"Chapter III. General Controls","stored_section":"WHO SHOULD ACT","heading":"Study each fraud","plain_english":"The bank must study why a fraud happened and how to stop the next one.","rbi_paragraph":"Para 54","rbi_char_offset":29147,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p48","layer":"bankpulse"},{"n":43,"claim":"md13624-2be3b4e1","page_group":"Chapter III. General Controls","stored_section":"WHO SHOULD ACT","heading":"Train the fraud team","plain_english":"Staff in the fraud control team must be trained in tools, inquiry and card rules.","rbi_paragraph":"Para 55","rbi_char_offset":29281,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p49","layer":"bankpulse"},{"n":44,"claim":"md13624-169f247b","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Keep contacts current","plain_english":"The bank must keep current contact details for use during an incident.","rbi_paragraph":"Para 56","rbi_char_offset":30043,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p50","layer":"bankpulse"},{"n":45,"claim":"md13624-ca32a137","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Safe use guide inside","plain_english":"Safe use guidance must sit inside the application and the customer must read it.","rbi_paragraph":"Para 58","rbi_char_offset":31205,"weight":"DO IT","role":"Branch","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p51","layer":"bankpulse"},{"n":46,"claim":"md13624-1e96a6f1","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Complaint page in the app","plain_english":"The application must carry a clear section on how to raise a complaint.","rbi_paragraph":"Para 59","rbi_char_offset":31781,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p52","layer":"bankpulse"},{"n":47,"claim":"md13624-9cc4a63b","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Online dispute resolution","plain_english":"The bank must run an online system to settle digital payment disputes.","rbi_paragraph":"Para 60","rbi_char_offset":32491,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p53","layer":"bankpulse"},{"n":48,"claim":"md13624-ec084ed2","page_group":"Chapter III. General Controls","stored_section":"WHO SHOULD ACT","heading":"Teach device safety","plain_english":"The bank must teach customers to keep their own devices updated and clean.","rbi_paragraph":"Para 61","rbi_char_offset":32648,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p54","layer":"bankpulse"},{"n":49,"claim":"md13624-7311220e","page_group":"Chapter III. General Controls","stored_section":"WHO SHOULD ACT","heading":"Tell the risk first","plain_english":"A customer must be told the risk, the gain and the liability before subscribing.","rbi_paragraph":"Para 62","rbi_char_offset":33060,"weight":"DO IT","role":"Branch","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p55","layer":"bankpulse"},{"n":50,"claim":"md13624-5757c0f3","page_group":"Chapter III. General Controls","stored_section":"WHO SHOULD ACT","heading":"Explain new features","plain_english":"The bank must explain a new security feature clearly when it adds one.","rbi_paragraph":"Para 63","rbi_char_offset":33826,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p56","layer":"bankpulse"},{"n":51,"claim":"md13624-f950ccb0","page_group":"Chapter III. General Controls","stored_section":"WHO SHOULD ACT","heading":"Warn about phishing","plain_english":"The bank must warn customers about phishing, vishing and remote access tricks.","rbi_paragraph":"Para 64","rbi_char_offset":34325,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p57","layer":"bankpulse"},{"n":52,"claim":"md13624-f153de1c","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Mark a payment fraud","plain_english":"The application must let a customer mark a payment as fraud and tell the bank at once.","rbi_paragraph":"Para 66","rbi_char_offset":34980,"weight":"DO IT","role":"Branch","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p58","layer":"bankpulse"},{"n":53,"claim":"md13624-e487aac7","page_group":"Chapter III. General Controls","stored_section":"WHO SHOULD ACT","heading":"Board owns the rollout","plain_english":"The Board and senior staff answer for putting this policy into practice.","rbi_paragraph":"Para 