Cybersecurity for FinTech Companies India | PCI DSS & VAPT

FinTech-Specific Compliance Requirements in India

Indian fintechs operate under a complex and evolving compliance landscape. The right
cybersecurity program satisfies multiple overlapping regulatory requirements without
creating duplicate work.

PCI DSS — Payment Card Industry Data Security Standard

Any fintech that stores, processes, or transmits payment card data — or that provides
services to entities that do — must comply with PCI DSS. In India, RBI’s Payment
Aggregator (PA) and Payment Gateway (PG) guidelines explicitly mandate PCI DSS compliance
for authorized payment aggregators. PCI DSS Level 1 (annual QSA assessment) is required
for fintechs processing more than 6 million transactions annually. Non-compliance can result
in RBI de-authorizing the PA license and card network fines.

RBI Payment Aggregator and Payment Gateway Guidelines

RBI’s 2020 guidelines (updated 2022) regulate payment aggregators and gateways operating
in India. Cybersecurity requirements include: PCI DSS compliance, ISO 27001 or equivalent
ISMS, annual IS audit by a CERT-In empanelled organization, VAPT of all payment systems,
and mandatory CERT-In incident reporting. New PA license applicants must demonstrate
compliance before authorization is granted.

Digital Personal Data Protection Act 2023

Every Indian fintech processes personal data — loan applications, KYC records, transaction
histories, investment portfolios. The DPDP Act creates data fiduciary obligations including
purpose limitation, data minimization, security safeguards, breach notification, and data
subject rights. Fintechs handling large volumes of personal financial data may be designated
as Significant Data Fiduciaries with enhanced obligations.

ISO 27001 — Enterprise Client and Investor Requirement

ISO 27001 is required by enterprise clients, particularly banks and financial institutions,
for their fintech partners and API integrations. It is also a common condition from PE/VC
investors at Series A and Series B. ISO 27001 provides the governance framework for
fintech information security that satisfies due diligence requirements across multiple
stakeholder audiences.

SOC 2 Type II — US Market and API Partners

Fintechs targeting US enterprise clients or partnering with US financial institutions need
SOC 2 Type II attestation. SOC 2 is distinct from ISO 27001 — it is an attestation report
rather than a certificate, based on the AICPA Trust Services Criteria. MDIT designs ISMS
frameworks that satisfy both ISO 27001 and SOC 2 requirements simultaneously.

RBI Lending Guidelines — Digital Lending Platforms

RBI’s Digital Lending Guidelines (2022) impose specific data security requirements on
digital lending platforms, including restrictions on data collection, requirements for
transparent data handling, and obligations to ensure the security of borrower data
processed by lending service providers.

Common Cybersecurity Vulnerabilities in Indian FinTech Platforms

MDIT’s penetration testing and VAPT work across Indian fintech companies has identified
recurring vulnerability patterns that put customer financial data and regulatory compliance
at risk.

Broken Authentication in Mobile Banking Apps

Many Indian fintech mobile applications implement authentication incorrectly: OTP bypasses
through race conditions, absence of rate limiting on OTP validation endpoints, session
tokens that do not expire, and authentication logic implemented on the client side
(easily manipulated). These vulnerabilities allow account takeover without the user’s
knowledge or credentials.

Insecure API Design

Fintech platforms rely heavily on APIs — for UPI integration, lending bureau connectivity,
partner bank integration, and internal service communication. Common API security failures
include: missing or broken object-level authorization (allowing users to access other
users’ financial data by manipulating resource IDs), verbose error messages exposing
internal system details, absence of rate limiting enabling enumeration attacks, and
improper JWT validation enabling token forgery.

SQL Injection in Lending Platforms

Lending and credit assessment platforms with web-based loan management interfaces frequently
contain SQL injection vulnerabilities in search functions, loan status queries, and reporting
modules. Successful exploitation can expose the entire loan book — customer names, PAN
numbers, Aadhaar-linked data, account numbers, and credit scores.

Unencrypted PAN and Financial Data Storage

PCI DSS requires that Primary Account Numbers (PANs) be stored only in encrypted form or
masked for display. MDIT regularly discovers Indian fintech applications storing PANs,
CVVs, or full card numbers in plaintext in databases, log files, or application caches —
creating immediate PCI DSS non-compliance and massive breach risk.

Insecure Third-Party SDK Integration

Indian fintech mobile applications typically integrate multiple third-party SDKs for analytics,
crash reporting, customer support, and payment processing. These SDKs often receive access
to sensitive financial data and may have their own security weaknesses. A compromised SDK
represents a supply chain attack vector that MDIT tests as part of mobile app VAPT.

Missing Certificate Pinning

Fintech apps without SSL certificate pinning are vulnerable to man-in-the-middle attacks
that intercept communication between the app and its servers. Attackers on the same network
(coffee shop Wi-Fi, airport networks) can capture authentication tokens, session cookies,
and financial transaction data. Certificate pinning is a basic control that many Indian
fintech apps still lack.

