In force
CERT-In Directions: CERT-In Directions issued
Listed cyber incidents reported within six hours; ICT logs retained and clocks synchronised.
Banking & Financial Services
Technology an RBI or SEBI inspection can follow.
What we would build for banks, NBFCs, insurers, asset management companies and payment companies: AI whose output a credit officer can explain, integration that keeps the core banking system stable, and operations ready for CERT-In reporting and for the DORA clauses of European clients.
For banks, NBFCs, insurers, AMCs and market intermediaries regulated by RBI or SEBI, and for Indian technology providers that serve European financial entities.
28 April 2022
CERT-In six-hour reporting
Listed cyber incidents are reported to CERT-In within six hours of being noticed, and ICT logs are retained.
SourceCERT-In Directions under s. 70B(6) IT Act (opens external site)
20 August 2024
SEBI CSCRF issued
The Cybersecurity and Cyber Resilience Framework for entities regulated by SEBI.
May 2027
DPDP duties for lenders and insurers
Notice, security safeguards, breach intimation and one-year retention of logs under the DPDP Rules.
What is changing for Indian financial institutions
Supervisors expect evidence, not policy
RBI’s directions on IT governance and on managing risks in outsourcing, including IT services, and SEBI’s Cybersecurity and Cyber Resilience Framework (CSCRF) ask regulated entities to show how technology risk and suppliers are controlled. Cloud and AI providers sit inside that picture.
Six hours to report an incident
CERT-In’s Directions require listed cyber incidents to be reported within six hours of noticing them, and the DPDP Rules add breach intimation to the Data Protection Board of India from May 2027. Detection, triage and evidence collection have to work at that pace.
SourceG.S.R. 846(E)
Customers measure you against the best app on their phone
Instant payments and digital onboarding have taught customers to expect answers in minutes. Branch staff and contact centres need the same view of the customer that the app already shows.
Core systems carry decades of product logic
Core banking and policy administration systems still hold the books and the product rules. Change has to happen around them, through APIs and events, without risking stability or regulatory returns.
Problems we are asked to solve
- The problem
Onboarding and periodic KYC updates depend on staff reading documents by hand.
What we would doDocument intelligence extracts and cross-checks identity, address and income documents. Staff review every flagged case, and each check is logged for inspection.
- The problem
Relationship managers and service staff open several systems to answer a single customer.
What we would doAn assistant over products, circulars and procedures that respects access rights, cites its source and records what it displayed, so the interaction record stays complete.
- The problem
Each change to the core banking system is slow, costly and risky.
What we would doCore functions are exposed through APIs and event streams and moved out step by step, with reconciliation running until the old route can be switched off.
- The problem
The outsourcing register and the incident workflow live in spreadsheets.
What we would doWe build the register of technology suppliers, incident classification and reporting workflows into your service management and cloud tooling, linked to the business functions they support, so a six-hour report draws on facts already recorded.
- The problem
Models that cannot be explained fail internal validation.
What we would doAn evaluation framework set with your risk and model validation teams: test sets, explanations where the decision needs them, drift monitoring and a documented override by an authorised officer.
- The problem
Regulatory returns are reconciled by hand in every reporting cycle.
What we would doPipelines with recorded lineage and automated quality checks, so that each reported figure leads back to the system it came from.
A control-first reference design
Where AI sits between channels and core systems, with a maker-checker gate on every consequential step and the controls your regulators and European clients expect running beside each layer.
Illustrative example
No AI service talks to a core system except through the integration layer, and supervisory and security controls cover every component.
Read the diagram as text
Customers, relationship managers and service staff reach the institution through the app, the website, branches and the contact centre.
Three AI services sit behind those channels: intake of onboarding and KYC documents, an assistant for relationship managers and service staff, and a checker step where an authorised officer approves any decision with consequences.
The AI services never call core systems directly; they go through an integration layer of APIs and event streams. Behind it sit core banking or policy administration, the CRM and service platform, and a data platform whose lineage is documented.
Running alongside every layer are the supervisory and security controls: IT governance and risk, the register of IT and outsourcing providers, incident triage with reporting to CERT-In, and resilience and recovery testing. Every model is registered, validated and monitored under your model risk policy.
Checker before consequence
AI prepares drafts, extracts data and makes suggestions. An authorised officer approves any decision on credit, claims or restrictions on an account.
Explanation settled up front
How much explanation each decision type needs is agreed during design, not added just before validation.
