What changed
This circular reiterates the requirement for annual system audit reports from CISA-qualified auditors, originally introduced in December 2009. It specifies clear submission deadlines based on the entity's financial year: June 1 for April-March entities and March 1 for calendar-year entities.
What it means for you
Banks and payment system operators must ensure their system audits are conducted annually by a CISA-certified professional. Missing the deadlines could invite regulatory scrutiny under the Payment and Settlement Systems Act, 2007. This strengthens oversight of IT and payment system security.
What you must do
- Engage a CISA-qualified auditor for your annual system audit immediately if not already done.
- Align your audit cycle with your financial year closing to meet the June 1 or March 1 deadline.
- Submit the system audit report to RBI within the stipulated two-month window post year-end.
- Review your current audit schedule to ensure compliance with this circular.
Who it affects
All scheduled commercial banks, Authorised payment system operators
What is the deadline for submitting the system audit report?
For entities following an April-March financial year, the report must be submitted by June 1. For those following a calendar year, the deadline is March 1 of the following year.
Who can conduct the system audit?
The audit must be performed by a CISA-qualified auditor, as specified in the circular.
What is the legal basis for this requirement?
These directions are issued under Section 6(1) of the Payment and Settlement Systems Regulations 2008 read with Section 12 of the Payment and Settlement Systems Act, 2007.