MDIT’s FinTech Cybersecurity Services

Mobile Application VAPT (iOS and Android)

Comprehensive security testing of fintech mobile applications using OWASP Mobile Security
Testing Guide (MSTG) methodology. Covers static analysis (decompiled source review),
dynamic analysis (runtime manipulation, traffic interception), API security testing,
authentication and session management testing, data storage analysis, and third-party SDK
security review. Reports include severity ratings and developer-ready remediation guidance.

Web Application Penetration Testing

Black-box and grey-box penetration testing of fintech web applications — lending portals,
investment dashboards, payment gateways, and merchant management interfaces. OWASP Top 10
coverage plus business logic testing specific to financial operations (transaction
manipulation, balance negative tests, authorization bypass for financial functions).

API Security Testing

Dedicated API security assessment for fintech platforms — REST, GraphQL, and SOAP API
endpoints. OWASP API Security Top 10 coverage, authentication testing, authorization
testing, injection testing, mass assignment vulnerability discovery, and rate limiting
validation. Includes UPI API, payment gateway API, and partner bank API integration testing.

PCI DSS Compliance Program

End-to-end PCI DSS compliance for Indian payment aggregators and card-handling fintechs.
Scope definition to minimize the cardholder data environment (CDE), gap assessment, network
segmentation review, cardholder data discovery, logging and monitoring setup, and QSA
coordination. We help clients achieve and maintain PCI DSS Level 1 or Level 2 compliance
as required by their transaction volumes and RBI authorization.

ISO 27001 Certification for FinTech

Fast-track ISO 27001:2022 implementation designed for fintech teams — cloud-native,
fast-moving, and often under-resourced for compliance work. Pre-built templates for lending,
payment, and investment platforms. 60–90 day certification path for startups and growth-stage
companies. Dual alignment with PCI DSS, RBI PA/PG guidelines, and DPDP Act obligations.

Cloud Security Assessment

Security assessment of fintech cloud infrastructure on AWS, GCP, or Azure. Covers IAM
configuration, network security groups and VPC design, storage bucket access controls,
encryption configuration, logging and monitoring gaps, and container security for
microservices architectures. Aligned to CIS Benchmarks and cloud provider security
best practices.

DPDP Act Compliance Advisory

Fintech-specific DPDP Act compliance program covering personal data inventory, data flow
mapping, consent management assessment, privacy notice review, data retention policy
development, breach notification procedure, and Data Protection Officer advisory support.

SOC 2 Readiness Assessment

Gap assessment against SOC 2 Trust Services Criteria (Security, Availability, Confidentiality,
Processing Integrity, Privacy) for fintechs targeting US market entry or US enterprise clients.
We design a combined ISMS that satisfies both ISO 27001 and SOC 2 requirements to avoid
dual compliance programs.

FinTech Security at Each Growth Stage

Security requirements evolve as fintechs grow. Here is what matters at each stage:

Seed Stage (Pre-Revenue to INR 5 Crore ARR)

At seed stage, the focus is on establishing security foundations that will scale without
creating technical security debt that becomes expensive to fix later.

• Secure development practices and code review process
• Cloud infrastructure security baseline (IAM, logging, encryption)
• Initial VAPT before first production launch
• Basic data classification and access control policies
• Vendor and third-party SDK due diligence

Series A (INR 5–50 Crore ARR)

Series A fintechs typically have first enterprise clients, early RBI regulatory obligations
(if payment or lending), and investor security diligence requirements.

• ISO 27001 certification (investor condition or enterprise client requirement)
• PCI DSS gap assessment if handling card payments
• Quarterly VAPT of web and mobile applications
• Incident response procedure and retainer
• Security awareness training program
• DPDP Act compliance baseline

Series B / Growth Stage (INR 50–500 Crore ARR)

Growth-stage fintechs have significant regulatory exposure, enterprise client security
audits, and increasing sophistication of targeting by threat actors.

• PCI DSS certification (Level 1 or 2 based on transaction volume)
• 24×7 SOC or SIEM deployment
• Red team exercise (simulated targeted attack)
• Third-party risk management program for API partners and vendors
• SOC 2 Type II (US market entry requirement)
• Vulnerability management program with continuous scanning

Pre-IPO / Large FinTech (INR 500 Crore+ ARR)

Pre-IPO fintechs and large established platforms face board-level security governance
expectations, SEBI requirements, and the security scrutiny of public market investors.

• Full security governance program (CISO advisory or virtual CISO)
• Annual red team and purple team exercises
• Mature third-party risk program with continuous vendor monitoring
• Regulatory relationship management (RBI, SEBI, CERT-In)
• M&A security due diligence support for acquisitions
• Board cybersecurity reporting framework

Frequently Asked Questions — FinTech Cybersecurity