A planned exit from every provider
Cloud and model providers are chosen with exit plans and substitution paths recorded for your outsourcing register.
Logs that rebuild a case
Inputs, outputs, model versions and approvals are kept for the periods your regulators and the DPDP Rules require, so that an inspection team can rebuild any case.
Indian and EU dates for financial institutions
Dates that change what a technology partner must be able to show. RBI, SEBI and the European supervisory authorities add directions, circulars and technical standards on top.
In force
SEBI CSCRF: Cyber resilience framework for SEBI-regulated entities
One framework for cybersecurity and cyber resilience across market intermediaries and other regulated entities, with later clarifications.
In force
DORA: EU operational resilience rules apply
ICT risk, register of ICT third parties, incident reporting and testing for EU financial entities.
In force
AI Act: Banned practices and AI literacy duties
In force
AI Act: Transparency duties apply
Customers in the EU must be told when they are dealing with an AI system.
Position on 6 November 2026
Ahead
AML Regulation: Single EU AML rulebook applies
Customer due diligence, beneficial ownership and record-keeping harmonised across the EU.
Ahead
AI Act: High-risk duties apply
Including creditworthiness assessment and life and health insurance pricing, under the 2026 amendment.
Ahead
AMLA: AMLA begins direct supervision
EU rules that reach Indian financial firms
Indian regulated entities answer to RBI, SEBI and CERT-In first. These EU instruments matter when you serve EU clients, run EU subsidiaries or supply technology to European financial entities; each entry explains how.
An orientation for planning, not legal or regulatory advice. Indian rules are summarised as they stood on 6 November 2026; EU dates reviewed on 2 October 2026.
- DORAScopeEU instrument
Applies to EU financial entities since 17 January 2025, from banks and insurers to investment firms and payment institutions. Each ICT contract they sign has to include the clauses listed in Article 30, wherever the provider sits, and a non-EU provider designated as critical must establish an EU subsidiary within 12 months of that designation (Article 31(12)).
How it affects youAn Indian IT firm serving EU banks meets DORA through its contracts. As a supplier we carry our part: contract terms, incident notification, exit plans, participation in testing and the details your client’s register requires.
SourceRegulation (EU) 2022/2554, EUR-Lex (opens external site)
- EU AI ActScopeEU instrument
Classes AI that scores the creditworthiness of individuals, or prices life and health cover, as high-risk. Risk controls, data governance, logs, human oversight and technical documentation follow from 2 December 2027 under the 2026 amendment. An Indian lender or insurer is caught when the output of its AI is used in the Union (Article 2(1)(c)).
How it affects youIn India, MeitY’s India AI Governance Guidelines are non-binding, but an inspection will still ask how a credit decision was reached. We classify each use case early, keep a credit officer in the decision and document the model within your model risk policy.
SourceRegulation (EU) 2024/1689, EUR-Lex (opens external site)
- EU AML package (AMLR and AMLA)ScopeEU instrument
The Anti-Money Laundering Regulation brings one EU-wide set of customer due diligence rules from 10 July 2027, in place of national ones. A new EU authority, AMLA, steers national supervisors and will take direct supervision of a selection of high-risk institutions.
How it affects youRelevant to Indian groups whose EU subsidiaries onboard customers there. Evidence handling must then be consistent across India and the EU, and we design document intake and case flows to that standard.
SourceRegulation (EU) 2024/1624, EUR-Lex (opens external site)
- GDPR and automated decisionsScopeEU instrument
Under Article 22, a person in the EU need not accept a decision taken purely by automated means that significantly affects them; where an exception allows such a decision, safeguards such as human review and a route to challenge it must be in place. Article 3(2) extends the GDPR to an Indian institution offering services to people in the EU.
How it affects youAt home, the DPDP Act sets the duties of a Data Fiduciary from May 2027. Under either law, we design so that an officer can review, explain and change an automated outcome, and the system records that they did.
SourceRegulation (EU) 2016/679, EUR-Lex (opens external site)
- MiFID II and IDD advice recordsScopeEU instrument
Under EU rules on investment and insurance distribution, a firm assesses suitability or the customer’s demands and needs and keeps a record of the advice. Once an AI tool helps the adviser, its contribution belongs in that record too.
How it affects youFor any advisory channel, in India or in the EU, our assistants log what they displayed and the sources behind it, so the advice file remains complete and open to review.
