Vendor Risk Assessment for Payment Bank as per RBI: Six-Hour Incident Reporting & Compliance Guide

Payment banks use a unique financial setup. Unlike regular commercial banks, they focus on handling many small transactions, which means they need to scale quickly in real time. To keep up, payments banks depend heavily on a network of outside partners, including vendors for payment gateways, cloud services, core banking software, AI-based fraud detection, and digital KYC onboarding.

But this connected setup also increases the risk of cyberattacks. The Reserve Bank of India (RBI) has responded by setting strict rules under the Master Direction on Outsourcing of IT Services and the IT Governance, Risk, Controls and Assurance Practices Framework. For payments banks, managing third-party risk is now a daily, active process instead of just a yearly formality.

One of the most urgent RBI security rules is the 6-hour window for reporting cyber incidents. If there is a security breach or disruption, the clock starts right away and every minute counts.

1. The Reporting Timeline: Regulated Entities (REs), including payments banks, must report any material cybersecurity incident to the RBI’s Centralized Information Management System (CIMS) portal or the CSITE cell

   within 6 hours of detection. Crucially, this mandate applies even if the breach originates within the perimeter of an external vendor's systems rather than the bank’s own data center.

2. Bridging the Vendor Communication Gap: Many banks miss this deadline because vendors delay or downplay early warnings. Payment banks should establish clear escalation steps in their Service Level Agreements (SLAs) to ensure the reporting clock starts as soon as a vendor identifies an issue.

3. Root Cause Analysis (RCA) Submission: Sending the first alert is just the start. After that, the bank must conduct a detailed investigation and submit a full Root Cause Analysis (RCA) report within 21 days.

Regulatory Penalty Notice: Non-compliance or delayed reporting under these guidelines exposes the institution to severe monetary penalties under the Banking Regulation Act, 1949, and can directly impact regulatory approvals for scaling operations.

To create a strong and reviewable risk system, payments banks should organize their vendor risk management around five key areas:

1. Board-Level Oversight & Strategic Governance

The ultimate accountability for vendor risk remains with the payments bank's Board of Directors and Senior Management; it cannot be outsourced. The bank must enforce a Board-approved outsourcing policy that is subject to annual reviews. Furthermore, the IT Strategy Committee and IT Steering Committee must actively monitor concentration risks (avoiding over-reliance on a single vendor) and assess systemic exposure across the entire supply chain.

2. Risk-Based Vendor Due Diligence

Before bringing on any third-party vendor, banks should carry out a full technical and operational check that looks at:

• Financial Viability: Assessing the vendor’s long-term financial health to ensure business continuity during adverse market conditions.

• Information Security Posture: Verifying independent security certifications, including ISO/IEC 27001, SOC 2 Type II, and specialized financial data protection standards.

• Disaster Recovery (DR) Readiness: Validating that the vendor possesses testing-proven Business Continuity Plans (BCP) capable of meeting the bank's strict Recovery Time Objectives (RTO).

3. Data Localization & Cryptographic Controls

To comply with RBI’s data localization rules, all key financial data, transaction logs, and customer personal information must be stored securely only in India. Also:

• Data at Rest: All data on vendor servers, databases, and backups must be protected with strong encryption, such as AES-256.

• Data in Transit: All communication channels, web services, and API connections between the bank and vendors must use TLS 1.2 or higher.

• Proper data masking and tokenization should be used at both the display and application levels to stop Personally Identifiable Information (PII) from leaking into system logs.

4. Sub-Contracting Controls (Fourth-Party Risk Management)

A significant vulnerability in supply chain security is unauthorized subcontracting, in which a primary vendor (Tier-1) routes tasks to downstream sub-processors (Tier-2 or Tier-3) without the bank's knowledge. To mitigate this:

• Contracts must include explicit clauses requiring the bank's prior written approval before any subcontracting occurs.

• The bank must maintain continuous visibility over the entire supply chain architecture to prevent hidden compliance vulnerabilities.

5. Continuous Integration with a 24/7 C-SOC

Payments banks must integrate their vendors' critical infrastructure logs with their own Cyber Security Operations Center (C-SOC). Deploying a real-time SIEM (Security Information and Event Management) system to monitor application logs, external API calls, and network anomalies is crucial. Without continuous automated monitoring, detecting, isolating, and reporting an incident within the mandatory 6-hour window is virtually impossible.

To ensure seamless alignment with the RBI's operational mandates, payments banks should operationalize the following structured cadence:

Managing an extensive vendor ecosystem through fragmented legacy systems and manual tracking increases compliance risks. KavachOne provides a sophisticated, enterprise-grade Governance, Risk, and Compliance (GRC) platform specifically engineered to streamline the third-party risk lifecycle for financial institutions:

• Automated Vendor Due Diligence & Risk Scoring: Make your onboarding process consistent. KavachOne checks vendor security controls, tracks certifications, and calculates risk scores that match RBI standards.

• Real-Time Incident Response and Escalation Engine: Mitigate the risk of missing the 6-hour deadline. Our platform integrates directly with your security perimeter to trigger automated internal alerts, launch containment playbooks, and pre-populate RBI incident reporting templates the moment an anomaly is detected.

• Granular Fourth-Party Visibility Mapping: Remove blind spots in your supply chain. KavachOne creates a live visual map of your main vendors and their approved sub-contractors, so you have full compliance oversight.

• Audit-Ready Documentation Repository: Make regulatory inspections easier. KavachOne acts as a single source of truth, safely storing policy acknowledgments, VAPT certificates, data localization checks, and board reports for quick access during RBI audits.

Keep your operations safe, reduce compliance hassles, and grow your fintech setup with confidence.

Contact KavachOne's Enterprise Risk Experts today to schedule a comprehensive assessment of your Vendor Risk Management framework.