11 RBI cyber controls, 3 you can’t buy: the other 8 cost ₹27.5 lakh to ₹2.5 crore

01Four routes into the rulebook, and most fintechs take two

“Fintech” is not a licence. A lending app, a payment gateway, a broker and a core-banking vendor all call themselves fintechs, and each reaches the rulebook differently. If you hold an RBI licence, as a bank, small finance bank, payments bank, NBFC or credit information company, one of the seven Directions binds you directly. The NBFC Direction attaches chapters by scale-based layer and, inside the Base Layer, by a ₹500 crore asset-size test.³ If you are registered with SEBI, as a broker, adviser or fund, the Cybersecurity and Cyber Resilience Framework (CSCRF) of 20 August 2024 applies, graded by size: a broker with more than 5,00,000 active clients is a Qualified entity.⁴

Most fintechs we speak to hold neither. They sell software or services to a bank or NBFC, and the rulebook reaches them through the contract. The urban co-operative bank Direction is explicit: the bank must impose 12 named controls on its ATM switch provider (paragraph 83) and 34 on its core-banking provider (paragraph 85).¹ Whatever your route, two older rules apply to everyone: CERT-In’s six-hour incident reporting and 180-day log retention, and the RBI’s 2018 rule that payment system data is stored only in India.⁵⁶

02The eight controls software answers, priced

TechBag’s BFSI obligations map takes the chapter sub-sections of the RBI’s urban co-operative bank Direction and turns them into eleven controls, each linked to the category guide that shortlists products and each carrying an indicative annual cost band for an Indian organisation with 200 to 1,000 endpoints.¹ The UCB Direction is the most granular of the seven, which is why we used it; a licensed NBFC or a bank’s supplier will find the same families of control, sized differently.

Read the chart for its shape, not its total. Four of the original post’s security tools, endpoint, email, data leak prevention and identity, sit in the middle. Backup, the second pillar, carries a ₹35 lakh ceiling because it is priced by protected terabyte, and the RBI asks for restore tests with dates and outcomes, not backup success reports, which prove only that data was written.¹ The payment data rule adds a constraint the 2024 post never mentioned: a copy of payment data is still payment data, so the backup target and the recovery site must be in India.⁶ Our backup comparison counts which products document an India region.

The widest band is monitoring, and that is where the third pillar, cost management, really lives. The map’s own note on that band is that “the licence is the small number”: a log platform is priced on what you ingest and how long you keep it. The RBI expects a year of audit logs; CERT-In expects 180 days kept in India.¹⁵ A fintech that logs every API call at debug level pays for that choice every month. Cutting noise at the source is the cheapest cost control on this list.

03Three obligations no purchase discharges

The fourth pillar, compliance, is where the 2024 post went most wrong. It suggested automated reporting tools, audit platforms and eDiscovery. Three of the eleven controls in the map are not products at all, and the map says so in as many words.¹

For a fintech supplier, the third item is the one to prepare for. A bank that must put 34 controls into its core-banking contract will send you those 34 controls, and your answers become evidence in its inspection. Buying a third-party-risk platform does not help you answer; it helps the bank track you. What helps is having the penetration test report, the access-review trail and the restore-test log ready before the questionnaire arrives.