Key Takeaways
- Payment system data must be stored in India under RBI rules for payment systems.
- PCI DSS applies when handling card data; most apps avoid storing card data.
- CERT-In requires timely reporting of specified cyber incidents.
- Consult compliance experts for your licence and model.
FinTech products must earn trust from users, partners and regulators.
Key areas
| Area | Requirement |
|---|---|
| Data localisation | RBI rules for payment system data |
| Card data | PCI DSS; prefer tokenisation via gateways |
| Personal data | DPDP Act obligations |
| Cyber incidents | CERT-In reporting timelines |
| Outsourcing | Vendor risk management |
| Audits | Security audits and penetration tests |
Security checklist
- Encryption and key management
- MFA for users and admins
- Secure SDLC and code reviews
- Fraud monitoring
- Logging and monitoring
- Incident response plan
Disclaimer: General information only.
Planning a fintech project?
Light Animation has designed and built software and websites for brands like Godrej, Saras Jaipur Dairy and Jaipur Traffic Police. Share your requirement and get a free consultation and estimate.
Explore FinTech Software DevelopmentGet a Free QuoteRelated reading: FinTech App Development Cost · AI Fraud Detection
Frequently Asked Questions
Do fintech apps need to store data in India?
RBI requires payment system data to be stored in India; other rules may apply by sector.
What is PCI DSS?
A security standard for organisations handling card data.
What is CERT-In reporting?
Mandatory reporting of specified cyber incidents to CERT-In within prescribed timelines.
How often should fintech apps be audited?
Regularly, and after major changes, as required by partners and regulators.
