Regulatory Project Updates Information
Project Name Project Status
• IMPS transaction changes Live in production.
• CARDs (RUPAY/NFS) development is in progress. Expected to be Live by 31st Dec 2025.
UDIR
• Channel front end changes (IOS, Android, RIB, CIB) is Live in production.
Real-time • Partners such as NOCPL, INCA, KAMAL already live in name screening through SDK.
Name Screening • BLACKBUCK testing and signoff received. A production build was released for them. However, blackbuck reinitiated the
(Part of AML) UAT testing. Timelines breached twice. Awaiting expected go live from Business team.
• Application was Live in 04-07-2025 with Complaint and Service Request Workflow.
• Development and testing has been completed for microsite for customers to raise the complaints. Application VAPT
Ticketing Tool is in progress and is expected to make Live by 30th Nov 2025.
• LEADS for gold loan retention and closure cases has been completed. Leads through DSA requirement gathering is in
progress.
Continuous
Clearing • Continuous clearing as per the RBI mandate is Live in production.
17-11-2025 92
Applications/Payment Channels Uptimes (Q2 FY 25-26) Information
Payment Channels Applications
Month IMPS RTGS UPI NEFT PAYSECURE AEPS CBS LOS CTS NACH
Jul 99.38% 99.38% 99.38% 99.38% 99.38% 99.38% 99.38% 100.00% 100.00% 100.00%
Aug 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00%
Sep 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00% 100.00%
Application Channels Threshold %
IMPS RTGS UPI NEFT PAYSECURE AEPS CBS LOS CTS NACH
99.50% 99.50% 99.50% 99.50% 99.50% 99.50% 99.50% 99.50% 99.50% 99.50%
CTRL-S Uptime
Threshold
Jul(99.39 %) Aug(100 %) Sep(100%)
(99.99%)
• On July 2nd, 2025, CTRL S servers encountered storage related issues. Moved to DR and reported to RBI. Downtime was 4.5 hours.
• On 17th July, 2025, API response times degraded significantly making them non-usable. The CBS Front-End (Branches) / Payments via
NEFT/RTGS/IMPS-IN/UPI-ALL were not affected.
Refer annexure 5 for RCA for the incident
17-11-2025 93
Network Uptime (Q2 FY-25-26, Branches) Information
Production Hours Uptime % Top Branches due to which Monthly Uptime was impacted
Month Branch Backup Link
99.91% 99.93% 99.92%
1. Ghaziabad (8.50 hrs) BTS shifting-
VPN over
Jul migrated to OFC from RF.
Broadband
2. Noida 45 (6 hrs) OFC Cut
1. Hyderabad (14 hrs)- Due to festival,
VPN over
Aug Dept removed wiring from poles.
Broadband
2. Gandhi Nagar (5 hrs) Area Fiber Cut
1. Ujjain ( 11.20 hrs) Router faulty
VPN over
Sep 2. Surat (5 hrs) OFC Cut
Broadband
Jul-25 Aug-25 Sep-25
• Network Threshold – 99.9%
• Outage reasons ( Q4 FY 24-25): Power failure (4.67%); BTS/RF Issue (25.15%); OFC Cut (41.70%); Hardware failure (9.93%); Ring Failure ( 18.55%)
• There was no impact on CBS as branches continued to work using backup connectivity option (backup MPLS link/VPN over broadband).
