5. Core Banking System

Enterprise Information System
Prepared By: Ashish Desai
7383381111
IPCC 5. Core Banking System
 OVERVIEW OF BANKING SERVICES
 CHALLENGES OF IT
 IT RISKS AND RISK ASSESSMENT
 APPLYING IT CONTROLS
 OVERVIEW OF CBS
 CBS ARCHITECTURE
 CORE FEATURES OF CBS
 MAJOR COMPONENTS OF THE CBS SOLUTION
 TECHNOLOGY AND WORK-FLOW OF CBS
 TECHNOLOGY COMPONENTS
 HOW DOES CBS WORK?
 CBS IT ENVIRONMENT

Enterprise Information System
Prepared By: Ashish Desai
7383381111
IPCC 5. Core Banking System
BUSINESS PROCESS FLOW OF CURRENT & SAVINGS ACCOUNTS (CASA)
BUSINESS PROCESS FLOW OF CREDIT CARDS
BUSINESS PROCESS FLOW OF MORTGAGES
TREASURY PROCESS
LOANS AND TRADE FINANCE PROCESS
INTERNET BANKING PROCESS
RISKS ASSOCIATED WITH CBS
RISK PREDICTION FOR BASEL III, BASED ON ARTIFICIAL INTELLIGENCE
BANKING REGULATION ACT
RBI REGULATIONS
MONEY LAUNDERING

Core Banking System
INTRODUCTION
Information Technology (IT) is an integral aspect of functioning of enterprises and
professionals in this digital age.
There has been massive use of technology across many areas of banking business in India,
both from the asset and the liability side of a bank's balance sheet.
The technology footprint has spread across the Indian banking landscape in a very big way.
In fact, with most banks using technology, the key differentiator now is how IT is used for
delivering services to customers.
Delivery channels have immensely increased the choices offered to the customer to conduct
transactions with ease and convenience.
Banking is the engine of economic growth specifically in a rapidly developing country like
India with its diverse background, practices, cultures and large geographic dispersion of
citizens.
The changes in the banking scenario due to moving over to Core Banking System and IT-based
operations have enabled banks to reach customers and facilitate seamless transactions with
lesser dependence on physical infrastructure.
The accounting transactions and all services of the banks are being done from a central server
using core banking solutions.
This is changing the modus operandi of how banking services are delivered to customers by
using alternate delivery channels such as ATM, Internet Banking and Mobile Banking.
OVERVIEW OF BANKING SERVICES
The key features of a banking business are as follows:
The custody of large volumes of monetary items, including cash and negotiable instruments,
whose physical security should be ensured.
Dealing in large volume (in number, value and variety) of transactions.
Operating through a wide network of branches and departments, which are
geographically dispersed.
Increased possibility of frauds as banks directly deal with money making it mandatory for
banks to provide multi-point authentication checks and the highest level of information
security.
To understand how automation impacts the way these services are provided, it is critical to
understand various types of banking services and how these services are provided.

Core Banking System
Some of the major products and services provided and rendered by commercial banks which
constitute core banking services are briefly explained here.
Acceptance of Deposits
Deposits involve deposits by customers in various schemes for pre-defined periods.
Commercial banks accept deposits in various forms such as term deposits, savings bank
deposits, current account deposits, recurring deposit, saving-cum-term deposit and various
others innovative products.
Granting of Advances
Advances constitute a major source of lending by commercial banks.
The type of advances granted by commercial banks take various forms such as cash credit,
overdrafts, purchase/ discounting of bills, term loans, etc.
An external ECB is an instrument used in India to facilitate the access to foreign money by
Indian corporations and public sector undertakings.
Remittances
Remittances involve transfer of funds from one place to another.
Two of the most common modes of remittance of funds are demand drafts and
Telegraphic/ Mail Transfers (TT/ MT).
Drafts are issued by one branch of the Bank and are payable by another branch of the
Bank
The drafts are handed over to the applicant.
In the case of telegraphic/ mail transfer, no instrument is handed over to the applicant;
the transmission of the instrument is the responsibility of the branch.
Electronic Funds Transfer is another mode of remittance which facilitates almost
instantaneous transfer of funds between two centers electronically.
Collections
Collections involve collecting proceeds on behalf of the customer.
Customers can lodge various instruments such as cheques, drafts, pay orders, travelers
cheques, dividend and interest warrants, tax refund orders, etc. drawn in their favor and
the trade bills drawn by them on their buyers with their Bank for collection of the amount
from the drawee (the bank or the drawee of the bill).
Banks also collect instruments issued by post offices, like national savings certificates,
postal orders, etc.

Core Banking System
Clearing
Clearing involves collecting instruments on behalf of customers of bank.
The instruments mentioned above may be payable locally or at an outside center.
Clearing house settles the inter-Bank transactions among the local participating member
banks. Generally, post offices are also members of the house.
There may be separate clearing houses for MICR (Magnetic Ink Character Recognition)
and non-MICR instruments.
MICR is a technology which allows machines to read and process cheques enabling
thousands of cheque transactions in a short time.
MICR code is usually a nine-digit code comprising of some important information about
the transaction and the bank.
ELECTRONIC CLEARING SERVICES (ECS)
there is a single receiver of funds from a large number of customers, e.g.,
public utilities, mutual funds, etc. The beneficiary (i.e., the receiver of funds) obtains mandate
from its customers to withdraw funds from their specified Bank accounts on a specific date.
there is a single account to be debited against which many accounts with a
number of banks in the same clearing house area are credited. This system is useful for
distribution of dividend/ interest, payment of salaries by large units, etc.
LETTERS OF CREDIT AND GUARANTEES
A Letter of Credit (LC) is an undertaking by a bank to the payee (the supplier of goods
and/ or services) to pay to him, on behalf of the applicant (the buyer) any amount up to
the limit specified in the LC, provided the terms and conditions mentioned in the LC are
complied with.
CREDIT CARDS
The processing of applications for issuance of credit cards is usually entrusted to a
separate division at the central office of a bank.
Most credit cards issued by banks are linked to one of the international credit card
networks like VISA, Master, Amex or India's own RuPay which currently issues debit cards
but credit cards are also expected to launched in near future.
DEBIT CARDS
Debit Cards are issued by the bank where customer is having their account. Debit cards
are generally issued by the central office of the bank.
Debit Cards facilitates customers to pay at any authorized outlet as well as to withdraw
money from an ATM from their account.

Core Banking System
When a debit card is used for a transaction, the amount is immediately deducted from
the customer's account balance.
OTHER BANKING SERVICES
These cover all operations done at the back office of the bank.
These are related to general ledger, Management Information Systems, reporting, etc.
These are also called front-office operations that cover all operations
which provide direct retail services to customers.
Banks provide special services to customers
classified as High Net-worth Individuals (HNI) based on value/ volume of deposits/
transactions.
Risks are all pervasive in the banking sector. This should be done
at strategic, tactical, operational and technology areas of the bank. Risk management is
best driven as per policy with detailed standards, procedures and guidelines provided
for uniform implementation.
Banks also
perform other services such as insurance
broking, claims, underwriting, life insurance,
non-life insurance, etc. However, these
would be offered by separate entities set
up by the bank.
CHALLENGES OF IT
Frequent changes or obsolescence of technology:
Technology keeps on evolving and changing constantly and becomes obsolete very
quickly. Hence, there is always a risk that the investment in technology solutions unless
properly planned may result in loss to bank due to risk of obsolescence.
Multiplicity and complexity of systems:
The Technology architecture used for services could include multiple digital platforms and
is quite complex.
Hence, this requires the bank personnel to have personnel with requisite technology skills
or could be outsourced to a company having the relevant skill set.
Different types of controls for different types of
technologies/ systems:
Deployment of Technology gives rise to new types of risks which are explained later in
this chapter.
These risks need to be mitigated by relevant controls as applicable to the
technology/information systems deployed in the bank.

Core Banking System
Proper alignment with business objectives and legal/
regulatory requirements:
Banks must ensure that the CBS and allied systems implemented, cater to all the business
objectives and needs of the bank, in addition to the legal/regulatory requirements
envisaged.
Dependence on vendors due to outsourcing of IT
services:
In a CBS environment, the bank requires staff with specialized domain skills to manage IT
deployed by the bank.
Hence, these services could be outsourced to vendors and there is heavy dependency on
vendors and gives rise to vendor risks which should be managed by proper contracts,
controls and monitoring.
Vendor related concentration risk:
There may not one but multiple vendors providing different services.
For example, network, hardware, system software and banking software services may
be provided by different vendors or these services may be provided by a single vendor.
Both these situations result in higher risks due to heavy dependence on vendors.
Segregation of Duties (SoD):
The segregation of duties as per organization structure should be clearly mapped in the
CBS used by the bank.
This is a high-risk area since any SoD conflicts can be a potential vulnerability for
fraudulent activities.
For example, if a single employee can initiate, authorize and disburse a loan the
possibility of misuse cannot be ignored.
External threats leading to cyber frauds/ crime:
The CBS environment provides access to customers anytime, anywhere using internet.
Hence, information system which was earlier accessible only within and to the employees
of the bank is now exposed as it is open to be accessed by anyone from anywhere.
Higher impact due to intentional or unintentional acts
of internal employees:
Employees in a technology environment are the weakest link in an enterprise. This is much
more relevant in bank as banks deal directly with money. Hence, the employee acts done
intentionally or unintentionally may compromise security of the IT environment.

