<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/04/banner1251-7.webp" alt="M2P Fintech" title="" id="47w9r0aue" width="100%" height="447">Over the past few years, we have been witnessing ongoing digital advancements, ranging from communication to the way we transact. Out of these advancements, cashless transactions are reigning supreme and are further fueled by this raging pandemic. They have taken over traditional payments and banking practices.Also, there is a multitude of payment options available today. Major players such as Google Pay, Apple Pay, PayPal have access to sensitive user data stored across international servers. These actions led to many raising their voice about user data security and privacy.Being a global concern, RBI brought forth the concept of Data Localization to protect user data from potential threats.<h2 class="heading-node" id="909f" style="text-align: justify">What is data localization?</h2>Data protection created a buzz way back in 1993 when Public Records Act ensures the data transfer is restricted outside India for security purposes from surveillance of other countries.<blockquote class="block-node" id="gvz0ve27e">Data localization is the act of storing citizens’ data within the country’s geographical boundaries to avoid any foreign accessibility.</blockquote>It also plays a crucial part in the government’s cloud computing policy.<h2 class="heading-node" id="a1d6" style="text-align: justify">RBI guidelines on the data localization Policy</h2>Reserve Bank of India (RBI) issued a circular dated April 6, 2018, stating that all authorized Payment System Operators (PSOs) in India to ensure that the data related to payment systems such as customer data, payment sensitive data, payment credentials, and transaction data should be mandatorily stored within India itself under the Payment and Settlement Systems Act, 2007.A deadline of six months was tagged along with the data localization policy. Since the payment ecosystem has ballooned in the last few years, RBI was pushed to undertake this crucial step in protecting consumers’ data.All payment firms, including American Express, Master Card/Visa, PayPal, Google Pay, WhatsApp Pay, Paytm, and Phone Pe, should adhere to the RBI’s data localization rule. Subsequently, RBI insisted system providers for unfettered access to all data on complete end-to-end transaction details/information collected/carried/processed as part of the message/payment instruction by submitting Audit Report (SAR) conducted by CERT-IN.<h2 class="heading-node" id="b109" style="text-align: justify">As per RBI’s data localization policy...</h2><ol class="list-node" id="2v2w7zt70"><li>There is no bar on payment processing outside the country, but post-processing, the data should be deleted from the foreign systems and brought back to India not later than the one business day or 24 hours from payment processing, whichever is earlier. The same should be stored only in India.</li><li>However, any subsequent activity such as settlement processing after payment processing, if done outside India, shall also be undertaken/performed on a near real-time basis by storing it only in India.</li><li>In case of any other related processing activity, such as chargeback, etc., the data can be accessed, at any time, from India, where it is stored.</li><li>RBI’s prior approval is necessary for sharing the payment system data with overseas regulators.</li><li>The banks operating in India must strictly adhere to the storage norms.</li><li>Exceptionally, a foreign leg of a transaction is permitted to store their banking data abroad. However, the domestic payment transactions should be stored only in India along with the details which include end-to-end transaction, payment, and settlement transactions — customer name, mobile number, e-mail address, Aadhar card number or PAN, beneficiary details, and payment credentials like One Time Password (OTP), PIN and passwords.</li><li>For cross-border transactions that include data with a foreign and domestic component, a copy of the domestic component may be stored abroad, if required.</li><li>System providers were given six months to ensure the directive’s compliance and report the same to RBI.</li></ol><img src="https://miro.medium.com/max/700/1*UWIdZTi2f31G70qkfQJqLw.png" alt="An image representing the RBI Data Localisation Policy" title="" width="100%" height="349">The RBI guidelines on storing payments data provoked a noteworthy impact on Payment System Operators. Indian payment firms, viz. Paytm, PhonePe, and MobiKwik backed the RBI regulations on data localization policy in protecting citizens’ data and restricting any foreign accessibility.But the representatives of top leading companies such as Amazon, Flipkart, Google, Microsoft, Facebook, and American Express met with government and RBI officials to raise concerns regarding the stringent nature of this policy (2019).Later the Indian government took the responsibility to determine the category of data to be stored locally. This categorization ensured that the data is not misused by various companies, which involves transferring it to third-party providers.<h2 class="heading-node" id="f733" style="text-align: justify">Personal data protection bill</h2>The Personal Data Protection Bill (PDP Bill) applies to the processing of personal data by the companies registered in India, foreign companies dealing with personal data of individuals in India, and the Indian Government. The PDP bill categorizes the collected data into three categories:<ul class="list-node" id="0gtvgf1gh"><li>Personal data,</li><li>Sensitive personal data and</li><li>Critical personal data.</li></ul>The PDP bill is not applicable for the processing of anonymous data.The PDP bill proposed to store sensitive personal data and critical personal data in India. However, it permits the processing of sensitive personal data by transferring it to outside of India in certain cases provided that at least a copy of that data continues to be stored in India and explicit consent is needed for the same. Whereas critical personal data can only be stored and processed within India.<h2 class="heading-node" id="e7e0" style="text-align: justify">The impact on payment industries</h2>Multinational payment systems located in India faced a major impact after the RBI’s intervention on Data Localization. Popular foreign credit card companies such as Visa and Mastercard missed the strict six-month deadline set by the RBI (2019). Usually, International payment companies store their data on global servers, but this rule made them store data locally with an additional investment.India is the fastest-growing market for mobile apps and digital banking. The Indian start-up companies in the FinTech sector often go through the toughest challenge of outsourcing technical support and shifting from cloud services to cheaper and cost-effective services.Data Localization Policy will prohibit these start-ups from opting for cost-effective cloud service providers globally and choose localized alternatives, which ends in high operational costs. But this will be a fruitful drift that leads to shielding of payments data from identity fraud and other digital breaches associated with it.<h2 class="heading-node" id="3200" style="text-align: justify">The current scenario</h2>RBI reiterated its stand on data privacy by issuing a circular stating that from April 1, 2021, all Payment system operators to submit a compliance certificate duly signed by their CEOs or Managing Directors on a half-yearly basis adhering to the RBI’s regulations on securing payments data.This again triggered an active interest in RBI’s continuous intervention on securing and continuously monitoring the data to avoid any future risks to the country. With the advancements in the digital economy, financial data security is a must for the country’s economic growth and development.Want to know more about data localization? Write to us at business@m2pfintech.com<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox. Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