17-11-2025 94
Network Uptime (Q2 FY 24-25, Head-Office and NOC) Information
Jul Aug Sep
S. No. Head Office Media Type Q2 (FY 25-26)
(Uptime) (Uptime) (Uptime)
1 Noida HO – MPLS Primary Optical Fiber 100% 100% 100% 100%
2 Noida HO – MPLS Secondary Optical Fiber 100% 100% 100% 100%
3 Noida HO – ILL Primary Optical Fiber 100% 100% 100% 100%
4 Noida HO – ILL Secondary Optical Fiber 100% 100% 100% 100%
5 Noida HO – ILL DR Replication Optical Fiber 100% 100% 100% 100%
6 NOC – MPLS Primary Optical Fiber 100% 100% 100% 100%
7 NOC – MPLS Secondary Optical Fiber 100% 100% 100% 100%
8 NOC– ILL Primary Optical Fiber 100% 100% 100% 100%
9 NOC– ILL Secondary Optical Fiber 100% 100% 100% 100%
17-11-2025 95
UPI & IMPS Transactions (Q2 FY 25-26) Information
Month Total Transaction
Month Total Transaction UPI Transactions IMPS Transactions
Jul-25 18,56,219 Jul-25 1,23,500
Technical Decline % Technical Decline %
Aug-25 21,40,179 Aug-25 1,28,821
Sep-25 21,71,345 Sep-25 1,15,155
0.83
3.21
0.49 0.51
1.88
1.35
Jul-25 Aug-25 Sep-25 Jul-25 Aug-25 Sep-25
Month Reasons for Declines (UPI) Month Reasons for Decline (IMPS)
July Decline percentage increased due to a storage-related incident at July Decline percentage increased slightly due to a storage-
CTRLS servers on July 2. (1.42% otherwise) related incident at CTRLS servers on July 2. (0.37 %
Aug Maximus UPI DR drill conducted. Intermittent network Issues in otherwise) (<1 % which is under threshold)
DR env (1.4% otherwise) Sep On 7th and 13th Sep, beneficiary banks were offline, due to
Improvements (Release Date: 14th Aug): Implemented separate which there is a slight spike. The decline % would be 0.59 %
services for UPI Financial and Non-Financial transactions otherwise (<1 % which is under threshold)
Sep Network Issue at Maximus’s end (0.79% otherwise) * UPI & IMPS Decline Threshold is <1%
17-11-2025 96
AEPS Transaction Uptime % Q2 FY 25-26 Information
Apr-25 May-25 Jun-25
Transaction Type Total Technical Declined Total Technical Declined Total Technical Declined
Transaction Declined % Transaction Declined % Transaction Declined %
ON/US 1976 30 1.52 1906 6 0.31 1393 2 0.14
Issuer 12704 165 1.3 13955 160 1.15 12510 148 1.18
Acquirer 978 23 2.35 1164 12 1.03 1151 10 0.87
Grand Total 15658 218 1.39 17025 178 1.05 15054 160 1.06
Uptime %- 98.6% Uptime %- 99.95% Uptime %- 99.94%
Jul-25 Aug-25 Sep-25
Transaction Type Total Technical Declined Total Technical Declined Total Technical Declined
Transaction Declined % Transaction Declined % Transaction Declined %
ON/US 1885 6 0.32 1874 11 0.59 1704 20 1.17
Issuer 15865 347 2.19 16061 184 1.15 15112 230 1.52
Acquirer 1337 16 1.2 1537 15 0.98 1177 12 1.02
Grand Total 19087 369 1.93 19472 210 1.08 17993 262 1.46
Uptime %- 98.07% Uptime %- 98.92% Uptime %- 98.54%
• Q1/Q2 OFFUS Decline % increased by 0.65%:
• Major Reason: Issuer or switch inoperative AEPS Decline Threshold is <1%
17-11-2025 97
Debit Card Transactions Q2 FY 25-26 Information
Paycraft
Paycraft (Technical Decline)
Month Tota Transaction Reason Number of TD (Remote Onus) TD%
Do not honour 20 0.12
format error 78 0.47
Jul-25 16508
response received too late 123 0.74
Host Not Available 9 0.05
Total 1.38
Month Tota Transaction Reason Number of TD (Remote Onus) TD%
Do not honour 11 0.06
format error 14 0.07
Aug-25 17599
response received too late 15 0.08
Host Not Available 4 0.02
Total 0.23
Month Tota Transaction Reason Number of TD (Remote Onus) TD%
Do not honour 18 0.07
format error 22 0.08
Sep-25 25253
response received too late 20 0.07
Host Not Available 2 0.01
Total 0.23
The decline % in July 2025 were slightly increased ( <2% threshold) due to the Debit Card transactions Decline Threshold is < 2%
incident occurred on 2nd July 2025 at CTRLS servers due to storage related issues. (Maintained as per NPCI recommendation)
17-11-2025 98
NEFT/RTGS Statistics Q2 FY 25-26 Information
NEFT/RTGS% Transactions Count
99.85% 99.89% 99.87%
99.72% 99.68% 98568
35206
98.42%
4010 4740
225 4 12 -
Jul-25 Aug-25 Sep-25 NEFT NEFT RTGS RTGS NEFT NEFT RTGS RTGS
Inward Outward Inward Outward Outward Inward Outward Inward
NEFT RTGS Success Success Success Success Failure Failure Failure Failure
• Several NEFT transactions initiated in August failed due to incorrect
credit IFSC codes in the messages, which were not maintained in SFMS.
• Invalid IFSC codes identified from transactions since January have been
disabled in the CBS system to prevent future discrepancies.