Core Banking System
New social engineering techniques employed to acquire
confidential credentials:
Fraudsters use new social engineering techniques such as socializing with employees and
extracting information which is used unauthorized to commit frauds.
For example: extracting information about passwords from bank's staff acting as genuine
customer and using it to commit frauds.
Need for governance processes to adequately manage
technology and information security:
Technology, has become key enabler for bank and is implemented across the bank, senior
management of bank should be involved in directing how technology is deployed in bank
and approve appropriate policies. This requires governance process to implement security
as required.
Need to ensure continuity of business processes in the
event of major exigencies
The high dependence on technology makes it imperative to ensure resilience to ensure
that failure does not impact banking services.
IT RISKS AND RISK ASSESSMENT
Every enterprise is started and exists to provide value to its stakeholders.
Every business has its own inherent risk and banking business is prone to higher risk. Similarly,
automation of business processes introduces new types of risks and in case of banking services,
as it primarily involves with money, there are greater and newer risks.
These risks need to be understood and mitigated by appropriate risk mitigation strategies.
Definition of Risk
is uncertainty in achieving objectives. Risk can be positive or negative.
can be defined as: "the potential harm caused if a threat exploits a particular
vulnerability to cause damage to an asset".
is defined as the process of identifying security risks and determining their
magnitude and impact on an organization.
Information systems can generate many direct and indirect risks.
These risks lead to a gap between the need to protect systems and the degree of
protection applied.
The gap is caused by:
Widespread use of technology and Interconnectivity of systems;

Core Banking System
Elimination of distance, time and space as constraints;
Devolution of management and control;
Attractiveness of conducting unconventional digital attacks; and
External factors such as legislative, legal and regulatory requirements or IT
developments.
Risks are mitigated by implementing risk assessment. This involves the following:
Identification of threats and vulnerabilities in the system;
Potential impact or magnitude of harm that a loss of security would have on
enterprise operations or enterprise assets, should an identified vulnerability be
exploited by a threat; and
The identification and analysis of security controls for information systems.
Impact of IT Risks
There are new IT risks which could have a significant impact on critical business operations,
such as:
External dangers from hackers, leading to denial of service and virus attacks, extortion
and leakage of corporate information.
Growing potential for misuse and abuse of information system affecting privacy and
ethical values; and Increasing requirements for availability and robustness.
Phishing attacks through Internet Banking. Phishing is the attempt to obtain sensitive
information such as usernames, passwords, and credit card details (and, indirectly,
money), often for malicious reasons, by disguising as a trustworthy entity in an
electronic communication.
IT Risk Management
Effective risk management begins with a clear understanding of the bank's risk appetite
and identifying high-level risk exposures.
Based on the type of risk, project and its significance to the business, Board and Senior
Management may choose to take up any of the following risk management strategy in
isolation or combination as required:
Avoid: Eliminate the risk by not taking up or avoiding the specific business process
which involves risk.
Mitigate: Implement controls (e.g. acquire and deploy security technology to protect
the IT infrastructure).
Transfer: Share risk with partners or transfer to insurance coverage.
Accept: Formally acknowledge that the risk exists and monitor it.

Core Banking System
Some sample risks relating to Banking are as follows:
Loss of confidential data;
Unauthorized access to customer information;
Inaccuracy of data leading to incorrect decision-making;
Loss due to errors;
Loss of money/reputation/business due to Frauds; and
Impact of Non-compliance.
Examples of IT Risk Assessment and Risk Management
Mechanism
Unauthorized data changes affecting integrity of data;
Absence of logs and audit trail/ logs;
Unauthorized transactions;
Unauthorized entry/ corrections/ deletions;
Transactions without vouchers;
Changing data using other's password;
Willful and wrong inputs; and
Hiding erroneous outputs
Unauthorized or incorrect Interest rate changes;
Incorrect Interest computation;
Incorrect computation of charges;
Unauthorized increased in credit limits;
Payments of stolen drafts;
Payment of stopped cheques;
Payment of duplicate drafts/ Fixed Deposit Certificates issued; and
Opening of New accounts without complying with KYC (Know Your Customer) norms
as specified by RBI.
Indicators of higher IT risk
IT security is not given required priority;
Attitude of "Computer will take care of everything - no checking is required";
Lack of transparency of IT operations and responsibility assigned;
Lack of Input control;
Lack of output verification;
Lack of evidence;
Lack of access control;
Lack of audit trails;
Lack of dual checks for sensitive and high value transactions;
Lack of documented disaster recovery plan/ contingency plan/ Business Continuity Plan;
Lack of controls leading to temptation to commit frauds;
No check on vendors for reliability of software; and
Over-dependence on long serving - 'trusted' operators, supervisors, managers, etc.

Core Banking System
Importance of IT Controls
Control refers to the policies, procedures, practices and organization structures that are
designed to provide reasonable assurance that business objectives are achieved and
undesired events are prevented or detected and corrected.
IT Control objectives is defined as: "a statement of the desired result or purpose to be
achieved by implementing control procedures within a particular IT activity".
Implementing right type of controls is responsibility of management.
Controls provides a clear policy and good practice for directing and monitoring
performance of IT to achieve enterprise objectives.
IT Controls perform dual role:
They enable enterprise to achieve objectives; and
They help in mitigating risks.
IT controls promote reliability and efficiency and allow the organization to adapt to
changing risk environments.
Any control that mitigates or detects fraud enhances the organization's resiliency.
Resiliency is a result of a strong system of internal controls which enable a well-controlled
organization-to manage challenges or disruptions seamlessly.
Key indicators of effective IT controls
The ability to execute and plan new work such as IT infrastructure upgrades required to
support new products and services.
Development projects that are delivered on time and within budget, resulting in cost-
effective and better product and service offerings compared to competitors.
Ability to allocate resources predictably.
Consistent availability and reliability of information and IT services across the organization
and for customers, business partners, and other external interfaces.
Clear communication to management of key indicators of effective controls.
The ability to protect against new vulnerabilities and threats and to recover from any
disruption of IT services quickly and efficiently.
The efficient use of a customer support center or help desk.
Heightened security awareness on the part of the users and a security conscious culture.

Core Banking System
Internal Control System in Banks
The objective of internal control system is to ensure orderly and efficient conduct of
business.
For example, Internal controls in banking would be to ensure that the transaction or
decision are within the policy parameters laid down by the bank, they do not violate the
instruction or policy prescription and are within delegated authority.
Work of one staff member is invariably supervised/ checked by another staff
member, irrespective of the nature of work (Maker-Checker process).
A system of job rotation among staff exists.
Financial and administrative powers of each official/ position is fixed and
communicated to all persons concerned.
Branch managers must send periodic confirmation to their controlling authority on
compliance of the laid down systems and procedures.
All books are to be balanced periodically. Balancing is to be confirmed by an
authorized official.
Details of lost security forms are immediately advised to controlling so that they can
exercise caution.
Fraud prone items like currency, valuables, draft forms, term deposit receipts,
traveler's cheques and other such security forms are in the custody of at least two
officials of the branch.
The system maintains a record of all log-ins and log-outs.
If the transaction is sought to be posted to a dormant (or inoperative) account, the
processing is halted and can be proceeded with only with a supervisory password.
The system checks whether the amount to be withdrawn is within the drawing power.
The system flashes a message if the balance in a lien account would fall below the
lien amount after the processing of the transaction.
Access to the system is available only between stipulated hours and specified days
only.
Individual users can access only specified directories and files. Users should be given
access only on a "need-to-know basis" based on their role in the bank. This is
applicable for internal users of the bank and customers.
Exception situations such as limit excess, reactivating dormant accounts, etc. can be
handled only with a valid supervisory level password.

Core Banking System
A user timeout is prescribed. This means that after a user logs-in and there is no activity
for a pre-determined time, the user is automatically logged- out of the system.
Once the end-of-the-day process is over, the ledgers cannot be opened without a
supervisory level password.
APPLYING IT CONTROLS
There are different options for implementing controls as per risk management strategy.
Each of these IT deployments of CBS requires applying IT controls as per specific requirements
of the bank.
This application of controls is done through proper configuration settings, setting of
parameters in masters and implementing controls in transaction processing.
IT controls are selected and implemented based on the risks they are designed to manage.
Controls always involve costs. Hence, it is important to ensure that adequate and appropriate
controls are implemented to mitigate the risks as applicable. In case of banking industry, risks
are all pervasive.
However, the focus in this chapter is not on business related risks of banking but IT related
risks and controls of banking automation.
Apart from the classification of controls already discussed in detail in previous chapter, a
common classification of IT controls is General Controls and Application Controls.
General Controls are macro in nature and the impact pervades the IT environment at different
layers whereas Application Controls are controls which are specific to the application
software.
General Controls
The security policy is approved by the senior management and encompasses all areas
of operations of bank and drives access to information across the enterprise and other
stakeholders.
IT should be administered with appropriate policies and procedures clearly defining
the levels of access to information and authentication of users.
Secure deployment of IT requires the bank to have separate IT organisation structure
with key demarcation of duties for different personnel within IT department and to
ensure that there are no SoD conflicts.