9","rbi_char_offset":9435,"weight":"BACKGROUND","role":"Board","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p59","layer":"bankpulse"},{"n":54,"claim":"md13624-30b175e0","page_group":"Chapter III. General Controls","stored_section":"KEY DATES","heading":"Test again after a change","plain_english":"A scan and an attack test are also needed when new systems or big changes come in.","rbi_paragraph":"Para 32(1)","rbi_char_offset":20166,"weight":"BACKGROUND","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p60","layer":"bankpulse"},{"n":55,"claim":"md13624-34d3f99d","page_group":"Chapter III. General Controls","stored_section":"THE CORE IDEA","heading":"Two factors for payment","plain_english":"A digital payment or a cash withdrawal needs more than one factor to sign in.","rbi_paragraph":"Para 41","rbi_char_offset":23886,"weight":"BACKGROUND","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p61","layer":"bankpulse"},{"n":56,"claim":"md13624-e59ad927","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Alert on every change","plain_english":"Alerts are needed for every payment, every new payee and every change in a limit.","rbi_paragraph":"Para 46","rbi_char_offset":25812,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p62","layer":"bankpulse"},{"n":57,"claim":"md13624-2047a40a","page_group":"Chapter III. General Controls","stored_section":"WHAT CHANGES","heading":"Only on written request","plain_english":"A digital payment service may start only on the customer's own written request.","rbi_paragraph":"Para 65","rbi_char_offset":34622,"weight":"BACKGROUND","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p63","layer":"bankpulse"},{"n":1,"claim":"md13624-871aaced","page_group":"Chapter IV. Internet Banking Security Controls","stored_section":"WHAT CHANGES","heading":"Guard the name system","plain_english":"The bank must guard against DNS cache poisoning and handle cookies safely.","rbi_paragraph":"Para 67(2)","rbi_char_offset":36069,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p64","layer":"bankpulse"},{"n":2,"claim":"md13624-6f4f07eb","page_group":"Chapter IV. Internet Banking Security Controls","stored_section":"WHAT CHANGES","heading":"Give a virtual keyboard","plain_english":"A virtual keyboard must be offered on the net banking site.","rbi_paragraph":"Para 67(3)","rbi_char_offset":36166,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p65","layer":"bankpulse"},{"n":3,"claim":"md13624-afbb7cbe","page_group":"Chapter IV. Internet Banking Security Controls","stored_section":"WHAT CHANGES","heading":"Close idle sessions","plain_english":"An online session must close on its own after a fixed idle time.","rbi_paragraph":"Para 67(4)","rbi_char_offset":36221,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p66","layer":"bankpulse"},{"n":4,"claim":"md13624-3d07214f","page_group":"Chapter IV. Internet Banking Security Controls","stored_section":"WHAT CHANGES","heading":"Change the first password","plain_english":"A password sent by the bank must expire, and it must be changed at first sign in.","rbi_paragraph":"Para 67(5)","rbi_char_offset":36322,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p67","layer":"bankpulse"},{"n":5,"claim":"md13624-9565e3bb","page_group":"Chapter IV. Internet Banking Security Controls","stored_section":"WHAT CHANGES","heading":"Extra check on the website","plain_english":"Net banking sites need extra checks such as adaptive sign in and a strong CAPTCHA.","rbi_paragraph":"Para 67(1)","rbi_char_offset":35773,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":["digital-payment"],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p68","layer":"bankpulse"},{"n":1,"claim":"md13624-dd824a24","page_group":"Chapter V. Mobile Payments Application Security Controls","stored_section":"KEY DATES","heading":"Six months for old versions","plain_english":"An older version of the application must be switched off within six months.","rbi_paragraph":"Para 68(2)","rbi_char_offset":38090,"weight":"MUST KNOW","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p69","layer":"bankpulse"},{"n":2,"claim":"md13624-21e8495b","page_group":"Chapter V. Mobile Payments Application