In the era of electronic Commerce or Quick Commerce, the role of Payment Aggregators and payment gateways is significant. These entities take care of funds transferred from customers to suppliers through different banks and Channels. Therefore, entities operating as PA and PG are required to be regulated and monitored.
RBI has issued “Guidelines on Regulation of Payment Aggregators and Payment Gateways” vide document No. RBI/DPSS/2019-20/174 dated 17th March, 2020. RBI has specified the various guidelines for payment aggregators such as the requirement of authorisation, capital requirement, operation of the escrow account, etc.
In addition, the guidelines also specify the “Baseline Technology-related Recommendations” in Annexure 2. These technology-related recommendations for mandatory for adoption by the PAs. However, the same is recommended for payment Gateways.
This article discusses the Baseline Technology-related Recommendations provided by the RI for PA and PG
1. Security-related Recommendations
The entities are required to have the following validation for IT systems and security:
1.1. Information Security Governance:
- The entities at a minimum shall carry out comprehensive security risk assessment of their people, IT, business process environment, etc., to identify risk exposures with remedial measures and residual risks.
- These can be an internal security audit or an annual security audit by an independent security auditor or a CERT-In impaneled auditor.
- Reports on risk assessment, security compliance posture, security audit reports, and security incidents shall be presented to the Board.
1.2. Data Security Standards:
- Data security standards and best practices like PCI-DSS, PA-DSS, latest encryption standards, transport channel security, etc., shall be implemented.
1.3. Security Incident Reporting:
- The entities shall report security incidents/cardholder data breaches to RBI within the stipulated time frame.
- Monthly cyber security incident reports with root cause analysis and preventive actions undertaken shall be submitted to RBI.
1.4. Merchant Onboarding:
- The entities shall undertake comprehensive security assessment during the merchant onboarding process to ensure these minimal baseline security controls are adhered to by the merchants.
- As per the guidelines issued, the PAs shall undertake the background check of the merchant to ensure that the merchant does not have any malafide intention and does not sell fake products or prohibited products.
1.5. Cyber Security Audit and Reports:
- The entities shall carry out and submit to the IT Committee:
- Quarterly internal and annual external audit reports;
- Bi-annual Vulnerability Assessment / Penetration Test (VAPT) reports;
- PCI-DSS including Attestation of Compliance (AOC) and
- Report of Compliance (ROC) compliance report with observations noted if any including corrective/preventive actions planned with action closure date;
- inventory of applications that store process or transmit customer-sensitive data;
- The PA-DSS compliance status of payment applications that store or process cardholder data.
1.6. Information Security:
- Board-approved information security policy shall be reviewed at least annually. The policy shall consider aspects like:
- alignment with business objectives;
- the objectives, scope, ownership, and responsibility for the policy;
- information security organisational structure;
- information security roles and responsibilities;
- maintenance of asset inventory and registers;
- data classification; etc
- authorisation; exceptions; knowledge and skill sets required; periodic training and continuous professional education; compliance review and penal measures for non-compliance of policies.
1.7 IT Governance: An IT policy shall be framed for regular management of IT functions and the entity shall ensure that detailed documentation in terms of procedures and guidelines exists and is implemented. The strategic plan and policy shall be reviewed annually. The Board level IT Governance framework shall have-
- Involvement of the Board in approving information security policies, establishing necessary organisational processes/functions for information security, and providing necessary resources.
- IT Steering Committee with representations from various business functions as appropriate. The Committee shall assist the Executive Management in the implementation of the IT strategy approved by the Board.
- Enterprise information model to enable applications development and decision-supporting activities, consistent with board-approved IT strategy. The model shall facilitate the optimal creation, use, and sharing of information by a business, in a way that maintains integrity and is flexible, functional, timely, secure, and resilient to failure. The
- Cyber Crisis Management Plan approved by the IT strategic committee and shall include components such as Detection, Containment, Response, and Recovery.
1.8. エンタープライズデータディクショナリ：
- 各組織は、組織のデータ構文規則を組み込んだ「エンタープライズデータディクショナリ」を維持するものとする。
- これにより、アプリケーションやシステム間でのデータ共有が可能となり、IT部門とビジネスユーザー間でのデータに対する共通理解が促進され、互換性のないデータ要素の作成が防止されるものとする。
1.9. リスク評価：
- リスク評価では、脅威と脆弱性の組み合わせを特定し、ビジネス、コンプライアンス、および契約上の観点から、当該資産の機密性、可用性、または完全性に与える影響の可能性を評価するものとする。
1.10. アプリケーションへのアクセス：
- アプリケーションシステムの管理に関する文書化された手順を策定し、アプリケーション所有者の承認を得た上で、常に最新の状態に保つものとする。
- アプリケーションへのアクセスは、最小権限の原則および職務責任に応じた「知る必要性（need to know）」に基づいて行われるものとする。
1.11. スタッフの能力：
- IT機能に必要なスキルセットを備えた訓練を受けたリソースの要件を把握し、定期的に適切に評価する必要がある。
1.12. ベンダーリスク管理：
- BCP-DR（事業継続計画および災害復旧）やデータ管理を含む技術サポートのサービスレベルアグリーメント（SLA）には、規制当局がこれらのシステムにアクセスすることを許可する条項を明確に含めるものとする。
1.13. 成熟度とロードマップ：
- 各組織は、広く認められた国際基準に基づいてIT成熟度レベルを評価し、アクションプランを策定した上で、目標とする成熟度レベルに到達するための計画を実行するものとする。
1.14. 暗号化要件：
- 各組織は、確立された国際標準であり、かつ暗号学者の国際コミュニティによる厳格な精査を受けているか、あるいは権威ある専門機関、信頼できるセキュリティベンダー、または政府機関によって承認された暗号化アルゴリズムを選択するものとする。
1.15. フォレンジック対応能力：
- アプリケーション、サーバー、ミドルウェア、エンドポイント、ネットワーク、認証イベント、データベース、Webサービス、暗号化イベント、ログファイルなど（ただしこれらに限定されない）を含む、組織のインフラストラクチャから発生するすべてのセキュリティイベントを収集、調査、分析し、セキュリティアラートをプロアクティブに特定するものとする。
1.16. データ主権：各組織は、外部の管轄区域に属するインフラストラクチャにデータを保存しないよう、予防措置を講じるものとする。データへの不正アクセスを防止するため、適切な管理策を検討するものとする。
1.17. アウトソーシングにおけるデータセキュリティ：
組織がセキュリティ監査を実施できるように、「監査権」条項を定めたアウトソーシング契約を締結するものとする。または、第三者は毎年、独立したセキュリティ監査報告書を組織に提出するものとする。
1.18. 決済アプリケーションのセキュリティ：
Payment applications shall be developed as per PA-DSS guidelines and complied with as required. The entities shall review PCI-DSS compliance status as part of the merchant onboarding process.
2. Other Recommendations
The Payment Aggregators and Payment gateways have to take care of the following points:
- The customer card credentials shall not be stored within the database or the server accessed by the merchant.
- Option for ATM PIN as a factor of authentication for card not present transactions shall not be given.
- Instructions on storage of payment system data, as applicable to PSOs, shall apply.
- All refunds shall be made to the original method of payment unless specifically agreed by the customer to credit an alternate mode.
Conclusion
The key to successfully and securely operating as a Payment Aggregator and Payment Gateway is Information Technology. Therefore, PAs and PGs are required to ensure that IT implemented in the entity is regularly audited, secure,d and carried out in accordance with guidelines issued by the RBI.
.avif)