Core Banking System
Software solutions for CBS are most developed acquired and implemented. Hence,
process of acquisition and implementation of systems should be properly controlled.
IT solutions deployed and its various components must be changed in tune with changing
needs as per changes in technology environment.
Hence, change management process should be implemented to ensure smooth transition
to new environments.
Heavy dependence on IT and criticality makes it imperative that resilience of banking
operations should be ensured by having appropriate business continuity including
backup, recovery and off-site data centre.
Application software drives the business processes of the banks.
These solutions in case developed and implemented must be properly controlled by
using standard software development process.
Confidentiality refers to protection of critical information.
Integrity refers to ensuring authenticity of information at all stages of processing.
Availability refers to ensuring availability of information to users when required.
IT operations: IT operations refer to how IT is deployed, implemented and maintained
within the bank.
There may be various incidents created due to failure of IT. These incidents need to be
appropriately responded and managed as per pre-defined policies and procedures.
Application Controls
Application Controls ensure accurate and reliable processing.
Application controls ensure that all transactions are authorized, complete and accurate.
For example: application software ensures that only transactions of the day are
accepted by the system. Withdrawals are not allowed beyond limits, etc.
Some examples of Application controls are as follows:
Data edits (editing of data is allowed only for permissible fields);
Separation of business functions (e.g., transaction initiation versus authorization);

Core Banking System
Balancing of processing totals (debit and credit of all transactions are tallied);
Transaction logging (all transactions are identified with unique id and logged);
Error reporting (errors in processing are reported); and
Exception Reporting (all exceptions are reported).
A detailed discussion of Application Controls has already been provided in the previous
chapter of the study material.
OVERVIEW OF CBS
Core Banking Solution (CBS) refers to a common IT solution where in a central shared database
supports the entire banking application.
Business processes in all the branches of a bank update a common database in a central server
located at a Data Center, which gives a consolidated view of the bank's operations.
CBS is centralized Banking Application software that has several components which have been
designed to meet the demands of the banking industry.
CBS is modular in structure and is capable of being implemented in stages as per requirements
of the bank.
A CBS software also enables integration of all third-party applications, including in-house
banking software, to facilitate simple and complex business processes.
Some examples of CBS software are given below. These are only illustrative and not
exhaustive.
Core banking software suite
developed by Infosys that provides universal
banking functionality covering all modules for
banks covering all banking services.
Web-based global banking
product designed to support banks and
financial solution companies in dealing with
assets, liabilities, core financial accounting and
customer service.
Comprehensive, integrated, interoperable, and modular solution that enables
banks to manage evolving customer expectations.
A customer-centric business model which offers simplified operations comprising
loans, deposits, wealth management, digital channels and risk and compliance components.
A full-scale Banking solution which is a scalable, integrated e-banking systems
that meets the deployment requirements in traditional and non-traditional banking

Core Banking System
environments, It enables communication through any touch point to provide full access to
provide complete range of banking services with anytime, anywhere paradigm.
CBS ARCHITECTURE
CBS requires that most of bank's branches access applications from centralized data centers.
CBS for a bank functions not only as a heart (circulatory system) but also as a nervous system.
All transactions flow through these core systems, which, at an absolute minimum, must remain
running and responsive during business hours. These systems are usually running 24x7 to
support Internet banking, global operations, and real time transactions via ATM, Internet,
mobile banking, etc.
The platform where communication technology and information technology are merged to suit
core needs of banking is known as core banking solutions.
Here, computer software is used to perform core operations of banking like recording of
transactions, passbook maintenance, and interest calculations on loans etc.
Some key aspects in-built into architecture of a CBS are as follows:
Facilitates information flow within the bank and Improves the speed
and accuracy of decision-making. It deploys systems that streamline integration and unite
corporate information to create a comprehensive analytical infrastructure.
Through a holistic core banking architecture, enables banks to target
customers with the right offers at the right time with the right channel to increase
profitability.
Compliance in case of banks is complex and expensive. CBS
has built-in and regularly updated regulatory platform which will ensure compliance.
Optimizes utilization of information and resources of banks
and lowers costs through improved asset reusability, faster turnaround times, faster
processing and increased accuracy.
CORE FEATURES OF CBS
Initially, basic modules like Savings Account, Current Account, Fixed Deposits, Bills &
Remittances, Loans and Advances models were implemented.
Subsequently, alternate delivery channels like ATM, Internet banking, Real Time Gross
Settlement(RTGS)/ National Electronics Funds Transfer System(NEFT), Mobile Banking,
Treasury, Government Business etc. could be added.
The core features of CBS are as follows:
On-line real-time processing.

Core Banking System
Transactions are posted immediately.
All databases updated simultaneously.
Centralized Operations (All transactions are stored in one common database/server).
Separate hierarchy for business and operations.
Business & Services are productized.
Remote interaction with customers.
Reliance on transaction balancing.
Highly dependent system-based controls.
Authorizations occur within the application.
Increased access by staff at various levels based on authorization.
Daily, half yearly and annual closing,
Automatic processing of standing instructions,
Centralized interest applications for all accounts and account types
Anytime, anywhere access to customers and vendors.
MAJOR COMPONENTS OF THE CBS SOLUTION
Banking industry is involved in dealing with public money and thus demands proper checks
and balances to ensure close monitoring of the dealing, minimizing the risk arising out of the
banking business.
One of the significant projects implemented is the centralized database and centralized
application environment for core and allied applications and services which is popularly
known as CBS.
The various components/ features of core banking are as follows:
Opening new accounts and customer on-boarding.
Managing deposits and withdrawals.
Transactions management from initiation to reporting.
Interest calculation and management.
Payments processing (cash, cheques/ mandates, NEFT, RTGS, IMPS etc.).
Loans disbursement and management.
Processing cash deposits and withdrawals.
Processing payments and cheques.
Processing and servicing loans.
Accounts management.
Configuring and calculating interest.
Customer Relationship Management (CRM) activities.
Setting criteria for minimum balances, interest rates, withdrawals allowed, limits and so
on.
The branch confines itself to the following key functions:
Creating manual documents capturing data required for input into software
Internal authorization
Initiating Beginning-Of-Day (BOD) operations
End-Of-Day (EOD) operations
Reviewing reports for control and error correction.

Core Banking System
TECHNOLOGY AND WORK-FLOW OF CBS
CBS involves banking services provided by a group of networked bank branches. As they are
networked, customers can access their accounts and perform certain transactions from any of
the bank's branches.
The customer is no longer a customer of the branch but is a customer of the bank.
CBS is a combination of an application software and network devices and Central Data
Centre.
CBS is a Technology environment based on client-server architecture, having a Remote Server
(called Data Centre) and Client (called Service Outlets which are connected through channel
servers) branches.
CBS has brought significant changes so far as workflow and housekeeping
activities/accounting processes at branches are concerned.
User-actions and controls are elaborately menu-driven.
User is prompted by software to initiate an action and to apply a control.
Various periodical runs/ mass activities like Application of Interest & Service Charges,
Updating of parameters globally, balancing/ reconciliation of ledgers and TDS etc. are
carried out centrally at the Data Centre, leaving various control actions to be taken at
branches.
TECHNOLOGY COMPONENTS
The software resides in a centralized application server which is in the Central Office Data
Centre, so the application software is not available at the branch but can be accessed from
the branches or online.
Along with database servers and other servers, an application server is located at the
Central Data Centre.
The CBS deployed by the Banks as a part of the CBS Project includes Data Centre (DC) and
the Disaster Recovery Centre (DRC).
The key technology components of CBS are as follows:
Database Environment
Application Environment
Web Environment
Security solution
Connectivity to the Corporate Network and the Internet
Data Centre and Disaster Recovery Centre
Network Solution architecture to provide total connectivity
Enterprise Security architecture
Branch and Delivery channel environment
Online Transaction monitoring for fraud risk management

Core Banking System
Technology Architecture of CBS
The Fig. provides an architecture overview of CBS with client access devices at the top
which interface with channel servers which in turn interface with application servers which
are connected to the database servers hosted on windows/Unix platform.
These concepts are further explained in later section (CBS IT Environment) of this chapter.
Teller : Browser or Client/Server
Customer : branch, ATM, POS,
telephone, Internet; TV browser,
PDA, mobile phone etc.
Branch Server
ATM/POS Switch
IVR Server
WAP or SMS Server
Web Server
Business Intelligence
TP Monitors
Host Connect
Oracle RDBMS
Execution Logic
Functional Architecture of CBS
A Core Banking Solution is the enterprise resource planning software of a bank.
However, a CBS is modular in nature and is generally implemented for all functions or for
core functions as decided by the bank.
For example, if treasury operations or foreign exchange transactions are minimal, then
this may not be implemented in CBS but the results could be linked to CBS as linked with
the proper interface.
Hence, the implementation would depend on the need and criticality of specific banking
services provided by the bank.