Security Controls","stored_section":"WHAT CHANGES","heading":"Reinstall on an error","plain_english":"If the application behaves oddly, the customer must be told to install a fresh copy.","rbi_paragraph":"Para 68(1)","rbi_char_offset":37320,"weight":"DO IT","role":"Branch","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p70","layer":"bankpulse"},{"n":3,"claim":"md13624-1e45b56f","page_group":"Chapter V. Mobile Payments Application Security Controls","stored_section":"WHAT CHANGES","heading":"Publish the checksum","plain_english":"The bank must publish a checksum so a customer can tell the real application from a fake.","rbi_paragraph":"Para 68(5)","rbi_char_offset":39664,"weight":"DO IT","role":"Branch","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p71","layer":"bankpulse"},{"n":4,"claim":"md13624-cfa4a511","page_group":"Chapter V. Mobile Payments Application Security Controls","stored_section":"WHAT CHANGES","heading":"Bind app to device","plain_english":"The application must be bound to the device by hardware, software and service data.","rbi_paragraph":"Para 68(6)","rbi_char_offset":40287,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p72","layer":"bankpulse"},{"n":5,"claim":"md13624-86f10104","page_group":"Chapter V. Mobile Payments Application Security Controls","stored_section":"WHAT CHANGES","heading":"Tell on new device","plain_english":"The customer must be told on more than one channel when a new device is registered.","rbi_paragraph":"Para 68(6)","rbi_char_offset":40522,"weight":"DO IT","role":"Branch","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p73","layer":"bankpulse"},{"n":6,"claim":"md13624-d3b357b6","page_group":"Chapter V. Mobile Payments Application Security Controls","stored_section":"WHAT CHANGES","heading":"Sign in again","plain_english":"The application must ask for a fresh sign in after idle time and on each launch.","rbi_paragraph":"Para 68(8)","rbi_char_offset":40935,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p74","layer":"bankpulse"},{"n":7,"claim":"md13624-14b9d869","page_group":"Chapter V. Mobile Payments Application Security Controls","stored_section":"WHAT CHANGES","heading":"Spot the unsafe network","plain_english":"The application must spot an unsafe network such as open wireless and add checks.","rbi_paragraph":"Para 68(9)","rbi_char_offset":41145,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p75","layer":"bankpulse"},{"n":8,"claim":"md13624-c0d5d047","page_group":"Chapter V. Mobile Payments Application Security Controls","stored_section":"WHAT CHANGES","heading":"Guard the temporary files","plain_english":"The application must limit what it writes to temporary files and must protect it.","rbi_paragraph":"Para 68(11)","rbi_char_offset":41764,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p76","layer":"bankpulse"},{"n":9,"claim":"md13624-b6b6a130","page_group":"Chapter V. Mobile Payments Application Security Controls","stored_section":"WHAT CHANGES","heading":"No raw database queries","plain_english":"The application must avoid raw database queries and guard against injection attacks.","rbi_paragraph":"Para 68(13)","rbi_char_offset":42065,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p77","layer":"bankpulse"},{"n":10,"claim":"md13624-e799ac8f","page_group":"Chapter V. Mobile Payments Application Security Controls","stored_section":"WHAT CHANGES","heading":"Check the device first","plain_english":"The application may run only if the device meets the security checks the bank set.","rbi_paragraph":"Para 68(2)","rbi_char_offset":37696,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p78","layer":"bankpulse"},{"n":11,"claim":"md13624-46dfa611","page_group":"Chapter V. Mobile Payments Application Security Controls","stored_section":"WHAT CHANGES","heading":"Block a rooted phone","plain_english":"The bank may check whether a phone is rooted and refuse to install on it.","rbi_paragraph":"Para 68(4)","rbi_char_offset":39467,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p79","layer":"bankpulse"},{"n":1,"claim":"md13624-85d8bce7","page_group":"Chapter VI. Card Payment Security Controls","stored_section":"WHAT CHANGES","heading":"Never store