Skip to content
SecuriFii

Payments regulation

System Audit Report (SAR) for Data Localisation and Payment Compliance

The Reserve Bank requires the entire data relating to a payment system to be stored in a system only in India, and requires completion to be certified in a System Audit Report by a CERT-In empanelled auditor and approved by your board. The audit is quick to fail on something you did not know you had: a log pipeline, a backup, a vendor’s analytics. We find those first.

Discuss this
Standard
RBI DPSS.CO.OD No.2785/06.08.005/2017-2018
Issued
6 Apr 2018
SAR conducted by
CERT-In empanelled
SAR approved by
Board
Data processed abroad
Back within 24 h

What the RBI direction actually requires

On 6 April 2018 the Reserve Bank of India directed all payment system providers to ensure that the entire data relating to the payment systems they operate is stored in a system only in India — the full end-to-end transaction details collected, carried or processed as part of the payment message or instruction. For the foreign leg of a transaction, the data may also be stored in the foreign country. The direction was issued under Section 10(2) read with Section 18 of the Payment and Settlement Systems Act, 2007.

The Reserve Bank’s FAQ of 26 June 2019 sets the reach. The direction applies to every payment system provider authorised or approved by the Reserve Bank, and to all banks operating in India. It also covers transactions through the participants, service providers, intermediaries, payment gateways and third-party vendors those providers engage — but the responsibility for compliance stays with the authorised provider.

The data includes customer data such as name, mobile number, email, Aadhaar and PAN; payment-sensitive data such as customer and beneficiary account details; payment credentials such as OTPs, PINs and passwords; and transaction data such as originating and destination system information, reference, timestamp and amount. Processing abroad is permitted, but the data must then be deleted from the systems abroad and brought back to India not later than one business day or 24 hours from processing, whichever is earlier.

The System Audit Report is how completion is demonstrated. The circular required it to be conducted by CERT-In empanelled auditors certifying completion, approved by the provider’s board and submitted to the Reserve Bank. The FAQ says it should include, among other things, data storage, maintenance of database, data backup restoration and data security.

What it will ask of you

An auditor certifying that payment data is stored only in India will test the claim against your systems, not your policy. These are the places it is usually lost.

  • A complete map of the payment data

    Every system that stores any part of the end-to-end transaction: databases, caches, message queues, log and observability pipelines, analytics, data warehouses, support tools and backups — with the region each one actually stores data in.

  • Your vendors, not only your systems

    The direction reaches the service providers, payment gateways and third-party vendors you engage, and the FAQ leaves responsibility with you. Their storage locations need evidence too, in contract and in fact.

  • Proof of the processing-abroad clock

    Where any processing happens outside India, evidence that the data is deleted abroad and returned to India within one business day or 24 hours, whichever is earlier — which means deletion that is automated and logged.

  • Backups and restoration inside India

    The SAR covers data backup restoration, so disaster recovery copies and restore paths have to stay in India as well, and a restoration test is the evidence.

  • Board approval

    The SAR goes to the Reserve Bank approved by your board, so the board needs to understand what it is approving and what the auditor found.

Why it is worth getting right

  • A finding at audit is a finding in a report your board approves and the Reserve Bank receives.
  • Payment aggregators must also comply with the storage requirements and undergo an annual system audit, including a cyber security audit, by CERT-In empanelled auditors.
  • The data map that answers the localisation question also answers your PCI DSS scoping and your DPDP Act records.
  • Banks and providers that engage you carry the compliance responsibility for your part of the chain, which gives them every reason to ask you to evidence it.

Not sure this is the standard you need?

Tell us what triggered the question — a customer, an auditor, a contract clause — and we will say which of these applies, including when the answer is none of them.