Core Banking System
The following Fig. provides a functional architecture of CBS covering the complete range
of banking services.
HOW DOES CBS WORK?
The CBS software meets the needs of banks right from customers, staff, vendors, regulators
and auditors.
CBS covers the entire flow of information right from initiation, processing to storage and
archiving of information.
The CBS also interfaces with various type of software that may be developed in-house or
procured from different vendors. This software must be updated as required on a regular
basis.
The deployment and implementation of CBS should be controlled at various stages to ensure
that banks automation objectives are achieved:
Planning for implementing the CBS should be done as per strategic and
business objectives of bank.
The decision to implement CBS requires high investment and recurring costs
and will impact how banking services are provided by the bank. Hence, the decision must
be approved by the board of directors.

Core Banking System
Although there are multiple vendors of CBS, each solution has key
differentiators. Hence, bank should select the right solution considering various parameters
as defined by the bank to meet their specific requirements and business objectives.
CBS solutions used to be earlier developed in-
house by the bank. Currently, most of the CBS deployment are procured. There should be
appropriate controls covering the design or development or procurement of CBS for the
bank.
Extensive testing must be done before the CBS is live. The testing is to be done
at different phases at procurement stage to test suitability to data migration to ensure all
existing data is correctly migrated and testing to confirm processing of various types of
transactions of all modules produces the correct results.
CBS must be implemented as per pre-defined and agreed plan with
specific project milestones to ensure successful implementation.
CBS must be maintained as required. E.g. program bugs fixed, version
changes implemented, etc.
CBS must be supported to ensure that it is working effectively.
CBS modules must be updated based on requirements of business processes,
technology updates and regulatory requirements
Audit of CBS must be done internally and externally as required to ensure that
controls are working as envisaged.
The following diagram provides an overview of how a CBS works.
It may be noted that the core of CBS is the customer who interacts with CBS through various
channels such as branches, ATMs, call centres, internet banking, relationship officers of
bank or through mobile phones.
These delivery channels connect to different business modules/ silos in an integrated
manner.
These functional modules connect to various types of servers such as database server, CRM
server, application server, data warehouse server, ATM servers, etc.
In addition, partners/ vendors may also be connected to the CBS.
Customer Identification File (CIF) is a digital or virtual file where the customer identity details
with a valid photo ID and address details are stored and given a unique number which is
called CIF number.
A customer may have many accounts of different nature, like current account, savings account,
loans etc., but all these accounts will be mapped to one CIF only.

Core Banking System
CBS IT ENVIRONMENT
Servers
The Server is a sophisticated computer that accepts service requests from different
machines called clients.
The requests are processed by the server and sent back to the clients.
Some of these are briefly explained here:
CBS is developed as internet based application and therefore can be accessed through
browser application.
Application server may be decentralized and located at regional office or at branch for
easy and quick response. No user is granted access to CBS directly.
The validation is a complete process in the computer so that it ensures that data that is fed
in, conforms to certain prerequisite conditions e.g., if an operator keys in data for
withdrawal of money, the account number of customer would be entered by the operator
naturally.
The Application Server performs necessary operations and this updates the account
of the customer "A" in the database server.

Core Banking System
The customer may do some other operation in branch "Y". The process is validated
at branch "Y" and the data is transmitted to the application software at the data
center.
The results are updated in the database server at the centralized data center.
Thus, it would be observed that whatever operations a customer may do at any of
the branches of the bank the accounting process being centralized at the
centralized data center is updated at the centralized database.
The application software is never static and would require some changes to be
effected either due to bugs discovered or a change in the process or any other
justified reason.
Such changes are never made directly into the live application server. These
changes are made to a separate server called a test server.
The earlier version would be archived and the latest copy of the software would
always have a backup copy.
The Database Server of the Bank contains the entire data of the Bank.
Application software would access the database server. The data contained in the
database must be very secure and no direct access should be permitted to prevent
unauthorized changes.
Strict discipline is followed regarding the maintenance of the database server, The
individual who performs this role is called the Database Administrator.
From the normal application server, the Automated Teller Machine Server (ATMS)
and Internet Banking Application Server (IBAS) would also access the Database
Server. And the account at the centralized database would be updated.
This server contains the details of ATM account holders.
When the Central Database is busy for any other reason, the file containing the
account balance of the customer is sent to the ATM switch. Such a file is called
Positive Balance File (PBF).
Once the central database server becomes accessible all the transactions that took
place till such time as the central database became un-accessible would be
updated in the central database.
This ensures not only continuity of ATM operations but also ensures that the Central
database is always up-to-date.

Core Banking System
The Internet Banking database server stores the user name and passwords of all
the internet banking customers.
IBCS (Internet Banking Channel Server) software stores the name and password
of the entire internet banking customers.
IBCS server also contains the details about the branch to which the customer
belongs.
The Internet Banking customer would first have to log into the bank's website with
the user name and password.
The Internet Banking Software which is stored in the IBAS (Internet Banking
Application Server) authenticates the customer with the login details stored in the
IBCS.
Authentication process is the method by which the details provided by the customer
are compared with the data already stored in the data server to make sure that
the customer is genuine and has been provided with internet banking facilities.
The Web Server is used to host all web services and internet related software.
All the online requests and websites are hosted and serviced through the web
server.
A Web server is a program that uses HTTP (Hypertext Transfer Protocol) to serve
the files that form Web pages to users, in response to their requests, which are
forwarded by their computers' HTTP clients.
Dedicated computers and appliances may be referred to as Web servers as well.
All computers that host Web sites must have Web server programs.
A Proxy Server is a computer that offers a computer network service to allow clients
to make indirect network connections to other network services.
A client connects to the proxy server, and then requests a connection, file, or other
resource available on a different server.
In some cases, the proxy may alter the client's request or the server's response for
various purposes.
The Anti-Virus Server is used to host anti-virus software which is deployed for
ensure that appropriate virus/ malware scans are performed.

Core Banking System
Case Study of IT deployment in Bank
(please refer the module)
Banks carry out variety of functions across the broad spectrum of products offered by them.
Some of the key products that are provided by most commercial banks are Current & Savings.
The flow and process as well as relevant risk and control may differ from bank to bank however
below information should give a basic idea to students about these processes where CBS and
other relevant applications are used and what specific risk and controls might be relevant in
such cases.
BUSINESS PROCESS FLOW OF CURRENT &SAVINGS ACCOUNTS (CASA)
A. Process Flow of CASA facility (as shown in the Fig. 5.3.1)
Either the customer approaches the relationship manager to apply for a CASA facility or
will apply the same through internet banking, the charges/ rates for the facility are
provided by the relationship manager basis the request made by the customer.

Core Banking System
Once the potential customer agrees for availing the facilities/products of the bank, the
relationship manager request for the relevant documents i.e. KYC and other relevant
documents of the customer depending upon the facility/product. KYC(Know Your
Customer) is a process by which banks obtain information about the identity and address
of the customers. KYC documents can be Passport, Driving License, etc.
The documents received from the customers are handed over to the Credit team / Risk
team for sanctioning of the facilities/limits of the customers.
Credit team verifies the document's, assess the financial and credit worthiness of the
borrowers and updates facilities in the customer account.
Current / Account savings account along with the facilities requested are provided to the
customer for daily functioning.
Customers can avail facilities such as cheque deposits / withdrawal, Cash deposit /
withdrawal, Real Time Gross Settlement (RTGS), National Electronics Funds Transfer
System (NEFT), Electronic Clearing Service (ECS), Overdraft Fund Transfer services
provided by the bank
B. Risks and Controls around the CASA Process
S
N
RISK CONTROL
1
Credit Line setup is
unauthorized and not in
line with the banks policy.
The credit committee checks that the Financial Ratios, the
Net-worth, the Risk factors and its corresponding
mitigating factors, the Credit Line offered and the Credit
amount etc. is in line with Credit Risk Policy and that the
Client can be given the Credit Line.
2
Credit Line setup in CBS is
Access rights to authorize the credit limit in case of account
setup system should be restricted to authorized personnel.
3
Customer Master defined
in CBS is not in accordance
with the Pre Disbursement
Certificate.
Access rights to authorize the customer master in CBS
should be restricted to authorized personnel.
4
Inaccurate interest /
charge being calculated in
CBS.
Interest on fund based facilities are automatically
calculated in the CBS as per the defined rules.
5
Unauthorized personnel
approving the CASAS
transaction in CBS.
Segregation of Duties to be maintained between the
initiator and authorizer of the transaction for processing
transaction in CBS.
6
Inaccurate accounting
entries generated in CBS.
Accounting entries are generated by CBS basis the
facilities requested by the customer and basis defined
configurations for those facilities in CBS.