cards plainly","plain_english":"Card details must never be kept as plain text at the bank or at a vendor.","rbi_paragraph":"Para 69(7)","rbi_char_offset":48883,"weight":"MUST KNOW","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p80","layer":"bankpulse"},{"n":2,"claim":"md13624-f186122b","page_group":"Chapter VI. Card Payment Security Controls","stored_section":"WHAT CHANGES","heading":"No remote card scanning","plain_english":"Card data scanning must be done on the bank's own devices and never from outside.","rbi_paragraph":"Para 69(8)","rbi_char_offset":49669,"weight":"MUST KNOW","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p81","layer":"bankpulse"},{"n":3,"claim":"md13624-6ade61e2","page_group":"Chapter VI. Card Payment Security Controls","stored_section":"WHAT CHANGES","heading":"Follow the card standards","plain_english":"The bank must follow the card industry standards for PINs, terminals and modules.","rbi_paragraph":"Para 69(1)","rbi_char_offset":43150,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p82","layer":"bankpulse"},{"n":4,"claim":"md13624-9e718554","page_group":"Chapter VI. Card Payment Security Controls","stored_section":"WHO SHOULD ACT","heading":"Report to the IT committee","plain_english":"A status report on these card standards must go to the IT Strategy Committee.","rbi_paragraph":"Para 69(1)","rbi_char_offset":44815,"weight":"DO IT","role":"Compliance","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p83","layer":"bankpulse"},{"n":5,"claim":"md13624-5ab8c5b4","page_group":"Chapter VI. Card Payment Security Controls","stored_section":"WHAT CHANGES","heading":"Approved terminals only","plain_english":"Merchant terminals must be validated under the card industry programmes.","rbi_paragraph":"Para 69(3)","rbi_char_offset":45133,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p84","layer":"bankpulse"},{"n":6,"claim":"md13624-b11eb8ea","page_group":"Chapter VI. Card Payment Security Controls","stored_section":"WHAT CHANGES","heading":"Secure the acquiring side","plain_english":"As an acquirer, the bank must secure the card payment kit it puts in the field.","rbi_paragraph":"Para 69(4)","rbi_char_offset":45912,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p85","layer":"bankpulse"},{"n":7,"claim":"md13624-509ce35f","page_group":"Chapter VI. Card Payment Security Controls","stored_section":"WHAT CHANGES","heading":"Tamper proof security logs","plain_english":"The hardware security module must log its work and those logs must resist tampering.","rbi_paragraph":"Para 69(5)","rbi_char_offset":46160,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p86","layer":"bankpulse"},{"n":8,"claim":"md13624-fc8d9e54","page_group":"Chapter VI. Card Payment Security Controls","stored_section":"WHAT CHANGES","heading":"No single point of failure","plain_english":"The bank must cluster the hardware security module and keep safe backups.","rbi_paragraph":"Para 69(5)","rbi_char_offset":46258,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p87","layer":"bankpulse"},{"n":9,"claim":"md13624-cc04dbd6","page_group":"Chapter VI. Card Payment Security Controls","stored_section":"WHAT CHANGES","heading":"PIN made at the module","plain_english":"A card PIN must be made and printed at a system joined to the security module.","rbi_paragraph":"Para 69(5)","rbi_char_offset":46795,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p88","layer":"bankpulse"},{"n":10,"claim":"md13624-a0fb4b65","page_group":"Chapter VI. Card Payment Security Controls","stored_section":"WHAT CHANGES","heading":"Anti skimming on ATMs","plain_english":"The bank must fit anti skimming and whitelisting on its ATMs.","rbi_paragraph":"Para 69(6)","rbi_char_offset":47648,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p89","layer":"bankpulse"},{"n":11,"claim":"md13624-87d4b0c0","page_group":"Chapter VI. Card Payment Security Controls","stored_section":"WHAT CHANGES","heading":"Watch card transactions","plain_english":"The bank must watch card use closely, above all cash taken out abroad.","rbi_paragraph":"Para 69(7)","rbi_char_offset":47829,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p90","layer":"bankpulse"},{"n":12,"claim":"md13624-d32697d6","page_group":"Chapter