Every regulator, one platform.
RBI Cybersecurity Framework, CERT-In Directions, DPDP customer data, outsourcing register, STR/CTR. Ship fast, stay inspection-ready. No consultant on retainer. dcomply unifies every regulator into a single compliance calendar, one evidence locker, and modules that fintechs and NBFCs operate day to day.
Managed DPO retainer · Rs 29,999/mo · advocate on recordEvery Indian fintech lives under all of these.
DPDP is the foundation. RBI CSF, Digital Lending and CERT-In sit directly on top. SEBI CSCRF applies if listed. PMLA is the operational baseline.
Four pain points, one console.
The RBI VAPT register, the CERT-In clock, the digital-lending consent artefact, the outsourcing register. Named, templated, logged.
RBI CSF VAPT every 6 months. Base, mid, top layer NBFCs each have their own control set. VAPT twice a year, cyber-ops centre for top-layer, named CISO always. The spreadsheet drifts; dcomply holds the deadline register and the VAPT evidence.
CERT-In 6-hour clock. Ransomware, data breach, unauthorised access — all trigger a 6-hour report. CERT-In format, pre-filled from the incident, CISO-signed. 180-day log retention.
Digital lending consent. KFS, LSP disclosure, cool-off period, no sensitive data on the app. RBI Digital Lending Guidelines + DPDP + your privacy policy all have to agree. One consent artefact satisfies all three.
Outsourcing register. RBI-required processor register with named fields, DPA copies, sub-processor chains and the SOC-2 attestation of each one. Not a Google Sheet — a register inspectors accept.
Every fintech module, pre-mapped to Indian law.
Our BFSI engagement (RBI + SEBI + IRDAI + CERT-In bundled, from Rs 4,99,999 one-time, 120 days) covers all fintech-specific scope. Managed retainer from Rs 49,999/mo.
Fintech compliance in four numbers.
Questions fintech compliance heads actually ask.
Indian fintechs and NBFCs face overlapping obligations across DPDP Act 2023 (data protection), RBI Cybersecurity Framework for NBFCs, RBI Digital Lending Guidelines 2022, SEBI CSCRF for market intermediaries, PMLA/KYC rules, and CERT-In's 6-hour breach reporting directive. dcomply unifies all of these into a single compliance calendar and evidence locker.
A layered IT security requirement issued by RBI in 2017 that classifies NBFCs into base, mid and top layers and prescribes controls proportional to size and risk, including a board-approved cybersecurity policy, VAPT twice a year, incident reporting to RBI within 2 to 6 hours, and a Cybersecurity Operations Centre for top-layer NBFCs.
When a triggering event occurs, dcomply's breach module pre-fills the CERT-In incident report format, timestamps the discovery moment for the 6-hour clock, routes it for CISO approval, and generates the submission-ready email with all mandatory fields including IP/URL, malware hashes and affected systems.
Yes. Every digital lender collecting borrower KYC, income proof, contact list access, location, SMS metadata or bank statement data is a Data Fiduciary under DPDP. RBI Digital Lending Guidelines add specific requirements: consent for storage on borrower devices, no third-party servers outside India, and audit trails for every field accessed.
RBI KYC Master Direction requires 5-year retention post account closure and 10-year for suspicious transactions. DPDP requires deletion when purpose is exhausted. The reconciliation is that dcomply flags accounts as legally retained under RBI post-closure but blocks any secondary use (marketing, profiling), a partial-anonymisation posture.
Yes. dcomply supports AA participants with consent artefact templates aligned to ReBIT specifications, purpose-scoped consent tracking, and audit-log export in the AA-standard JSON schema. FIP and FIU roles are configurable per tenant.
If you are RBI-regulated, no. The CSF and CERT-In obligations apply from the day you are licensed. The Starter tier is designed for early-stage fintechs.
Yes. SEBI CSCRF and LODR are native modules.
Yes. The Vendor Risk module ships with the RBI-required fields and generates the register in the format inspectors expect.
dcomply's SOC 2 Readiness and ISO 27001 modules run in parallel, feeding the same evidence library. Common for fintechs raising international capital.
Modular. You pay for the modules you activate. Typical fintech setup: RBI plus CERT-In plus Vendor Risk plus DPDP plus STR/CTR.
Request a scope. Clear your RBI inspection.
BFSI engagement from Rs 4,99,999 (120 days). Managed retainer from Rs 49,999/mo. vDPO Premium from Rs 19,999/mo.