Core Banking System
BUSINESS PROCESS FLOW OF CREDIT CARDS
A. Process Flow of Issuance of Credit Card Facility
1. Either the customer approaches the relationship manager to apply for a credit card facility
or customer will apply the same through internet banking, the charges/rates for the facility
are provided by the relationship manager basis the credit application made by the
customer.
2. Once the potential customer agrees for availing the facilities/products of the bank, the
relationship manager request for the relevant documents i.e. KYC and other relevant
documents of the customer depending upon the facility/product.
3. The documents received from the customers are handed over to the Credit team for
sanctioning of the facilities/limits of the customers.
4. Credit team verifies the document's, assess the financial and credit worthiness of the
borrowers and issues a credit limit to the customer in CBS and allots a credit card.
5. Credit Card is physically transferred to the customer's address.

Core Banking System
B. Process Flow of Sale - Authorization process of Credit
Card Facility
1. Customer will swipe
the credit card for
the purchase made
by him/her on the
POS machine (Point
of Sale) at
merchant's
shop/establishment.
2. POS (Point of Sale)
will process the
transaction only
once the same is
authenticated.
3. The POS (Point of
Sale) will send the
authentication request to the merchant's bank (also referred as "acquiring bank") which will
then send the transaction authentication verification details to the credit card network (such
as VISA, MASTER CARD, AMEX, RUPAY) from which the data will be validated by the
credit card issuing bank within a fraction of seconds.
4. Once the transaction is validated, the approval message is received from credit card
issuing bank to the credit card network which then flows to the merchant's bank and
approves the transaction in the POS (Point of Sale) machine.
C. Process Flow of Clearing & Settlement process of
Credit Card Facility (as shown in the Fig. 5.3.3)
1. The transaction data from the merchant is transferred to the merchant’s bank. Merchant’s
bank clears settlement amount to Merchant after deducting Merchant fees. Merchant’s
bank, in turn now provides the list of settlement transactions to the credit card network
which then provides the list of transactions made by the customer to the credit card
issuing bank.
2. The credit card issuing bank basis the transactions made, clears the amount to Merchant’s
bank but after deducting interchange transaction fees.
3. At the end of billing cycle, card issuing company charges the customer’s credit card
account with those transactions in CBS.

Core Banking System
D. Risks and Controls around the Credit Card Process
S
N
RISK CONTROL
1
Credit Line setup is
The credit committee checks that the Financial Ratios, the
Net-worth, the Risk factors and its corresponding
mitigating factors, the Credit Line offered and the Credit
amount etc. is in line with Credit Risk Policy and that the
Client can be given the Credit Line.
2 Credit Line setup is
Access rights to authorize the credit limit in case of account
setup system should be restricted to authorized personnel.
3
Masters define for the
customer are not in
accordance with the
Pre-Disbursement
Certificate
Access rights to authorize the customer master in credit
card system should be restricted to authorized personnel,
Segregation of duties exist in credit card system such that
the system restricts the maker having checker rights to
approve the facilities booked by self in the credit card
system.
4
Credit Line setup can be
breached
Transaction cannot be made if the aggregate limit of
outstanding amount exceeds the credit limit assigned to
customer.
5 Inaccurate interest /
charge being calculated
in the Credit Card system.
Interest on fund based credit cards and charges are
automatically calculated in the credit card system as per
the defined masters.
6
Inaccurate reconciliations
Performed.
Daily reconciliation for the balances received from credit
card network with the transactions updated in the credit
card system on card network level.
BUSINESS PROCESS FLOW OF MORTGAGES
A Mortgage loan is a secured loan which is secured on the borrower's property by marking
a lien on the property as collateral for the loan.
If the borrower stops paying, then the lender has the first charge on the property.
Mortgages are used by individuals and businesses to make large real estate purchases
without paying the entire value of the purchase up front.
Over the period of many years, the borrowers repay the loan amount along with interest
until there is no outstanding.
1. Types of Mortgage Loan
This is a traditional mortgage where customer has an option of selecting
fixed or variable rate of interest and is provided for the purchase of property.

Core Banking System
Here the customer already has an existing loan and is applying for
additional amount either for refurbishment or renovation of the house.
In case of under construction properties
the loan is disbursed in tranches / parts as per construction plan.
2. Process Description
Loans are provided by the lender which is a financial institution such as a bank or a
mortgage company. There are two types of loan widely offered to customer first is fixed
rate mortgage where rate of interest remains constant for the life of the loan second is
variable/floating rate mortgage where rate of interest is fixed for a period but then it
fluctuates with the market interest rates.
Borrower / Customer approaches the bank for a mortgage and relationship manager/
loan officer explains the customer about home loan and its various feature. Customer to
fill loan application and provide requisite KYC documents (Proof of Identity, Address,
Income and obligation details etc.) to the loan officer.
Loan officer reviews the loan application and sends it to Credit risk team who will
calculate the financial obligation income ratio which is to determine customer's financial
eligibility on how much loan can be provided to the customer.
This is done basis the credit score as per Credit Information Bureau (India) Limited (CIBIL)
rating, income and expense details and Rate of Interest at which loan is offered. Once
financial eligibility is determined, then along with customer documents the details are sent
to the underwriting team for approval.
Underwriting team will verify the financial (applicant's credit history) and employment
information of the customer. Underwriter will ensure that the loan provided is within the
lending guidelines and at this stage provide conditional approval along with the list of
documents required.
As per the property selected by the customer, loan officer will provide the property
details along with requisite documents (property papers etc.) to the legal and valuation
team. Legal team will carry out title search on the property which is to determine legal
owner of the property, any restrictions or any lien on the property etc. Valuation team
will carry out valuation of property and determine its value.
Further verification of property to determine whether property is built as per the
approved plan, whether builder has received requisite certificates, age of building to
determine whether it will withstand the loan tenure, construction quality.
Legal and valuation team will send their report to the operations team which will
generate letter of offer / Offer letter to customer which entails all details of loan such
as loan amount, rate of interest, tenor, monthly installment, security address, fee/charges
details and term and conditions.
Customer will agree to loan agreement which is offered by signing the offer letter. Loan
officer will notarize all the loan documents and are send back to lender operations team.

Core Banking System
Once signed offer letter is received the operations team will release or disburse fund
and prepare a cashier order. Cashier order is provided to customer in exchange of
mandatory original property documents. Once exchange is carried out successfully, banks
place a charge or lien on the property so that in case of default the first charge is with
the bank to recover the money.
Post disbursement of loan customer can carry out various loan servicing activity by visiting
the branch or via online mode amendments such as interest rate change, change in
monthly instalment, prepayment of loan amount and foreclosure of loan etc.
3. Risk Controls around the Mortgage Process
S
N
RISK KEY CONTROL
1 Incorrect customer and
loan details are captured
which will affect the over-
all downstream process.
There is secondary review performed by an independent
team member who will verify loan details captured in
core banking application with offer letter.
2
Incorrect loan amount
disbursed.
There is secondary review performed by an independent
team member who will verify loan amount to be disbursed
with the core banking application to the signed offer
letter.
3 Interest amount is in-
correctly calculated and
charged.
Interest amount is auto calculated by the core banking
application basis loan amount, ROI and tenure.
4
Unauthorized changes
made to loan master data
or customer data.
System enforced segregation of duties exist in the core
banking application where the inputter of the transaction
cannot approve its own transaction and reviewer cannot
edit any details submitted by inputter.
TREASURY PROCESS
Investments Category are Government Securities (Gsec), shares, other investments, such as,
Commercial Papers, Certificate of Deposits, Security Receipts, Pass Through Certificates, Units
of Mutual Funds, Venture Capital Funds and Real Estate Funds Debentures and Bonds.
Products in Trading category are Forex and Derivatives (Over-The-Counter (OTC) and
Exchange traded) the products involved are Options, Swaps, Futures, Foreign Exchange (FX)
forwards, Interest derivatives)
4. Core areas of Treasury Operations:
The Front Office operations consist of dealing room operations wherein the dealers
enter into deal with the various corporate and interbank Counter-parties.
Deals are entered by dealers on various trading /Communication platform and
they are primarily responsible to check for counter-party credit Limits, eligibility,

Core Banking System
and other requirements of the Bank before entering into the deal with the
customers.
All counter-parties are required to have executed the International Swaps and
Derivatives Association ('ISDA') agreement as well as pass a board resolution
allowing it to enter into derivatives contract.
As soon as the deal is struck with counter-party, the deal details are either noted in
a manual deal pad or punched in front office system of the Bank which gets queued
in for authorization.
Middle Office includes risk management, responsibility for treasury accounting, and
documentation of various types, producing the financial results, analysis and budget
forecasts for the treasury business unit, input into regulatory reporting.
It is responsible for monitoring of counterparty, country, dealer and market-related
limits that have been set and approved in other areas of the bank such as the credit
department.
The mainstream role of the Back Office is in direct support of the trading room or
front office.
This includes verification by confirmation, settlement, checking existence of a valid
and enforceable International Swap Dealers Association ('ISDA') agreement and
reconciliation of nostro accounts (a bank account held by a UK bank with a foreign
bank, usually in the currency of that country) as soon as possible.
An important development in the back office has been the advent of Straight-Through
Processing (STP), also called 'hands-off' or exception processing. This has been made
possible through enhancement of system to real time to verify from an external
source.
The critical one is FOBO (Front Office/ Back Office) reconciliation to ensure the
completeness and accuracy of trades/ deals done for the day.
In practice, this is done automatically, comparing incoming data from brokers and
counter-parties and investigating exceptions.
One of the basic tenets for a treasury area in a bank is the strict segregation of
duties and location between the front and back office, the latter controlling
confirmations and settlement transactions.

