If you are building a fintech startup in India, RBI compliance is not optional. It is the difference between getting a banking partnership and getting shut down. The Reserve Bank of India issued three major master directions in 2024-2025 alone, each tightening the technical requirements for payment aggregators, NBFCs, and digital lending platforms.
Most fintech founders treat compliance as a legal problem. It is not. It is an infrastructure problem. The RBI does not care about your privacy policy. They care about whether your data is encrypted, whether your cloud runs in India, whether you can detect a breach in 6 hours, and whether you have the audit trails to prove it.
Here is the checklist your CERT-In empanelled auditor will actually check.
Which RBI Framework Applies to You?
Before building anything, know which direction you fall under:
| If you are a... | Your governing framework | Compliance deadline |
|---|
| Payment Aggregator | PA Master Direction 2025 | Active now |
| NBFC (Top/Upper/Middle layer) | IT Governance Master Direction 2024 | Active since Apr 2024 |
| Non-bank PSO (large) | Cyber Resilience Direction 2024 | Active since Apr 2025 |
| Non-bank PSO (medium) | Cyber Resilience Direction 2024 | April 1, 2026 |
| Digital lending platform | Digital Lending Directions 2025 | Active now |
If you process payments, lend money, or route funds through your platform, at least one of these applies to you. Many startups think they are "just an interface." The moment you touch, hold, or settle funds, licensing and compliance requirements kick in.
The Infrastructure Checklist
1. Data Must Live in India
This is non-negotiable. All payment system data must be stored on servers physically located in India. This includes transaction records, card credentials, timestamps, user details, and payment profiles.
What this means for your infrastructure:
- AWS: ap-south-1 (Mumbai) only for payment and financial data
- Azure: Central India or South India regions
- GCP: asia-south1 (Mumbai)
- Your Terraform or Pulumi code must enforce region constraints. No exceptions.
- If data is processed overseas temporarily, a complete copy must return to India within 24 hours and the foreign copy must be deleted
- RBI must have unrestricted audit access to all stored data
The most expensive compliance mistake I see: startups that launch on us-east-1 because it was the default, then discover they need to migrate everything to Mumbai. Retrofitting costs 5x more than building it right from day one.
2. Encryption Everywhere
The RBI mandates encryption in transit and at rest. Specifically:
- In transit: TLS 1.2 or higher on all connections. No self-signed certificates in production.
- At rest: AES-256 encryption for databases, object storage, and volumes. Use AWS KMS, Azure Key Vault, or GCP Cloud KMS for key management.
- Card data: Tokenization required. Storing actual card details is banned.
- PCI-DSS compliance mandatory for payment aggregators and their onboarded merchants.
Quick check: run this against your AWS account to find unencrypted EBS volumes:
aws ec2 describe-volumes --filters Name=encrypted,Values=false --query 'Volumes[*].[VolumeId,Size,State]' --output table
If that returns results, you have a compliance gap.
3. Access Controls and MFA
RBI requires access on a need-to-know basis with time-limited duration. In practice:
- Multi-factor authentication on everything: AWS console, VPN, admin panels, deployment pipelines
- No administrative rights on end-user workstations
- Privileged access management with audit logging
- Regular access reviews (quarterly minimum)
- Service accounts with least-privilege IAM policies
I audit fintech startups where the CEO still has root access to production databases. That is a finding your auditor will flag on page one.
4. 24/7 Security Monitoring
The Cyber Resilience Direction requires a Security Operations Center. This means:
- Continuous monitoring with log correlation and threat detection
- Automated alerting for suspicious activity
- Log management with retention (minimum 1 year)
- Threat intelligence integration
You do not need to build an in-house SOC. Outsourced SOC services work and are specifically permitted. But "we check logs when something breaks" is not a SOC.
At minimum, set up CloudWatch Alarms + CloudTrail + GuardDuty on AWS, or the equivalent on Azure/GCP. Configure alerts for: root account usage, IAM policy changes, security group modifications, and unusual API call patterns.
