Fintech and payments
Lending, payments, wealth and neobanking platforms.
In short
For a fintech business, where data is stored and which vendors can reach it are regulatory questions as well as engineering ones.
Fintech businesses are regulated by the Reserve Bank of India as well as by data protection law. RBI rules affect decisions that engineers usually make, such as where payment data is stored, which vendors can access it and how customer identity is verified.
Many fintech products are offered in partnership with a bank or NBFC, which remains answerable to the regulator. The partnership agreement has to set out who handles onboarding, complaints, data security and audits, in a way that meets the RBI's requirements on outsourcing.
Financial data is also personal data under the DPDP Act. Customers need clear notice and consent for each use.
What usually comes up
- RBI directions on storing payment data
- KYC records and outsourcing arrangements
- Consent for the use of financial data under the DPDP Act
Under the DPDP Act
A breach at a fintech company may need to be reported to the affected customers, the Data Protection Board, CERT-In and the RBI, each on its own timeline.
What our work involves
- Mapping RBI requirements on payment data storage and outsourcing against the architecture
- Agreements with banks, NBFCs, payment aggregators and technology vendors
- Consent and notice for financial data under the DPDP Act
- Customer terms, grievance processes and privacy notices