A few years ago, one of our NBFC clients almost lost a deal worth ₹4 crore because their loan origination software couldn’t produce an audit trail fast enough during a RBI inspection. The product was good. The security was decent. But “decent” doesn’t cut it when a regulator asks for encryption logs from 18 months ago in the next 48 hours.
That incident reshaped how we approach every BFSI project at Speqto Technologies. If you’re a software vendor selling into banks, NBFCs, insurance companies, or fintech startups, compliance isn’t a checkbox you tick before launch — it’s a living system you maintain. Here’s the checklist we actually use with clients, not the generic one you’ll find in a whitepaper.
1. Data Classification Before Anything Else
Most vendors jump straight to encryption without first classifying what they’re protecting. We had a payments client store KYC documents, transaction logs, and internal support chat exports all in the same S3 bucket with identical access controls. That’s a red flag for any auditor.
- Tag data as PII, financial, operational, or public-facing
- Apply access controls proportional to sensitivity — not everyone in engineering needs read access to Aadhaar numbers
- Maintain a data inventory document; RBI and IRDAI auditors will ask for this by name
2. Encryption — At Rest, In Transit, and In Use
Every BFSI vendor claims “we use encryption.” The question auditors actually ask is which standard, which key length, and who holds the keys.
- AES-256 for data at rest, TLS 1.2 or higher for data in transit
- Use a dedicated KMS (AWS KMS, Azure Key Vault, or HashiCorp Vault) instead of hardcoding keys in config files — we still see this in legacy fintech codebases during audits
- Rotate keys on a defined schedule (90 days is a reasonable default for BFSI workloads)
3. Access Management That Survives an Offboarding Mess
One insurance-tech client of ours discovered, during a SOC 2 readiness review, that a developer who left the company eight months earlier still had production database access. Nobody had revoked it because offboarding was a manual Slack message, not a workflow.
- Implement role-based access control (RBAC) tied to HR systems, not manual tickets
- Enforce MFA on every system touching customer financial data — no exceptions for “just the dev environment”
- Run quarterly access reviews and document them; this alone satisfies a large chunk of ISO 27001 Annex A controls
4. Audit Trails That Actually Hold Up
Going back to the NBFC story — the real gap wasn’t security, it was traceability. Regulators want to see who accessed what, when, and why.
- Log every access to customer financial records with timestamp, user ID, and action taken
- Store logs in immutable, write-once storage for at least the regulatory retention period (typically 8-10 years for BFSI in India)
- Build a searchable audit dashboard — if your team needs three days to pull logs, you’ve already failed the inspection
5. Map Your Framework to the Right Regulator
A common mistake we see: vendors chase ISO 27001 certification while ignoring RBI’s specific outsourcing and data localization guidelines, which actually matter more to their bank clients.
- RBI: Data localization for payment systems data, cybersecurity framework for banks and NBFCs
- IRDAI: Specific guidelines for insurers on outsourcing and data protection
- SEBI: Cybersecurity and cyber resilience framework for market intermediaries
- DPDP Act, 2023: Consent management, breach notification within prescribed timelines, data principal rights
We built a compliance mapping sheet for a wealth-tech client that cross-referenced RBI, SEBI, and DPDP requirements against their existing controls. It saved them roughly six weeks of back-and-forth during their bank partnership’s vendor due diligence.
6. Vendor and Sub-Processor Risk
If you use a third-party OTP gateway, cloud host, or analytics tool, your BFSI client’s auditors will ask about them too. We insist every client maintain:
- A signed data processing agreement (DPA) with every sub-processor
- Evidence of their sub-processors’ own security certifications
- A clear data flow diagram showing where customer data physically travels
7. Incident Response That’s Rehearsed, Not Just Written
A written incident response plan sitting in a Google Doc isn’t a plan — it’s a formality. Run tabletop exercises twice a year. One of our lending platform clients simulated a card-data leak scenario and discovered their “immediate customer notification” process actually took 11 hours due to approval bottlenecks. They fixed it before it became a real crisis.
Final Thought
BFSI compliance isn’t about surviving an audit once. It’s about building software where security and traceability are baked into the architecture, so the next audit — and the one after that — is just another Tuesday. At Speqto, this checklist isn’t theoretical; it’s the same framework we run through with every BFSI and fintech client before their product goes anywhere near a bank’s procurement team.
