Question map
Consider the following statements : The Reserve Bank of India's recent directives relating to 'Storage of Payment System Data', popularly known as data diktat, command the payment system providers that 1. they shall ensure that entire data relating to payment systems operated by them are stored in a system only in India 2. they shall ensure that the systems are owned and operated by public sector enterprises 3. they shall submit the consolidated system audit report to the Comptroller and Auditor General of India by the end of the calendar year Which of the statements given above is/are correct?
Explanation
The correct answer is option A (Statement 1 only).
The Reserve Bank of India's directives relating to 'Storage of Payment System Data', popularly known as data diktat, command that payment system providers shall ensure that entire data relating to payment systems operated by them are stored in a system only in India.[2] All system providers were required to ensure that, within a period of six months, the entire data relating to payment systems operated by them is stored in a system only in India.[3] This makes Statement 1 correct.
Statement 2 is incorrect as the RBI directive does not mandate that payment systems must be owned and operated by public sector enterprises. In terms of Section 4 of the PSS Act, no person other than RBI can commence or operate a payment system in India unless authorised by RBI[4], but this authorization is not restricted to public sector enterprises only.
Statement 3 is also incorrect as there is no requirement in the RBI's data storage directive for payment system providers to submit consolidated system audit reports to the Comptroller and Auditor General of India. The directive primarily focuses on data localization requirements.
Sources- [1] Indian Economy, Nitin Singhania .(ed 2nd 2021-22) > Chapter 8: Financial Market > 2020 > p. 247
- [2] Indian Economy, Nitin Singhania .(ed 2nd 2021-22) > Chapter 8: Financial Market > 2020 > p. 247
- [3] https://www.rbi.org.in/commonman/english/scripts/FAQs.aspx?Id=2995
- [4] Indian Economy, Vivek Singh (7th ed. 2023-24) > Chapter 2: Money and Banking- Part I > 10.Oversight of payment and settlement systems > p. 70
PROVENANCE & STUDY PATTERN
Full viewThis question is a classic 'Current Affairs headline meets Static Logic' test. While Statement 1 requires knowing the news (Data Localisation), Statements 2 and 3 are 'extreme exaggerations' designed to be eliminated by understanding the basic definitions of a Mixed Economy and the Constitutional role of the CAG.
This question can be broken into the following sub-statements. Tap a statement sentence to jump into its detailed analysis.
- Statement 1: Reserve Bank of India "Storage of Payment System Data" (data diktat) directive: does it require payment system providers to store the entire data relating to payment systems they operate only in India?
- Statement 2: Reserve Bank of India "Storage of Payment System Data" (data diktat) directive: does it require payment system providers' systems to be owned and operated by public sector enterprises?
- Statement 3: Reserve Bank of India "Storage of Payment System Data" (data diktat) directive: does it require payment system providers to submit consolidated system audit reports to the Comptroller and Auditor General of India by the end of the calendar year?
- Explicitly commands payment system providers to ensure entire data relating to payment systems operated by them are stored in a system only in India.
- Uses the phrase 'entire data' and 'only in India', which matches the statement's wording directly.
- Labels the directive as 'Storage of Payment System Data' (data diktat), linking the requirement to that directive.
- Confirms RBI is the regulator for payment and settlement systems under the Payment and Settlement Systems Act.
- Section 4 vests RBI with exclusive authority over who can commence or operate payment systems, supporting RBI's power to issue such storage directives.
- Explicit line requiring payment system providers to ensure entire payment-system data is stored in India and that the systems are owned and operated by Public Sector Enterprises.
- Frames the ownership requirement as part of the RBI's 'Storage of Payment System Data' directives (the data diktat).
- Presents the ownership obligation alongside other directive obligations, showing it is a stated RBI command rather than background context.
- Official RBI FAQ on the directive states the requirement and scope: it mandates that payment system data be stored only in India within six months.
- The passage describes the storage/localisation obligation but contains no language about submitting consolidated system audit reports to the Comptroller and Auditor General of India.
- A summary of the directive likewise states it "requires all payment system providers to store the payment data only in India."
- This summary focuses on data localisation and does not mention any requirement to submit consolidated system audit reports to the CAG by year-end.
This snippet explicitly lists the alleged commands of the RBI 'Storage of Payment System Data' directive, including the requirement to submit consolidated system audit reports to the CAG by year-end — it therefore provides the precise claim that needs verification.
A student could treat this as a reported example in a secondary source and check primary RBI notifications or official gazette text to confirm whether the book's summary accurately reflects the directive.
Lists and classifies the kinds of payment system operators (NPCI, card networks, PPI issuers), showing that many authorized operators are non-bank or private entities.
A student could use this to question whether the CAG (whose remit is public accounts) customarily audits private payment operators, and therefore seek statutory or RBI text extending CAG authority to such entities.
Describes the CAG's material duties to audit and report on all expenditure from Consolidated Fund of India and related public accounts — defining the CAG's constitutional/audit remit.
A student could combine this with the fact that many payment operators are private to assess whether it is plausible or typical for the CAG to audit them without explicit legislative or executive mandate.
Explains that the CAG functions mainly as an auditor and its role is tied to public finances rather than operational control of non-public entities.
A student might use this to infer that any requirement for private payment providers to report to the CAG would be unusual and therefore look for a specific statutory/administrative basis in RBI or government orders.
Mentions 'Audit reports' as a formal function/heading associated with the CAG, indicating that audit reporting is an established institutional practice.
A student could use this to frame searches for the type and recipients of audit reports (e.g., whether consolidated system audit reports are standardly routed to the CAG) by consulting CAG or RBI procedural guidelines.