5. Incident Response (2-6 Hours)
When a security incident happens, RBI reporting timelines are tight:
- Banks and NBFCs: Report within 2-6 hours of discovery
- Non-bank PSOs: Report cyber-attacks, outages, internal frauds, and settlement delays within 6 hours
Your incident response plan must include:
- Automated breach detection (not a human checking dashboards)
- Escalation procedures with named owners
- Communication templates pre-approved by legal
- Forensic analysis capability for severity, impact, and root cause
- Cyber Crisis Management Plan (CCMP) approved by the board
6 hours from detection to RBI notification. If your team's current incident response is "someone posts in Slack and we figure it out," you will miss that window.
6. VAPT: Not Once, Not Annually, Continuously
Vulnerability Assessment and Penetration Testing requirements:
- Vulnerability Assessment: Every 6 months minimum
- Penetration Testing: At least annually, by a CERT-In empanelled auditor
- Best practice: Quarterly VAPT, plus after major app or infrastructure changes
- Must be performed before regulatory audits and before onboarding banking partners
Integrate vulnerability scanning into your CI/CD pipeline. Tools like Trivy for container scanning, Snyk for dependency vulnerabilities, and OWASP ZAP for web application testing should run on every deployment. The formal CERT-In audit happens annually, but you should be catching issues continuously.
7. Business Continuity and Disaster Recovery
The RBI requires:
- Board-approved BCP/DR plan
- Documented data migration policy with audit trails
- Regular DR testing (not just documentation, actual failover tests)
- Defined Recovery Time Objective (RTO) and Recovery Point Objective (RPO)
If your DR plan is a document nobody has read since it was written, that is a compliance gap. Test it. Quarterly.
8. Vendor Risk Management
Every vendor that processes data for you is part of your compliance surface. RBI requires:
- Security controls to prevent infiltration from vendor networks
- Network segmentation between your environment and vendor access
- Certified assurance from an independent auditor for vendors involved in critical processes
- Regular vendor risk assessments
Your payment gateway, KYC provider, cloud hosting, SMS gateway, analytics tools: each one needs a risk assessment. If your vendor has a breach, it is your compliance problem.
The Annual Audit: What Happens
Every year, a CERT-In empanelled auditor will:
- Review your IS (Information Security) policies and whether they are actually followed
- Check encryption implementation across your infrastructure
- Verify access controls, MFA, and privilege management
- Test your incident response readiness
- Validate data localization (is all payment data in India?)
- Review VAPT reports and whether findings were remediated
- Check BCP/DR documentation and testing evidence
- Assess vendor risk management practices
The audit report goes to RBI's Regional Office. Material findings can trigger enforcement actions, restrictions on launching new products, or worse.
Penalties That Have Actually Been Enforced
This is not theoretical. RBI issued 79 enforcement actions in FY 2024-25:
- Paytm penalized for KYC non-compliance, with additional FIU-IND penalty for AML violations
- PhonePe fined Rs 21 lakh for PPI guideline violations
- Four NBFCs fined Rs 76.6 lakh combined for P2P lending violations
- PAs that missed the December 2025 authorization deadline must wind down by February 2026
On top of RBI penalties, the DPDP Act adds penalties up to Rs 250 crore for data protection failures.
The 6 Mistakes I See in Every Fintech Audit
- Wrong cloud region. Payment data on us-east-1. This is the most expensive mistake to fix after the fact.
- No MFA on the AWS root account. First thing every auditor checks. Takes 5 minutes to fix.
- Production database accessible from the internet. Security groups with 0.0.0.0/0 on port 5432 or 3306.
- No audit logging. CloudTrail not enabled, or enabled but nobody reviews the logs.
- VAPT reports with open critical findings. Getting the test done is not enough. You must remediate the findings.
- "We will do compliance later." By the time a banking partner asks for your audit report, it is too late to start.
Start Here
If you are a fintech startup preparing for your first RBI audit, or a growing platform that knows the infrastructure has gaps, here is what to do this week:
- Verify all payment data is on India-region servers
- Enable MFA on every admin account
- Turn on CloudTrail and GuardDuty (or equivalent)
- Check for unencrypted storage volumes
- Document your incident response process
If you want someone to do a full audit and tell you exactly where the gaps are, book a free 20-minute infrastructure review. We specialize in getting fintech startups audit-ready in 4-6 weeks.
MatrixGard is a DevSecOps consultancy for funded startups. See our services or view pricing.