17-11-2025 99
ITRM Updates ( Downtime and Daksh Compliances) Regulatory
Daksh Compliance Submissions:
Name Of Cyber Questionnaire Date of Release Due Date Submission Date
Onboarding on TSOC platform of DOT 02-Jul-25 07-Jul-25 04-Jul-25
Public Facing applications and Databases - June 2025 04-Jul-25 07-Aug-25 07-Aug-25
Cyber Questionnaire Form - Version 1 (KRI) 04-Jul-25 05-Aug-25 31-Jul-25
Information related to SEBI's CSCRF 07-Jul-25 07-Jul-25 07-Jul-25
Inputs on data localization 17-Jul-25 25-Jul-25 25-Jul-25
Onboarding on TSOC platform of DOT 02-Jul-25 07-Jul-25 04-Jul-25
17-11-2025 100
ITRM Updates (User Access Management) Regulatory
Total No Of
Total No Of active Total No Of active No Of
SR No. Name Of Application active Users-Sept Remarks
Users-July 25 Users-Aug 25 Observation
25
1 IB user access review 11 11 11 0 No Observation found.
2 MB user access review 22 0 No Observation found.
20 20
3 RIB admin user access review 6 0 No Observation found.
No Observation found.
4 CIB admin user access review 13 13 13 0
5 PAM user access review 65 - - 0 No Observation Found.
6 Firewall Admin User Access Review 4 4 4 0 No Observation found.
Domain Joining Admin User Access
7 9 9 9 0 No Observation Found
Review
8 Domain Admin User Access Review 6 6 6 0 No Observation Found
HO(7), Indore(2), HO(7), Indore(2), SRE(4), HO(7), Indore(2),
9 Server Room Admin User Access Review 0 No Observation Found
SRE(4), Pride(4) Pride(4) SRE(4), Pride(4)
10 Office 365 User Access Review 9 7 7 0 No Observation Found
11 PFMS User Access Review 4 - 3 0 No Observation Found
12 LOS Application Users Access Review 208 - - 0 No Observation Found
17-11-2025 101
ITRM Updates (User Access Management) contd. Regulatory
Total No Of
Total No Of active Total No Of active No Of
SR No. Name Of Application active Users- Remarks
Users-July 25 Users-Aug 25 Observation
Sept 25
One Id from India gold
13 Middleware Users Access Review 128 - - 1 needed to be changed.
ID has been removed
3(Inhouse-106) 0
U(3)
14 Server user access - - 0 No Observation Found.
(Public Cloud-10)
U(4)
0
Private-82
15 CBS User Access Review 654 654 607 0 No Observation Found.
No Observation Found
16 Treasury User Access 8 7 7 0
No Observation Found
17 Recon User Access 6 6 6 0
No Observation Found
18 SFMS User Access Review 6 6 6 0
19 No Observation Found
ALM User Access Review 8 8 8 0
17-11-2025 102
ITRM Updates (Outsourcing Vendor Assessment) Information
Name Criticality Scope of Work Score (Q2) Positives Negatives Corrective Measures
•Dedicated SPOCs for delivery and ITRM / InfoSec
•Finacle application infra hosting
asks
•Issue resolution requires repeated follow-ups due
Ctrls & •Extended data centre management •Round-the-clock team availability ensures •Invest in Tools for complete read visibility (for
Yes 3.5 to substandard regulatory submissions that often the Bank Team)
Cloud4C uninterrupted service delivery
demand multiple corrections.
•Services to work on AWS
•Services to work on OCI
•Cut down the engagement (MATM retired).
Atyati Yes Aadhar-based services & ADV 3 •Continuous support availability •Delayed responses to queries or escalations Onboarding a new pipe to UIDAI.
•Long term plan wrt Aadhaar Data Vault
•Track engagement metrics to ensure active
•Low involvement in analyzing Bank-related issues.
•Prompt issue reporting by TSPs supports participation
Upswing Yes Digital FD TSP 4
quick resolution and reduces downtime. •Escalate early when risks to timelines are
•Frequent delays in meeting committed ETAs
identified
•Strong expertise in Domain ensuring •Limited Support is offered during off - hours and •Backend Developer being overwhelmed with
effective assistance. Non-Working days. Work.
Mobile banking app 2.0 and SDK development
Winjit Yes
and support
4 • Good Responses over raised queries or
•Not much flexible and fast with development.. •Support Availability should be enhanced.
problems.