Ask a practitioner

Where we come in, and where we stop

The Reserve Bank was specific: the audit is to be conducted by CERT-In empanelled auditors certifying completion, and the System Audit Report is approved by your board before it reaches the Reserve Bank. We are not CERT-In empanelled, so we do not conduct the audit, certify completion or issue the SAR. We do the data discovery, the gap assessment, the remediation and the evidence, and we support you while the empanelled auditor does the rest.

Ours

  • Mapping the end-to-end payment data across your systems and vendors
  • A gap assessment against the circular and the FAQ
  • Remediation of storage, logging, backup and vendor arrangements
  • Evidence of deletion and repatriation where processing happens abroad
  • A readiness review before the auditor arrives, and support through the audit

A CERT-In empanelled auditor, and your board

  • Conducting the system audit and certifying that payment data is stored only in India — a CERT-In empanelled auditor
  • Issuing the System Audit Report — the same auditor
  • Approving the SAR before it is submitted to the Reserve Bank — your board

How an engagement runs

Steps 1 to 4 are our work. Step 5 belongs to a CERT-In empanelled auditor, and the approval in step 6 to your board.

  1. 01Data discoveryWe trace a payment from instruction to settlement and record every system and vendor that stores any part of it, and the region it is stored in. The surprises are usually in logging, analytics and backups.
  2. 02Gap assessmentEach finding measured against the circular and the FAQ — India-only storage, the foreign-leg exception, the processing-abroad clock, overseas sharing — with an owner and an effort estimate per gap.
  3. 03RemediationRegion changes, log routing, backup and restore paths, vendor contract terms and automated deletion where processing happens abroad, implemented alongside your engineers.
  4. 04Evidence and readiness reviewAn evidence pack organised around what the SAR covers — data storage, database maintenance, backup restoration and data security — and a readiness review run the way the auditor will run it.
  5. 05The system auditA CERT-In empanelled auditor conducts the audit and issues the SAR. We support you through it and help you confirm that the auditor appears on CERT-In’s published list.
  6. 06Board approval and submissionYour board approves the SAR and you submit it to the Reserve Bank. We help prepare the board briefing so the approval is an informed one.

What you get from us

  • A payment data map covering systems, vendors and storage regions
  • A gap register against the circular and the FAQ, with owners and effort
  • Remediation support for storage, logging, backup and vendor terms
  • An evidence pack organised around the scope of the SAR
  • A readiness review report and support through the empanelled auditor’s audit
  • A board briefing on what the SAR certifies and what it found

Common questions

Who has to comply with RBI data localisation?

Every payment system provider authorised or approved by the Reserve Bank under the Payment and Settlement Systems Act, 2007, and all banks operating in India. It also covers transactions through the service providers, intermediaries, payment gateways and vendors those providers engage, with the responsibility staying on the authorised provider.

Who can conduct the System Audit Report?

A CERT-In empanelled auditor. The circular says the audit should be conducted by CERT-In empanelled auditors certifying completion, and the FAQ repeats it. The SAR must then be approved by the provider’s board before it is submitted to the Reserve Bank. We are not empanelled and do not conduct or sign it.

Can payment data be processed outside India?

Yes. The FAQ says there is no bar on processing abroad, but the data must then be deleted from the systems abroad and brought back to India not later than one business day or 24 hours from processing, whichever is earlier, and stored only in India.

Is the RBI SAR an annual requirement?

The 2018 circular asked for a SAR on completion of localisation, due by 31 December 2018. It did not set an annual cycle. Separately, payment aggregators must undergo an annual system audit, including a cyber security audit, by CERT-In empanelled auditors under the 2025 Master Direction. Check the conditions of your own authorisation.

Can we keep a copy of the data abroad?

For a cross-border transaction, a copy of the domestic component may also be stored abroad if required. For a domestic transaction, the data must be stored only in India. Sharing with an overseas regulator needs the Reserve Bank’s approval.

Ready to scope it?

Send the date you are working to and roughly how large the organisation is. You will get a reply from a practitioner with an honest read on whether the date is reachable.

Start the conversation

Related services

All services

Related insights

All insights