RBI Digital Payment Security Controls (MD-DPSC) Checklist

Audit payment gateways and mobile banking against RBI MD-DPSC 2021. Check AFA 2FA, Card-on-File Tokenization (CoFT), 5-min auto-logout, root detection, and SSL pinning.

⚡ Interactive Calculation Engine Active

Please enable JavaScript in your browser to run live computations, 2D envelope diagrams, and export PDF reports.

How to Use RBI Digital Payment Security Controls (MD-DPSC) Checklist

  1. Evaluate your payment infrastructure against the statutory security controls matrix.
  2. Explore the Threat & Defense Simulator to inspect countermeasures against MITM and SIM swaps.
  3. Review compliance with Card-on-File Tokenization (CoFT) and escrow account segregation.
  4. Export the Digital Payment Security Audit Memorandum.

Mobile Application Security Standards in Indian Banking

RBI MD-DPSC Section 27 requires banking apps to actively detect rooted/jailbroken devices, modified bootloaders, and enforce SSL certificate pinning against MITM proxies.

Frequently Asked Questions

Can merchants store raw credit or debit card numbers?
No. RBI's CoFT guidelines prohibit merchants and payment aggregators from storing actual card numbers (PAN), CVV, or expiry. All stored cards must be surrogate network tokens.