Core Banking System
Process flow for Bank Treasury Operations:
6. Risk Controls around the Treasury Process
S
N
RISK KEY CONTROL
1
Unauthorized securities
setup in systems such as
Front office/Back office.
Appropriate Segregation of duties and review
controls around securities master
setup/amendments.
2
Inaccurate trade is
processed.
Appropriate Segregation of duties and review
controls to ensure the accuracy and authorization
of trades.
3
Unauthorized confirmations
are processed.
Complete and accurate confirmations to be
obtained from counter-party.
4
Insufficient Securities
available for Settlement
Effective controls on securities and margins.
5
Incomplete and inaccurate
data flow between systems.
Inter-system reconciliations, Interfaces and batch
processing controls.
6
Insufficient funds are
available for settlements.
Controls at CCIL/NEFT/RTGS settlements to ensure
the margin funds availability and the timely funds
settlements.
7
Incorrect Nostro payments
processed.
Controls at Nostro reconciliation and payments.
LOANS AND TRADE FINANCE PROCESS
The business of lending is carried on by banks offering various credit facilities to its customers.
Basically various credit facilities offered by banks are generally repayable on demand.
A bank should ensure proper recovery of funds lent by it and acquaint itself with the nature
of legal remedies available to it and also law affecting the credit facilities provided by it.

Core Banking System
7. Classification of Credit Facilities:
Fund based credit facilities involve outflow of funds meaning thereby the money of
the banker is lent to the customer.
They can be generally of following types:
Cash Credits/Overdrafts
Demand Loans/Term loans
Bill Discounting
In this type of credit facility, the banks funds are not lent to the customer and they
include Bank Guarantees and Letter of Credit.
1. The relationship manager across locations identifies the potential customers and
approaches them with the details of the products/facilities and the charges/rates or
the customer may directly approach the bank for availing the facilities.
2. Once the potential customer agrees for availing the facilities/products of the bank,
the relationship manager request for the relevant documents i.e. KYC and other
relevant documents of the customer depending upon the facility/product.
3. The documents received from the customers are handed over to the Credit team of
bank for sanctioning of the facilities/limits of the customers.
4. Credit team verifies the document's, assess the financial and credit worthiness of the
borrowers and issues a sanction letter to the customer.
5. Sanction letter details the terms of the facilities and the credit limits the customer is
eligible e.g. how much loan can be offered to the customer.
6. Once the customer agrees with the terms of the sanction letter, the credit team
prepares a Pre Disbursement Certificate (PDC) containing the details of all the
facilities & limits approved for the customer and sends it to the disbursement team
i.e. the team who is responsible for disbursing the loan amount to customer.
7. The disbursement team verifies the PDC and creates customer account and master in
the Loan Disbursement System. The disbursement team member also assigns the limits
for various products as per PDC.
8. Once the limits are assigned to the customer, the customer can avail any of the
facilities/products up to the assigned credit limits.

Core Banking System
1. Customer may approach the bank for availing the product/facility as per the sanction
letter.
2. The facility/product requested are offered to the customer after verifying the
customer limits in the Loan Disbursal System which normally would be CBS or may be
a separate system which later interfaces with CBS on periodic basis.
3. In case of the fund based loan -Term Loan /Overdraft/Cash credits, the funds are
disbursed to the customer's bank accounts and the corresponding asset is recorded in
a loan account recoverable from the customer.
4. Interest is generally accrued on a daily basis along with the principal as per the
agreed terms are recovered from the customer.
5. In case of bills discounting product, the customer is credited the invoice amount
excluding the interest amount as per the agreed rates. Interest income is generally
accrued on a daily basis. Receivable is booked in a loan account.
6. In case of non- fund based facilities, the facilities are granted to the customer up to
the assigned limits in the loan disbursement system.
7. Contingent entries are posted for asset and liabilities.
8. Commission is normally charged to the customer account upfront on availing the
facility and is accrued over the tenure of the facilities granted to the customer.
S
N
Product
Income for
banks
Accounting of
Income
1 Cash Credit / Overdraft
Interest on Cash Credits/
Overdraft balances.
Interest accrued on a daily
basis at the agreed rates.
2
Demand draft/ Term
Loan's
Interest on Demand
draft/Term loan.
Interest accrued on a daily
3 Bill Discounting Discounting Income. Interest accrued on a daily
4 Bank Guarantee Commission.
Commission accrued over
the tenure of the bank
guarantee.
5 Letter of Credit Commission Income.
Commission accrued over
the tenure of the bank
guarantee.

Core Banking System
8. Process flow for Fund based loans

Core Banking System
9. Process flow for Non-fund based loans

Core Banking System
10. Risk and Controls in the Loans and Advances Process
S
N
RISK KEY CONTROL
1
Credit Line setup is unau-
thorized and not in line with
the banks policy.
The credit committee checks that the Financial
Ratios, the Net-worth, the Risk factors and its
corresponding mitigating factors, the Credit Line
offered and the Credit amount etc. is in line with
Credit Risk Policy and that the Client can be given
the Credit Line.
2
Credit Line setup is unau-
thorized and not in line with
the banks policy.
Access rights to authorize the credit limit in Loan
Booking system/CBS should be restricted to
authorized personnel.
3
Masters defined for the
customer are not in
accordance with the Pre
Disbursement Certificate
Access rights to authorize the customer master in
Loan Booking system/CBS should be restricted to
authorized personnel.
Segregation of duties exist in Loan Disbursement
system. The system restricts the maker having
checker rights to approve the loan/facilities
booked by self in loan disbursal system
4
Credit Line setup can be
breached in Loan dis-
bursement system/CBS.
Loan disbursement system/CBS restricts booking of
loans/ facilities if the limits assigned to the
customer is breached in Loan disbursement
system/CBS.
5
Lower rate of interest/
Commission may be
charged to customer.
Loan disbursement system/CBS restricts booking of
loans/ facilities if the rate charged to the customer
are not as per defined masters in system.
6
Facilities/Loan's granted
may be unauthorized/in-
appropriate
Segregation of duties exist in Loan Disbursement
system. The system restricts the maker having
checker rights to approve the loan/facilities
booked by self in loan disbursal system
7
Inaccurate interest / charge
being calculated in the Loan
disbursal system
Interest on fund based loans and charges for non-
fund based loans are automatically calculated in
the Loan disbursal system as perthe defined
masters
INTERNET BANKING PROCESS
The customer applies to the bank for such a facility. The user is provided with a User ID and
Password. As is the best practice the password is expected to be changed soon after the first
log on.
On access, user is directed to secure web server.

Core Banking System
The internet banking website is hosted on the web server. The web server is in the central
data centre of the bank. Access to the web server is permitted only to authorised users.
The firewall is designed in such a fashion that only traffic addressed to the web server through
the authorised port is permitted.
An individual who accesses the website of bank through the browser will be able to access
the web server and there will be a display of the bank's web page on the screen of the
client's computer.
The password will not be displayed in plain text but will only be in an encrypted form.
The web server forwards the customer details to the internet banking applications server which
in turn accesses the IDBS.
The server has already the database of all the customers who have been provided with
internet banking facility. For each customer, it would be having details about user ID and
password.
The information received from the web server is verified with the data of the customer held
in the internet banking (IBAS).
After three unsuccessful attempts, the customer will be logged out for security reasons. If more
attempts are permitted, there is a possibility of a person just trying out different combination
of user ID and password to break into the system.
Once the authentication process is completed correctly, the customer is provided internet
banking facility, which would include:
Password change
Balance inquiry
Fund transfer
Request for cheque book
Stop payment
Copy of statement of account; and
ATM/ Credit Card related queries
The customer then chooses one of the services from the list.
The service requested is directed by the web server to the IBAS for processing. The IBAS will
access the internet banking database server for further processing.
The Internet Banking Channel Server (IBCS) will retrieve the data from the central database
server.
The IBCS will be able to access the central database server only through a middleware and
firewall.
The middleware is expected to convert the data to suit the requirements of IBCS.

