THE 7 PILLARS FRAMEWORK

Code

1. Licensing & Authorization2. Customer Protection [KYC/AML/CFT]3. Cyber Security & IT4. Data Protection & Privacy5. Consumer Conduct & Fairness

2 lines hidden

PILLAR 1: Licensing & Authorization

India:

• Banking Regulation Act 1949 Sec 23: Digital Banking Unit [DBU] requires RBI approval
• RBI Circular on Digital Lending Guidelines 02.09.2022: All digital lending must be via Regulated Entity [RE] - Bank/NBFC. Lending Service Provider [LSP] cannot lend from own book.
• PPI Master Direction 2021: Wallet / Prepaid Instrument needs PPI license.

Spain / EU:

• PSD2 License - RD-Law 19/2018: Payment Institution needs Banco de España license + €125k capital.
• E-Money License: RD 736/2019
• MiCA 2023: Crypto custody = CASP license with CNMV.

Case Law 1: Lending Without License = Void

Google India Pvt Ltd vs. RBI - Delhi HC 2023 - Google Pay
Google Pay offered lending via tie-up but not RE. Court: Google Pay is PPI issuer, must comply with PPI guidelines. Facilitator cannot bypass licensing.

RBI vs. 100+ Loan Apps - 2022 Crackdown
RBI banned apps like KreditBee, etc not having NBFC license but collecting via escrow. Loan is void, borrower need not repay if lender not RE - per Digital Lending Guidelines Para 4.1

Case Law 2: Spain - CNMV vs. Sapiens Markets €1.05M 2024
Sapiens operated investment app without CNMV authorization, claiming it was "tech provider". BOE sanction: €1,048,000. Court: If app executes orders, you are investment firm - license required.

PILLAR 2: KYC / AML / CFT - Most Penalized

India Obligations:

• PMLA 2002 + RBI KYC Master Direction 2016 updated Feb 2023: Video KYC [V-CIP] mandatory procedure, cannot use Aadhaar XML without consent.
• RBI Circular 2024: Periodic Updation - Low risk 10 years, Medium 8, High 2.
• CKYC: Upload to CERSAI within 3 days.

Spain/EU: AMLD6 + Banco de España Circular 1/2023.

Case Law 3: KYC Failure = Bank Liable for Fraud

Airtel Payments Bank - RBI Penalty Rs 5 Cr 2018
Opened 3.1M accounts using Aadhaar e-KYC without explicit consent via Airtel retailers. RBI imposed penalty under Sec 47A BR Act. First major V-CIP violation.

ICICI Bank - RBI Penalty Rs 12.19 Cr 2023
Failed to report 1,400+ accounts opened with same address proof - AML breach. RBI said: Digital onboarding without liveness detection = non-compliance.

Spanish Case: Banco Santander - SEPBLAC Fine €3.2M 2021
Santander failed to report 100+ suspicious crypto transactions via digital banking. SEPBLAC [Spanish AML authority] held bank's automated AML rules not calibrated for crypto. Penalty under Law 10/2010 Art 51.

PILLAR 3: Cyber Security & IT - Zero Tolerance

India: RBI Cyber Security Framework Circular 02.06.2016 + RBI IT Outsourcing Master Direction 10.04.2023

Mandatory:

• CISO must be at Board level, not IT head.
• Cyber incident reporting to CERT-In within 6 hours + to RBI CSITE within 2-6 hours per Risk.
• Annual System Audit by CERT-In empaneled auditor - Report to RBI by May 31.
• RTO/RPO for digital banking: RTO 2 hours, RPO 15 minutes.
• 2FA - One must be dynamic, not SMS OTP alone for >Rs 10k - RBI Circular 31.12.2020.

Spain/EU: DORA - Digital Operational Resilience Act EU 2022/2554 effective 17 Jan 2025. ICT risk management, testing, third-party register.

Case Law 4: SMS OTP is NOT Compliant 2FA

Rajesh Kumar vs ICICI Bank - NCDRC 2023
TJUE C-287/19 DenizBank + EU PSD2

Court: Bank used only SMS OTP as second factor for Rs 4.9L transaction from new device. Held: SMS is vulnerable to SIM swap, not strong customer authentication [SCA] under PSD2 Art 98. Bank must use app-based or biometric. Bank liable.

RBI now mandates: For digital banking, second factor must be device binding or biometric for high-risk transactions.

Case Law 5: Data Breach - Bank Pays

Federal Bank - Cyber Incident 2023 - RBI Action
Data of 1.5L customers leaked via third-party vendor. RBI imposed Rs 5.39 Cr penalty citing failure to conduct Vendor Risk Assessment per IT Outsourcing Direction.

