This talk was presented in NULL Delhi chapter meet in October 2016, as an insight into the world of Digital wallets and the regulations enforced on them by Government of India and RBI.

1. Security Ecosystem for
Digital Wallets
BY -
SAUMYA VISHNOI

2. Who am I ?
 Information Security profession – about 6 years of experience
Ex- PCI QSA
Audited multiple wallet environments
Currently working with a Fintech organization

3. Disclaimer
All the information, discussion and views
presented in the talk are
personal !!!

4. What is Digital Wallet ?

5. Digital Wallet
A digital application that works like a wallet ----
you add money into it and then you can spend the money out of it

7. Types of Digital wallet
Closed loop
Semi-open loop
Open loop

8. How safe are wallets ?

9. RBI
(Reserve Bank of India)

10. Regulatory Controls
 RBI Payment and Settlement Act 2007
 RBI PSS Audit – CISA audit – external
 Internal Audit
 AML controls (Anti- Money Laundering )
 Fraud management
 Penalty clause
Basically Risk Management !!!

12. PSS Audit – CISA audit – external
• External ISMS audit by a qualified CISA professional
•Submission of the audit report to RBI
•RBI review and approve/or send back with comments.
•Once approved --- RBI license is issued
•Internal audit schedule and review
•audit and risk committee responsibility
•Yearly external audit exercise and report submission to RBI

13. AML controls (Anti- Money Laundering )
• Required to be compliant to Prevention of Money Laundering Act, 2002
•KYC and non-KYC accounts
•Balance limitations
•Regular monitoring for suspicious behavior
•AML training to employees

14. Fraud Management
• Establishment of Fraud team
•Regular monitoring for suspicious behavior
•Assisting law enforcement agencies in Investigating fraud incidents
•Blacklisting mechanism
•Blocking/Unblocking account
•Customer awareness

15. Penalty Clause
 Section 30 of PSS Act --- Power of Reserve Bank to impose fine
 Section 31 of PSS Act --- Power to compound offences
Nature of offence --
 Breach of provisions of the act.
 Non- compliance of directions
 Violations of tem and conditions of authorization
Amount of Penalty – Depends upon the nature of offence, with a min of 5 Lakhs

18. Trust