Core Banking System
Internet banking database server then forwards the customer data to the IBAS which processes
the transaction.
The IBCS then sends the data to the IBAS. The IBAS then sends the same to the web browser
(Internet Explorer).
The web server generates a dynamic web page for the service requested.
The customer would be able to get the service required, after the services provided, the user
may choose to log out.
The customer may be permitted to request for more than one service in one session. Some
software would automatically log out the customer after one service has been completed and
expect users to log in again.
It needs to be emphasized that security is a serious concern in internet banking and should be
implemented with great care.
E-COMMERCE TRANSACTION PROCESSING
Most of the e-Commerce transactions involve advance payment either through a credit or
debit card issued by a bank.
Here, the user logs in on the e-commerce web site, places an order and selects option of
payment - Cards, or Internet Banking.
If it is Internet Banking, the
merchant site is directed to
bank's Merchant-Internet
banking server. User must
log in and authorize
payment.
In India, this requires
customer enter OTP (Online
Transaction Password)
received on mobile, to
complete the transaction. After this, the customer is redirected to merchant site.
RISKS ASSOCIATED WITH CBS
Ownership of Data/ process: Data resides at the Data Centre. Establish clear ownership.
Authorization process: Anybody with access to the CBS, including the customer himself, can
enter data directly. What is the authorization process?
Authentication procedures: These may be inadequate and hence the user entering the
transaction may not be determinable or traceable.

Core Banking System
Several software interfaces across diverse networks: A Data Centre can have as many as
75-100 different interface and application software.
Maintaining response time: Maintaining the interfacing software and ensuring optimum
response time and up time can be challenging.
User Identity Management: This could be a serious issue. Some Banks may have more than
5000 users interacting with the CBS at once.
Access Controls: Designing and monitoring access control is an extremely challenging task.
Incident handling procedures: These may not be adequate considering the need for real-
time risk management.
Change Management: At application level and data level - Master files, transaction files
and reporting software.
IT RELATED RISKS AND MITIGATING CONTROLS
CBS software uses Technology platform to provide a complete range of banking services
integrating bank and its branches and providing end-to-end services to customers.
There are inherent risks of this technology deployment of CBS.
Risk is what can go wrong and impede the enterprise from achieving its objective, and
controls are countermeasures which help in mitigating the risks.
Hence auditors need to understand how CBS works, the inherent risks, implemented controls
and evaluate the residual risks and consequent exposures.
There are multiple ways in which risks can be assessed.
From a business perspective, the risks that can be classified based on following Information
criteria:
Response is delayed resulting in dissatisfied stakeholder.
Process is ineffective and multiple runs consume time.
Users lose confidence in information system.
Due to loss of critical data.
Incomplete or inaccurate data due to errors in input or processing.
Information system is not available when required.
The information system does not comply with legal, regulatory, contractual
or internal compliance requirements.

Core Banking System
1. Data Centre and Network Operations
To be done on regular basis as per back up policy.
Running of various types of
transactions on regular basis as per pre-defined schedules. For example: Clearing of
cheques, interest computation is done at specified intervals.
The Servers and
applications running on them are monitored to ensure that servers, network connections
and application software along with the interfaces are working continuously.
SLA with vendors are
regularly reviewed to ensure that the services are delivered as per specified
performance parameters.
The personnel
deployed have required competencies and skill-sets to operate and monitor the IT
environment of CBS of bank.
S
N
RISK KEY CONTROL
1
The transaction may not be recorded
completely or accurately, and the
related items will be inaccurately or
incompletely recorded.
Batch and online processing procedures are
defined, executed and monitored for
successful and timely completion.
Any exception is reviewed and timely
resolved.
2
Invalid items may be recorded or
valid items may be inaccurately or
incompletely recorded.
Access to automated job scheduling tools,
and executable programs are defined to
restrict to appropriate individuals as per
job requirement.
3
Timely and adequate technical
support may not be available and
issues may not be resolved.
Entity has written agreement(s) with outside
contractors and/ or software vendors to
provide for technical support, as needed.
Management monitors compliance with
these agreements.
4
User queries may not be timely and
adequately resolved.
Help desk function exists to provide support
on user queries regarding systems.
Problems are recorded and the log for
timely resolution of all such user queries is
monitored.
5
Timely execution and complete
processing and availability of data
may not be ensured.
Performance and capacity utilization of the
computer systems are measured, reported,
and reviewed by management

Core Banking System
6
Unavailability of applications and
data backups in the event of a
disaster. It can also result in
disclosure of sensitive information.
All tapes, manuals, guides are properly
labelled and timely stored in a secured
environmentally controlled location.
7
Data may be lost and systems may
not be recoverable in the event of a
serious system failure. This may result
in regulatory/ legal complaints, loss
of reputation beside financial loss.
Schedule backup and storage of data is
done periodically and appropriately.
Management periodically reviews backups
are done as per back up policy and meet
business and legal requirements.
8
Backup may not be available if
subject to some disaster, resulting in
risk of data loss.
Backups are archived off-site.
2. Information Security
The security policy is basis on which detailed procedures and practices are
developed and implemented at various units/department and layers of technology,
as relevant.
It ensure that information is made available safely and securely.
Refers to security for various users of information systems. The security administration
policy documents define how users are created and granted access as per
organization structure and access matrix.
It also covers the complete administration of users right from creation to disabling of
users is defined as part of security policy.
Refers to how security is implemented at various aspects of application right from
configuration, setting of parameters and security for transactions through various
application controls.
Refers to various aspects of implementing security for the database software.
Refers to security for operating system software which is installed in the servers and
systems which are connected to the servers.

Core Banking System
Refers to how security is provided at various layers of network and connectivity to
the servers.
Refers to security implemented through physical access controls.
S
N
RISK KEY CONTROL
1
Significant information resources
may be modified inappropriately,
disclosed without authorization,
and/ or unavailable when needed.
(e.g., they may be deleted without
authorization).
Super user access or administrator passwords
are changed on system installation and are
available with administrator only.
Password of super user or administrator is
adequately protected.
2
Lack of management direction and
commitment to protect information
assets.
Security policies are established and
management monitors compliance with
policies.
3
Potential Loss of confidentiality,
availability and integrity of data
and system.
Vendor default passwords for applications
systems, operating system, databases, and
network and communication software are
appropriately modified, eliminated, or
disabled.
4
User accountability isnot
established.
All users are required to have a unique user
id.
5
It is easier for unauthorized users to
guess the password of an
authorized user and access the
system and/ or data. This may
result in loss of confidentiality,
and system.
The identity of users is authenticated to the
systems through passwords.
The password is periodically changed, kept
confidential and complex (e.g., password
length, alphanumeric content, etc.)
6
Unauthorized viewing, modification
or copying of data and/ or
unauthorized use, modification or
denial of service in the system.
System owners authorize the nature and
extent of user access privileges, and such
privileges are periodically reviewed by
system owners
7
Security breaches may go
undetected.
Access to sensitive data is logged and the
logs are regularly reviewed by
management.

Core Banking System
8
Potential loss of confidentiality,
and system
Physical access restrictions are implemented
and administered to ensure that only
authorized individuals can access or use
information resources.
9
Inadequate preventive measure for
key server and IT system in case of
environmental threat like heat,
humidity, fire, flood etc.
Environmental control like smoke detector,
Are extinguisher, temperature maintenance
devices and humidity control devices are
installed and monitored in data center.
1
0
Unauthorized system or data
access, loss and modification due to
virus, worms and Trojans.
Network diagram is prepared and kept
updated. Regular reviews of network
security are performed to detect and
mitigate network vulnerabilities.
3. Application Software
Application software is the lifeblood of an enterprise as they process all core transactions
of an enterprise.
All the core information systems of the bank which interfaces with customers are run using
various modules of CBS including other software developed in-house or procured from
other vendors.
It is important to understand risks pertaining to application software as they directly
impact the bank's operations.
Some of the key application risks are implementation of weak security; unauthorized
access/ changes to data; unauthorized Remote Access; inaccurate Information processing;
erroneous of falsified data input; misuse by authorized end users; etc.
S
N
RISK KEY CONTROL
1
Interest may be incorrectly
computed leading to
incorrect recording of in-
come/ expenditure.
Interest is automatically correctly computed.
Digits are rounded off appropriately. Interest is
accurately accrued.
2
Inappropriate assignment of
rate codes resulting in
violation of business rules
and/ or loss of revenue.
The interest rate code is defaulted at the account
level and can be modified to a rate code carrying
a higher or lower rate of interest only based on
adequate approvals.
3
Absence of appropriate
system validations may
result in violation of business
rules.
System validations have been implemented to
restrict set up of duplicate customer master
records.