•Need to be Quick with Development.
•An event-driven support framework with
•Insufficient vendor comprehension of the issues •Proper trainings and documents have been
Effortech Yes 24X7 Monitoring 4 adaptive logic that reconfigures its response
and corresponding resolution requirements. provided to vendor for better understanding
mechanisms based on real-time user input.
•Deployment and upgrade support, •Expert support resources are limited, and
including incident handling. availability is occasionally constrained. •Engaging subject matter experts enhances
BBSSL Yes Finacle Infra Support (SME Support) 4
•Post-production deployment is guided by a •A shortage of qualified experts occasionally
support effectiveness by enabling faster root cause
identification and resolution of complex issues
solution-focused delivery framework impacts timely support availability.
•Can expand their managed services to include
AWS Hosting for Mobile Banking 2.0, SDK and other •AWS infrastructure supports efficient and •Flexible source code repository option like GitLab
Yes 4 Gitlab as well for source code check-in and to build
(Cloud) application uninterrupted scalability. is not available as a managed service
seamless CI-CD pipelines
•Delay in process even at crisis •Direct Involvement with Oracle Support
Oracle •Lack in proper planning •New Resources to be added for better scope
Yes Middleware / API Gateway 3 •Flexible scalability within Oracle Cloud
(Cloud)
• Move integrations out of OIC into Microservice
Nityo has exited
17-11-2025 103
Mumbai DC - CtrlS, CBS Disaster Situation Information
Date 02-07-2025
Impacted Application CBS related Applications
Issue reported: A slowness alert was flagged by the Bank's monitoring team at 7:50 AM. A second alert was flagged at 9:00 AM
While the systems were working there was a gradual degradation. Debugging attempts by all the teams and restarts of the applications did not help
The entire network started becoming slow. So, the call to move to DR was taken at 12:40 PM. The move to DR happened at 2:15 PM. All applications
worked in DR without any issues
RCA: Shared storage on which the Bank's CBS applications were hosted had significant issues (with multiple disks failing)
History: The vendor that set-up the Bank's DR environment was empaneled to run DR drills too. They would take a week to 10 days before every
planned DR, to copy the code, make changes and bring up the applications. We had instances of unsuccessful DRs too where we had to come back to
DC during the day, due to issues faced in DR
The Bank took a call to move all development in-house and started separating the code and config from the entire customization code base. This
exercise was completed along with normal DEV changes. The last 3 DR drills also had EOD/BOD running in the DR env. All this preparation helped us
on [Link]. We stayed in the DR env for 2 weeks while the CBS applications in DC were moved to dedicated storage
Going Forward: Most Banks sync DR to DC once a week. We are doing the deployments simultaneously in both environments. We will apply the PSP
N-1 version from Finacle every 6 months and run the automation suite in DR to ensure that the environment is functioning properly
Decision: We will have a 60 min window during which we will take a call and move our applications to DR, if any system / application / network /
database issue is not resolved
17-11-2025 104
Mumbai DC - Oracle Cloud, Middleware Disaster Situation Information
Date 17-07-2025
Impacted Application Middleware
Issue reported: The API response times degraded significantly making them non-usable. The CBS Front-End (Branches) / Payments via
NEFT/RTGS/IMPS-IN/UPI-ALL were not affected. Mobile Banking App, Internet Banking Application, Onboarding SDK, APIs used by partners were
affected
History: We had a 36 hour downtime in Q1 2024 due to slowness in Oracle MW. After this the MW DR was set-up in the Hyderabad region and the first
MW DR Drill was conducted in Nov 2024 (48 hour drill)
Steps Taken: A P1 Service Request (SR) was raised with Oracle and we followed the recommended action plan. However, the steps outlined did not
resolve the issue. A call was taken to move to the DR as the situation in DC did not improve. We operated in the DR environment for 2+ weeks,
returning to DC (Mumbai) on 7th August 2025
Next Steps: Meeting with Oracle India Head and the Bank's MD/CEO happened on 7th August. Oracle has given us a debug patch to help them gather
more info from the tenant to identify the root cause of the issue. The Bank's tech team and the Oracle Tech and Product teams are also working
together in attempting to simulate the issue in a lower environment. The degradation is gradual and happens after sustained continuous loads.
Syncing: MW deployments in DC and DR happen at the same time
Decision: We will have a 60 min window during which we will take a call and move our applications to DR, if any system / application / network /
database issue is not resolved on the Oracle MW managed services offering
17-11-2025 105