- PSD2 and the next payment services rulesScopeEU instrument
PSD2 sets the EU rules for payment services and for third-party access to accounts. Provisional agreement was reached in 2025 on its successors, PSD3 and a Payment Services Regulation, which after a transition will raise the bar for fraud prevention and API performance.
How it affects youRelevant to Indian payment companies with customers in the EU. API platforms built today should expect stricter duties on performance, monitoring and the sharing of fraud data.
SourceDirective (EU) 2015/2366, EUR-Lex (opens external site)
Illustrative use cases
Illustrative exampleKYC document checks
At an NBFC, identity, address and income documents are extracted and compared; staff take the decision on each flagged case.
Compliance knowledge assistant
Answers from RBI master directions, SEBI circulars and internal policy, with the source paragraph shown and within each user’s access rights.
Complaint intake and routing
Complaints sorted by subject and urgency, passed to the right desk with a draft summary, and response deadlines tracked.
Motor and health claims intake
At a general insurer, claim forms, hospital bills and survey reports are read and checked against the policy; claims handlers approve each payment.
Core banking behind APIs
A co-operative bank’s core transactions published as documented APIs and events, so that new channels stop relying on batch files.
Platforms in banking, insurance and capital markets
Salesforce
Summit PartnerRelationship manager workspaces, onboarding journeys and service operations for banks and insurers, with DPDP consent records and links to the core and to document intake.
SAP
Gold PartnerFinance and group reporting for financial groups with Indian and European entities, with SAP data feeding risk and regulatory reporting through documented lineage.
Partner tiers shown are FromNine’s own. Product names belong to their respective owners.
India
Indian supervision at home, DORA through European clients
Regulated entities in India answer to RBI or SEBI, report cyber incidents to CERT-In within six hours and, from May 2027, carry the Data Fiduciary duties of the DPDP Rules. RBI’s directions on managing risks in outsourcing, including IT services, and SEBI’s CSCRF set out what they must show about their technology suppliers.
Indian IT firms that serve EU banks and insurers meet a second layer: the DORA contract terms of Article 30 and, for a provider designated critical, an EU subsidiary within 12 months. We produce the evidence once, in a form that both an Indian inspection and a European client can use: architecture and model records, logs, test results and current exit plans.
- CERT-In Directions 2022CERT-In Directions of 28 April 2022 under s. 70B(6) of the IT Act: reporting of listed cyber incidents within 6 hours, log retention, time synchronisation (opens external site)
- DPDP Act 2023Digital Personal Data Protection Act, 2023, also covering processing outside India connected with offering goods or services to Data Principals in India (opens external site)
- DPDP Rules 2025Digital Personal Data Protection Rules, 2025, brought into force in three steps over eighteen months (opens external site)
- DORADigital Operational Resilience Act, Regulation (EU) 2022/2554 (opens external site)
- EU AI ActArtificial Intelligence Act, Regulation (EU) 2024/1689 (opens external site)
- GDPRGeneral Data Protection Regulation (EU) 2016/679 (opens external site)
Frequently asked questions
We serve EU banks. How do you help with their DORA requirements?
As your subcontractor, we accept the Article 30 clauses your EU client passes down, report incidents through the channel agreed with you, keep exit plans documented, join resilience tests and provide the details your client needs for its register of ICT third parties.
Can AI be used in credit or underwriting decisions?
Yes, with care. The credit or underwriting officer makes the decision and must be able to explain it; the model is documented, monitored and logged. If the output is used in the EU, the AI Act classes creditworthiness assessment as high-risk and the GDPR rules on automated decisions apply.
Where would models and data run?
Where your regulators and your risk appetite allow: your own cloud tenancy, a cloud region you select, or on premises for the most sensitive workloads. Each choice is documented with exit options for your outsourcing register, and a stricter rule in your sector takes precedence, as section 16(2) of the DPDP Act provides.
Must we replace our core banking system?
No. Integration comes first, then modernisation in stages: APIs and events around the core, functions moved out only where the case is clear, and reconciliation until the old route is retired.
How do you test generative AI in a regulated process?
Test sets and acceptance criteria are agreed with your risk and validation teams before go-live; monitoring continues afterwards, and uncertain output goes to a checker. We plan on the basis that some output will be wrong and must reach a person.
Discuss your banking or insurance programme
Planning AI in onboarding, lending or claims, tightening incident readiness for the six-hour window, or preparing for a European client’s DORA review? Talk to engineers who design for inspectors as well as users.