- [THE VERDICT]: Sitter (via Elimination). Source: Any standard newspaper (April 2018) covering the 'Data Localisation' debate.
- [THE CONCEPTUAL TRIGGER]: Digital Payment Regulatory Framework & Data Sovereignty (RBI PSS Act 2007).
- [THE HORIZONTAL EXPANSION]: 1. PSS Act 2007 (Section 4: Authorization). 2. CERT-In empanelled auditors (Real auditors for this directive). 3. Srikrishna Committee (Data Protection). 4. GDPR (EU comparison). 5. The '24-hour rule' (Foreign processing allowed if data returns in 24h).
- [THE STRATEGIC METACOGNITION]: Apply the 'Target Entity Test'. When a rule applies to 'Payment System Providers' (which includes Visa, Mastercard, Google Pay), ask: Can the government force Visa to be a PSU? (No). Does CAG audit Google? (No). Logic beats rote memory.
RBI requires that the entire data relating to payment systems operated by providers be stored only in India, a direct data-localisation mandate for payments.
High-yield for questions on financial regulation and digital policy because it links central bank authority to data governance; connects to topics like cybersecurity, cross-border data flows, and fintech regulation. Understanding this enables answers on regulatory intent, impact on service providers, and policy trade-offs.
- Indian Economy, Nitin Singhania .(ed 2nd 2021-22) > Chapter 8: Financial Market > 2020 > p. 247
The Payment and Settlement Systems Act gives RBI exclusive oversight and authorisation powers over payment systems, underpinning RBI's issuance of directives.
Important for legal/regulatory questions on banking and payments; it explains why RBI can impose operational requirements on payment providers and links to constitutional/administrative competence and regulatory design. Mastery helps answer questions on institutional roles and limits of regulator power.
- Indian Economy, Vivek Singh (7th ed. 2023-24) > Chapter 2: Money and Banking- Part I > 10.Oversight of payment and settlement systems > p. 70
NPCI is the umbrella organisation operating retail payments in India and would be among the entities affected by RBI directives on payment-system data.
Useful for questions on payment infrastructure, financial inclusion and public-private institutional arrangements; connects to topics on how national payment architectures are governed and the operational impact of RBI rules on major payment operators.
- Indian Economy, Nitin Singhania .(ed 2nd 2021-22) > Chapter 7: Money and Banking > National Payments Corporation of India > p. 192
The directive mandates that entire payment-system data be stored within India and ties this to operational ownership requirements.
High-yield for questions on digital sovereignty, fintech regulation, and cybersecurity policy; explains a concrete regulatory tool used by the central bank to control cross-border data flows and has implications for compliance costs and international data transfers.
- Indian Economy, Nitin Singhania .(ed 2nd 2021-22) > Chapter 8: Financial Market > 2020 > p. 247
RBI's regulation and authorisation power over payment systems provides the legal basis for directives like the data-storage diktat.
Important for understanding how the central bank can impose operational rules on payment operators; links to governance of financial infrastructure, legal frameworks, and state regulation of digital payments.
- Indian Economy, Vivek Singh (7th ed. 2023-24) > Chapter 2: Money and Banking- Part I > 10.Oversight of payment and settlement systems > p. 70
Knowledge of how entities like NPCI are structured (not-for-profit, significant public-sector stake) helps assess the feasibility and implications of ownership-related directives.
Useful for questions on institutional design of payment infrastructure, public–private roles in financial systems, and policy impacts on entities like NPCI; connects fintech regulation with banking sector ownership patterns.
- Indian Economy, Nitin Singhania .(ed 2nd 2021-22) > Chapter 7: Money and Banking > National Payments Corporation of India > p. 192
- Indian Economy, Vivek Singh (7th ed. 2023-24) > Chapter 2: Money and Banking- Part I > 10.Oversight of payment and settlement systems > p. 71
The question asks about submitting an audit report to the CAG, so understanding the CAG's mandate to audit Union and State accounts is directly relevant.
High-yield for UPSC because CAG's constitutional role is frequently tested in governance and public finance topics; it links to accountability, financial oversight, and audit reports. Mastering this helps answer questions about who audits public money, the scope of audits, and institutional checks on the executive.
- Indian Polity, M. Laxmikanth(7th ed.) > Chapter 92: World Constitutions > COMPTROLLER AND AUDITOR GENERAL OF INDIA > p. 699
- Introduction to the Constitution of India, D. D. Basu (26th ed.). > Chapter 11: The Union Executive > 6. The Comptroller and Auditor-General of India > p. 233
- Introduction to the Constitution of India, D. D. Basu (26th ed.). > Chapter 11: The Union Executive > 6. The Comptroller and Auditor-General of India > p. 234
The actual audit requirement: The directive mandates a 'System Audit Report' (SAR) conducted by 'CERT-In empanelled auditors', not the CAG. This report must be submitted to the RBI Board, not the Parliament.
Use the 'Visa/Mastercard Test'. The directive applies to ALL providers. Ask yourself: 'Is Mastercard a Public Sector Enterprise?' (Eliminates Stmt 2). 'Does the CAG audit Visa's accounts?' (Eliminates Stmt 3). CAG only audits the Consolidated Fund/Public Accounts. Answer is A.
GS-3 Internal Security (Cybersecurity): Data Localisation is primarily argued as a tool for Law Enforcement Agencies (LEAs) to get instant access to financial data during terror funding or money laundering investigations, bypassing the slow Mutual Legal Assistance Treaties (MLAT).