VI. Card Payment Security Controls","stored_section":"WHAT CHANGES","heading":"Limits at the switch","plain_english":"Card transaction limits must be set at the card network switch itself.","rbi_paragraph":"Para 69(7)","rbi_char_offset":48061,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p91","layer":"bankpulse"},{"n":13,"claim":"md13624-3ba4f060","page_group":"Chapter VI. Card Payment Security Controls","stored_section":"KEY DATES","heading":"Watch limits round the clock","plain_english":"A breach of those limits must be watched 24x7, on weekends and holidays too.","rbi_paragraph":"Para 69(7)","rbi_char_offset":48637,"weight":"DO IT","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p92","layer":"bankpulse"},{"n":14,"claim":"md13624-28fe2219","page_group":"Chapter VI. Card Payment Security Controls","stored_section":"WHAT CHANGES","heading":"Test the scanning tool","plain_english":"A card data scanning tool must first be tried in a test setting.","rbi_paragraph":"Para 69(8)","rbi_char_offset":49417,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p93","layer":"bankpulse"},{"n":15,"claim":"md13624-f6bf1834","page_group":"Chapter VI. Card Payment Security Controls","stored_section":"WHO IT APPLIES TO","heading":"Issuer and acquirer both","plain_english":"These standards bind the bank both as the card issuer and as the acquirer.","rbi_paragraph":"Para 69(1)","rbi_char_offset":44511,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p94","layer":"bankpulse"},{"n":16,"claim":"md13624-b76bd363","page_group":"Chapter VI. Card Payment Security Controls","stored_section":"WHAT CHANGES","heading":"Harden every ATM","plain_english":"Every ATM needs a BIOS password, dead USB ports and the latest patches.","rbi_paragraph":"Para 69(6)","rbi_char_offset":47368,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p95","layer":"bankpulse"},{"n":1,"claim":"md13624-8af92755","page_group":"Chapter VII. Repeal and Other Provisions","stored_section":"WHAT IT REPLACES","heading":"Old payment rules go","plain_english":"These Directions repeal the earlier digital payment security instructions.","rbi_paragraph":"Para 70","rbi_char_offset":50229,"weight":"BACKGROUND","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md13624#p96","layer":"bankpulse"},{"n":2,"claim":"md13624-ed77acc3","page_group":"Chapter VII. Repeal and Other Provisions","stored_section":"WHAT IT REPLACES","heading":"Other laws still apply","plain_english":"These Directions add to other laws and rules and do not replace them.","rbi_paragraph":"Para 72","rbi_char_offset":51655,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":"A bank follows these Directions and thinks the matter is closed. It is not. Any other laws, rules, regulations or directions in force still apply on top. Where another one asks for more, the bank does the more.","anchor":"https://bankpulse.ai/rule/md13624#p97","layer":"bankpulse"},{"n":3,"claim":"md13624-a449e126","page_group":"Chapter VII. Repeal and Other Provisions","stored_section":"THE CORE IDEA","heading":"RBI has the last word","plain_english":"RBI may issue clarifications, and its reading of these Directions is final.","rbi_paragraph":"Para 73","rbi_char_offset":52102,"weight":"BACKGROUND","role":"All staff","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":"Two banks read the same clause differently. Neither reading settles it. RBI may issue clarifications, and its interpretation of any provision is final and binding on all concerned entities.","anchor":"https://bankpulse.ai/rule/md13624#p98","layer":"bankpulse"}],"actions":[],"amendments":[],"layers":{"rbi_source":"Facts taken from RBI's own document.","bankpulse":"BankPulse's plain-English summary of RBI's document.","bankpulse_inference":"BankPulse's own inference, not stated by RBI."},"rbi_wording_not_included":"By design. BankPulse never republishes RBI's exact sentences. Use rbi_paragraph with rbi_source.url to read RBI's own words.","terms":"BankPulse's plain-English summaries are BankPulse's own work. The underlying regulation is the Reserve Bank of India's. Always check the RBI document named in rbi_source before acting."}