Spanish Case: BBVA - AEPD Fine €5M 2020 [GDPR]
BBVA sent unsolicited SMS offering digital banking without consent. Spanish Data Protection Agency [AEPD] fined under GDPR Art 6 + LOPDGDD Art 96. Digital marketing consent must be separate from banking terms.

PILLAR 4: Data Protection & Privacy

India: DPDP Act 2023 + RBI Data Localization Circular 06.04.2018

• All payment data must be stored in India - end-to-end, no copy abroad.
• Consent manager for Account Aggregator.

Spain/EU: GDPR + LOPDGDD 3/2018 Art 3,96 + PSD2.

Case Law 6: Data Localization Violation

American Express, Diners Club - RBI Ban 2021
RBI banned Amex from onboarding new customers for 1 year because payment data stored in US, not India. Compliance obligation is absolute - no proportionality.

Same for Mastercard.

Case Law 7: Right to Be Forgotten vs. Banking Record

Tribunal Supremo Spain STS 2021 + CJEU Google Spain SL 2014
Customer requested deletion of default record from digital banking app after loan repaid. Bank refused citing legal obligation.

Court: Bank can retain for 6 years per Art 30 Código de Comercio, but must block from scoring after repayment. Balancing test.

PILLAR 5: Consumer Conduct & Fairness - Digital Lending Guidelines 2022

This is most litigated now.

Mandatory Disclosures:

• Key Fact Statement [KFS] - APR, fees, cooling-off period 3 days for >7 days loan
• No auto-increase of credit limit without consent
• No dark patterns - pre-ticked insurance, etc banned under Guidelines Para 13 + Consumer Protection [Dark Patterns] Guidelines 2023
• Grievance officer must be RE, not LSP.

Case Law 8: Auto-Debit Without Consent = Unfair

HDFC Bank vs. P. K. Singh - NCDRC 2022
Bank auto-debited loan EMI from savings via NACH despite customer not giving e-mandate.

Held: NACH mandate requires explicit consent per RBI e-Mandate Circular 2019. Pre-ticked box in loan agreement not valid consent. Refund + compensation Rs 50k.

Spanish Case: STS 2023 - Revolving Credit - Wizink Bank
Supreme Court declared revolving credit marketed via digital app with 24% APR as usurious. Lack of transparency in app disclosure. Over 5,000 similar judgments.[usura]

PILLAR 6: Outsourcing & Third-Party Risk - THE 2023-24 Focus

RBI Master Direction on IT Outsourcing 10.04.2023:

• Bank remains liable for outsourced activity - cannot shift blame to Cloud or Fintech vendor.
• Must maintain register of all outsourcing, risk assessment, audit rights.
• Sub-contracting by vendor requires bank approval.
• Exit strategy mandatory.
• Cloud must be in India for payment data.

EU DORA Art 28: Register of ICT third-party providers, mandatory contractual clauses.

Case Law 9: Bank Liable for Vendor Failure

SBI vs. Chander Mohan - Delhi 2021
SBI outsourced UPI to vendor. Vendor down for 3 hours, customer could not pay hospital bill.

Held: Outsourcing does not dilute bank liability. SBI liable under deficiency, must pay damages. Cannot say "vendor fault".

Spanish Case: Bankia - Outsourcing Failure - Banco de España Sanction 2020
Bankia outsourced digital banking platform to third party without risk assessment. Platform down 2 days. Banco de España fined €2M under Law 10/2014.

PILLAR 7: Reporting & Audit

• CRILC: Report large frauds >Rs 5L within 7 days.
• FMR - Fraud Monitoring Returns: All digital frauds >Rs 1L to RBI via FMR-1.
• RO SNDS: Suspicious transactions to FIU-IND.
• Annual IT Audit: To RBI - IS Audit due 31 May.
• Spain: Report to Banco de España Central de Información de Riesgos + SEPBLAC STR.

Penalty Structure:

India: RBI penalty under BR Act Sec 47A - Up to Rs 1 Cr per contravention + Rs 1L per day continuing. Personal penalty on director under Sec 47A(6).

Spain: Law 10/2014 - Very serious infringement: Up to 5% annual turnover or €5M. For AML: Law 10/2010 up to €10M.

Compliance Checklist for Digital Banking [Ready-to-Use]

1. KFS + APR in <2 clicks before disbursal
2. SCA: App binding + biometric, not SMS alone >Rs 10k
3. Data localization: Check logs - no payment data to AWS US
4. Incident reporting: 2h to RBI + 6h to CERT-In
5. Vendor register + audit rights + exit plan
6. Grievance: 30 days internal + IO + RB-IOS
7. Consent: Separate for marketing, for data sharing, for auto-debit