Decrypting RBI Data Localization Policy for Payment Companies

<html><head></head><body><img class="alignnone size-full wp-image-2580" src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/Artboard-1-copy-8-13.webp" alt="M2P Fintech" width="100%" height="100%">

<a href="https://m2pfintech.com/blog/pci-dss-the-payments-armour/">PCI DSS stands for Payment Card Industry Data Security Standard</a>. A collaboration between top reputed <a href="https://m2pfintech.com/blog/credit-card-processing-a-definitive-guide/">credit card</a> brands such as American Express, Discover, JCB, Mastercard, and Visa in 2004 resulted in PCI-DSS launch. Organizations who store or process, or transmit the cardholder data either as clear or in an encrypted manner should comply with PCI regulations.

A short survey showed that most people give the above description when quizzed about PCI-DSS. When we further probed them about the levels present in this compliance, we came up short. So, we came up with a quick read of the PCI-DSS compliance levels.
<h2 id="6c0f" class="rz sa ps bn ds sb sc sd fr se sf sg fv sh si sj fz sk sl sm gd sn so sp gh sq dr">PCI DSS Compliance levels</h2>
Divided into four levels, the PCI Compliance levels are based on the number of credit or debit card transactions processed by a business annually. These levels determine what needs to be done by an enterprise to remain compliant.
Level 1:
Applies to merchants who process more than six million real-world credit or debit card transactions annually. An authorized PCI Qualified Security Assessor will conduct an annual internal audit and an on-site evaluation of the organization to:
· Authenticate the assessment’s scope;
· Evaluate technical information and documentation;
· See whether the PCI-DSS standards are being met;
· Assist and guide the compliance process and
· Also, evaluate the compensating controls
On successful evaluation, the QSA will present an RoC (Report on Compliance) to the organization’s acquiring bank, thereby demonstrating its compliance.
Level 2:
Applies to merchants who process between one and six million real-world credit or debit card transactions. Security testing reports on network hosts and applications should be completed on a defined frequency. The RoC is also applicable for level 2 organizations.
Level 3:
Applies to merchants who process annually between 20,000 and one million e-commerce transactions. A yearly assessment must be done using the relevant SAQ (Self-Assessment Questionnaire)along with a quarterly PCI scan.
Level 4:
Applies to merchants who process annually fewer than 20,000 e-commerce transactions or those who process up to one million real-world transactions. They must complete a yearly assessment using the SAQ and a quarterly PCI scan.

