**Policy Summary: RBI Directive on Storage of Payment System Data**
This Reserve Bank of India (RBI) directive, reference DPSS.CO.OD No. 2785/06.08.005/2017-2018, dated April 6, 2018, mandates that all system providers operating payment systems in India must store the entire data related to these systems within India. This includes full end-to-end transaction details and information collected, carried, and processed as part of the payment instruction.
The directive allows for data pertaining to the foreign leg of a transaction to be stored outside India, if required.
System providers were required to achieve compliance by October 15, 2018, and report their compliance to the RBI by this date. A System Audit Report (SAR), conducted by a CERT-IN empaneled auditor, certifying the completion of the data localization requirement, must be approved by the Board of the system provider and submitted to the Reserve Bank by December 31, 2018.
This directive is issued under Section 10(2) read with Section 18 of the Payment and Settlement Systems Act 2007 (Act 51 of 2007).
For further information, contact Nanda S. Dave, Chief General Manager-in-charge, Department of Payment and Settlement Systems, Central Office, 14th Floor, Central Office Building, Shahid Bhagat Singh Road, Fort, Mumbai – 400001. Phone: 91-22-2264 4995; Fax: 91-22-22691557; Email: cgmdpsscorbi.org.in.
Key Entities Referenced
Reserve Bank of India: The central bank of India, the issuer of this notification.
Payment and Settlement Systems Act 2007: An act of the Indian Parliament that provides the legal basis for the regulation and supervision of payment systems in India.
Scheduled Commercial Banks: Banks in India that are listed in the Second Schedule to the Reserve Bank of India Act, 1934.
RRBs: Regional Rural Banks in India.
Urban Cooperative Banks: Cooperative banks located in urban and semi-urban areas in India.
State Cooperative Banks: Cooperative banks operating at the state level in India.
District Central Cooperative Banks: Cooperative banks operating at the district level in India.
Payment Banks: A type of bank in India that is allowed to accept deposits, remittances, and payments.
भारतीय �रज़व र् ब�क
RESERVE BANK OF INDIA
www.rbi.org.in
RBI/2017-18/153
DPSS.CO.OD No. 2785/06.08.005/2017-2018 6 April 2018
The Chairman and Managing Director / Chief Executive Officers,
Authorised Payment Systems /
All Scheduled Commercial Banks including RRBs /
Urban Co-operative Banks/State Co-operative Banks /
District Central Co-operative Banks /Payment Banks / Small Finance Banks and Local Area Banks
Madam / Sir,
Storage of Payment System Data
Please refer to paragraph 4 of the Statement on Development and Regulatory Policies of the First Bi-
monthly Monetary Policy Statement for 2018-19 dated April 5, 2018. In recent times, there has been
considerable growth in the payment ecosystem in the country. Such systems are also highly
technology dependent, which necessitate adoption of safety and security measures, which are best in
class, on a continuous basis.
2. It is observed that not all system providers store the payments data in India. In order to ensure
better monitoring, it is important to have unfettered supervisory access to data stored with these
system providers as also with their service providers / intermediaries/ third party vendors and other
entities in the payment ecosystem. It has, therefore, been decided that:
i. All system providers shall ensure that the entire data relating to payment systems operated
by them are stored in a system only in India. This data should include the full end-to-end
transaction details / information collected / carried / processed as part of the message /
payment instruction. For the foreign leg of the transaction, if any, the data can also be
stored in the foreign country, if required.
ii. System providers shall ensure compliance of (i) above within a period of six months and
report compliance of the same to the Reserve Bank latest by October 15, 2018.
iii. System providers shall submit the System Audit Report (SAR) on completion of the
requirement at (i) above. The audit should be conducted by CERT-IN empaneled auditors
certifying completion of activity at (i) above. The SAR duly approved by the Board of the
system providers should be submitted to the Reserve Bank not later than December 31,
2018.
3. The directive is issued under Section 10(2) read with Section 18 of Payment and Settlement
Systems Act 2007, (Act 51 of 2007).
Yours faithfully
(Nanda S. Dave)
Chief General Manager-in-charge
भगु तान और �नपटान प्रणाल� �वभाग, क�द्र�य कायार्लय, 14वीमंिजल, क�द्र�य कायार्लय भवन,शह�द भगत�सहं माग,र् फोटर्, मम्ु बई - 400001
फोनTel: (91-22) 2264 4995; फैक् सFax: (91-22) 22691557; ईमेल-e-mail : cgmdpssco@rbi.org.in
Department of Payment and Settlement Systems, Central Office, 14th Flr, Central Office Building,
Shahid Bhagat Singh Road, Fort, Mumbai - 400001
�हदं � आसान है , इसका प्रयोग बढ़ाइए