<h2 id="7604" class="rz sa ps bn ds sb aed sd fr se aee sg fv sh aef sj fz sk aeg sm gd sn aeh sp gh sq dr">What is this Self-assessment questionnaire?</h2>
PCI-DSS lists several kinds of SAQs for every level, and it is also based on how the merchant processes card information. Given below are some of the types of SAQs applicable to levels 2–4:
SAQ A: Merchants who outsource their entire card data processing to certified third parties. The transactions also include e-commerce transactions.
SAQ A-EP: Applies to E-commerce merchants who outsource their payment processing but not the site’s administration.
SAQ B: Applies to E-commerce merchants who don’t receive cardholder data, but they have control over the process through which data is redirected to a third-party payment processor.
SAQ B-IP: It applies to merchants who don’t store cardholder data in electronic form but will use IP-connected point-of-interaction devices. These merchants may handle either card-present or card-not-present transactions.
SAQ C-VT: Applies to merchants who process cardholder data via a virtual payment terminal.
You must select the right SAQ because every level has compliance requirements based on how payment card data is processed.

<h2 class="rz sa ps bn ds sb aed sd fr se aee sg fv sh aef sj fz sk aeg sm gd sn aeh sp gh sq dr">How to become a PCI DSS compliant</h2>
The PCI DSS specifies six control objectives for an organization to achieve compliance:
1. Build and maintain a secure network
2. Protect cardholder data
3. Maintaining a vulnerability management program
4. Implementing strong access control measures
5. Regular monitoring and testing of networks
6. Maintaining an information security policy

<h2 id="2e3a" class="rz sa ps bn ds sb aed sd fr se aee sg fv sh aef sj fz sk aeg sm gd sn aeh sp gh sq dr">The penalties of non-compliance</h2>
As cardholder data is considered personal data, a PCI DSS breach can also be regarded as equal to a <a href="https://m2pfintech.com/blog/gdpr-in-a-nutshell/">GDPR</a> breach. If PCI regulations are not adhered to, organizations will face severe financial penalties or even lose their facility to accept card payments.
In short, PCI-DSS is a standard that ensures trust, business continuity, and safety of the cardholder data.
<a href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.

Follow us on&nbsp;<a href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.</body></html>

PCI DSS- A quick guide to its levels

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/06/Artboard-1-2.webp" alt="M2P Fintech" title="" id="jc4mjh9mq" width="100%" height="479">Henry, an accountant, always takes the train on his way to the office. That particular day, he missed his usual cut-off time of leaving home and had to rush to the train station. He was terribly late for work and didn’t have a minute to swipe the card or scan the code to pay for his ticket. Then, Henry reaches the terminal and just places his index finger to purchase the ticket and proceeds to catch the train.<blockquote class="block-node" id="8ek6i7u3q">Sounds like a scene of a sci-fi movie, right? What if I tell you this is happening right now?</blockquote>Well, that is biometric authentication, where an individual’s unique physical traits are captured and stored by electronic devices. The captured information will be used to authenticate the individual’s identity when making a purchase.It is no secret that we often struggle to remember our passwords or PIN numbers. So, we resort to having our birthdays or our name as our password or PIN. Ironically, this also means we leave our sensitive data out in the open.With the global adaptation of <a class="link" href="https://m2pfintech.com/blog/the-rise-of-digital-payments/" target="">mobile payments</a>, the pressing need for a more secure system, as opposed to the existing authentication systems, is on the rise. Fingerprint scanning, iris recognition, and facial recognition are some of the biometric systems now in place.It does come with a slew of advantages like higher security, improved customer experience, and customer retention. But, on the flip side, the concern of personal information, especially one’s unique traits being out in the open, is a problem. Also, installing biometric systems requires a considerable investment that often retailers shy away from.<h2 class="heading-node" id="5a9a" style="text-align: justify">What does the future hold?</h2>Biometric adoption will be the future of the payment industry. And it is an innovation-driven by institutions and individuals wanting an upgrade from password/PIN input. Right from wearables to injectable chips, the idea of biometric authentication seems to have taken root.The world of payments keeps evolving with many futuristic trends in payment processing every day. <a class="link" href="https://m2pfintech.com/blog/future-of-payments-processing-matched-with-industry-needs/">Explore more.&nbsp;</a>It looks as if the future is just a step away………. Or rather a scan away.<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

Tag: "Compliance (12)"

M2P Fintech