Core Banking System
4
Inappropriate reversal of
charges resulting in loss of
revenue.
System does not permit reversal of the charges in
excess of the original amount charged.
5
Multiple liens in excess of
the deposit value may result
in inability to recover the
outstanding in the event of a
default.
System prevents a single lien from exceeding the
deposit value.
It prevents marking of multiple liens against the
same deposit, thus preventing the total liens
exceeding the deposit account.
6
Inappropriate security or
controls over system
parameter settings resulting
in unauthorized or incorrect
changes to settings.
Access for changes made to the configuration,
parameter settings is restricted to authorized user
and require authorization/ verification from
another user.
7
Failure to automate closure
of NRE/ NRO accounts on
change in residence status
may result in regulatory
non-compliance and undue
benefits to customers.
On change of Customer status from NRI/ NRO to
Resident on system, the system force the closure of
accounts opened for that customer under NRE/
NRO schemes, and to re-open the same under
resident saving account schemes.
8
Inappropriate set up of
accounts resulting in
violation of business rules.
The system parameters are set up as per business
process rules of the bank.
9
Failure to levy appropriate
revenue. Inappropriate levy
of charges, resulting in
customer disputes.
System does not permit closing of an account
having zero balance without recovering the
applicable account closure charges.
1
0
Inappropriate security or
controls over file upload
transactions resulting in in-
tentional or inadvertent
accounting errors.
Automated file upload process to the NPA
Provisioning System, exist eliminating the need for
manual intervention.
1
1
Incorrect classification and
provisioning of NPAs,
resulting in financial mis-
statement.
Configuration/ customization exists in the
application to perform the NPA classification as
per relevant RBI guidelines.
1
2
Failure to levy appropriate
revenue.
Inappropriate levy of
charges, resulting in
customer disputes.
The charges applicable for various transactions as
per account types are properly configured as per
bank rules. The Charges are as in compliances with
RBI and bank's policies
1
3
Duplicate asset records may
be created. Ownership of Unique id is created for each asset.

Core Banking System
asset may not be clearly
established
Each asset is assigned to specific business unit and
user to establish ownership.
4. Application Software - Configuration, Masters,
Transactions and Reports(REFER CHAPTER 1)
Application Software whether it is a high-end CBS software, ERP software or a simple
accounting software, have primarily four gateways through which enterprise can control
functioning, access and use the various menus and functions of the software.
These are as follows:
CONFIGURATION:
Configuration refers to the way a software system is set up for use. Configuration
is the first step after installing the software.
This involves setting up various parameters (configuration) as per policies and
business process rules.
Most of the system software are also configured with default parameters which
need to be modified.
It is very critical to configure the software correctly as per specific policies,
procedures and practices of the bank.
Configuration could include both hardware and software parameters.
Configuration will define how software will function and what menu options are
displayed.
Some examples of configuration are given here:
Defining access rules from various devices/terminals.
Creation of User Types
Creation of Customer Type, Deposit Type, year-end process
User Access & privileges - Configuration & its management
Password Management
MASTERS:
Masters refer to the setting parameters for various types of product and service
type as per software modules used in the bank.
The parameter settings in the masters will drive how the software will process
relevant transactions.
After configuring the software, the masters are set up first time during installation
and these are changed whenever the business process rules or values.

Core Banking System
For example: If RBI has changed the lending rates based on which bank has
decided to change the interest rates for specific type of advances, the interest
parameters are to be updated
Some examples of masters are as follows:
Customer Master for advances: Credit limit, loan period, interest rate, penal
interest rate, security offered, sanction terms, customer details, etc.
Deposit Master: Interest rate, type of deposit, service charges, period of
interest computation, Minimum balance, withdrawal limits, a/c type (NRE/
NRO), etc.
Customer Master: Customer type, details, address, PAN details,
Employee Master: Employee Name, Id, designation, level, joining details,
salary, leave, etc.
Income Tax Master: Tax rates applicable, Slabs, frequency of TDS, etc.
TRANSACTIONS:
Transactions refer to the actual transactions of various products and services which
can be user using menus and functions and by customer through internet/mobile
banking.
The transactions are allowed based on user access and access authorization matrix
set. For example, for each user, access to specific modules, type of transactions,
and what they can do: entry, authorize or view would be possible. Some examples
of transactions are given here:
Deposit transactions: opening of a/c, deposits, withdrawals, interest
computation, etc.
Advances transactions: opening of a/c, deposits, withdrawals, transfers,
closure, etc.
ECS transactions: Entry, upload, authorize/approve, update, etc.
General Ledger: Expense accounting, interest computation update, charges
update, etc.
REPORTS:
Users at different levels used information which is processed by the computers. This
information could be in form of reports which are periodically generated or on
demand.
These reports could be standard or adhoc reports. The reports could be used for
monitoring the operations as also for tracking the performance or security.
CBS Software also have development platform using which, the bank can develop
specific reports as required on standard or on an ad hoc basis.

Core Banking System
However, depending on the management style and information requirements
reporting features would be used by the bank.
Some examples of reports are as follows:
Summary of transactions of day
Daily General Ledger (GL) of day
Activity Logging and reviewing
MIS report for each product or service
Reports covering performance/compliance
Reports of exceptions, etc.
RISK PREDICTION FOR BASEL III, BASED ON ARTIFICIAL INTELLIGENCE
Basel III is a comprehensive set of reform measures, developed by the Basel Committee on
Banking Supervision, to strengthen the regulation, supervision and risk management of the
banking sector.
One of the dimensions of Basel III is determining capital adequacy (capability) based on risk
assessment.
One of the critical areas of risk assessment is based on assessment of available data.
It is hence important to refresh our understanding of the concept of a Data Warehouse. Data
from CBS database is transferred to a Data Warehouse. Data Warehouse stores data in
multi-dimensional cubes (unlike the rows and columns structures of tables in a traditional
database of CBS). Data in the Data Warehouse is generally never purged. So, there is huge
data accumulated (collected) over years.
The traditional MIS Reports and Decision Making Systems do not address answers to random
questions on the data. (What if.....?)
The only comprehensive and accurate solution for this problem is using artificial neural network
logic (Artificial Intelligence), wherein algorithms based on neural networks are executed on
the data the Data Warehouse, so as to understand hidden trends, which in turn helps in risk
assessment.
This improves the management of banking risks and banking risk prediction, and in turn, the
assessment of capital adequacy under Basel III.
BANKING REGULATION ACT
The Banking Regulation Act, 1949 is legislation in India that regulates all banking firms in
India. Initially, the law was applicable only to banking companies.
But, in 1965 it was amended to make it applicable to cooperative banks and to introduce
other changes.

Core Banking System
The Act provides a framework using which commercial banking in India is supervised and
regulated.
The Act gives the Reserve Bank of India (RBI) the power to license banks, have regulation over
shareholding and voting rights of shareholders; supervise the appointment of the boards and
management; regulate the operations of banks; and many more.
In 1965, the Act was amended to include cooperative banks under its purview by adding the
Section 56.
RBI has been proactive in providing periodic guidelines to banking sector on how IT is
deployed.
RBI also provides the technology platform for NEFT/ RTGS and other centralized processing
from time to time.
Negotiable Instruments Act-1881 (NI Act)
Under NI Act, Cheque includes electronic image of truncated cheque and a cheque in the
electronic form.
A cheque in the electronic form has been defined as "a mirror image" of a paper cheque.
The expression 'mirror image' is not appropriate. It is perhaps not even the intention that
a cheque in the electronic form should look like a paper cheque as seen in the mirror.
The definition of a cheque in electronic form contemplates digital signature with or without
biometric signature and asymmetric crypto system.
Since the definition was inserted in the year 2002, it is understandable that it has captured
only digital signature and asymmetric crypto system dealt with under Section 3 of IT Act,
2000.
Since IT Act,2000 has been amended in the year 2008 to make provision for electronic
signature also, suitable amendment in this regard may be required in NI Act so that
electronic signature may be used on cheques in electronic form.
RBI REGULATIONS
The Reserve Bank of India (RBI) was established on April 1, 1935 in accordance with the
provisions of the Reserve Bank of India Act, 1934.
The basic functions of the Reserve Bank as: "to regulate the issue of Bank Notes and keeping
of reserves with a view to securing monetary stability in India and generally to operate the
currency and credit system of the country to its advantage."
The Primary objective of BFS is to undertake consolidated supervision of the financial sector
comprising commercial banks, financial institutions and non-banking finance companies.

Core Banking System
Some of the key functions of RBI are given here.
Formulates implements and monitors the monetary policy with the
objective of maintaining price stability and ensuring adequate flow of credit to productive
sectors.
Prescribes broad parameters
of banking operations within which the country's banking and financial system functions with
the objective of maintaining public confidence in the system, protect depositors' interest
and provide cost- effective banking services to the public.
Issues and exchanges or destroys currency and coins not fit for
circulation with the objective to give the public adequate quantity of supplies of currency
notes and coins and in good quality.
Impact of Technology in Banking
The Fig. shows the four key components of banking business with controls pervading all the
four areas of business process, policies and procedures, regulatory requirements and
organization structure.
However, in the CBS environment, technology is the encompasses all the four critical
components which are business processes, policies and procedures, regulatory
requirements and organization structure.
If IT fails, then none of the business processes
can be performed. Hence, it is important to
understand how the four components of
banking business are configured, maintained
and updated using technology.
As per policy directives of regulators, the
banking software should be configured or updated. The controls also need to be
implemented and updated at different layers of technology such as system software,
network, database, application software, etc.
Earlier, technology was a tool and used in specific department of the bank but now with
CBS, Technology has become all-pervasive and has become integral for doing banking.
MONEY LAUNDERING
Money Laundering is the process by which the proceeds of the crime and the true ownership
of those proceeds are concealed or made opaque so that the proceeds appear to come from
a legitimate source.
The objective in money laundering is to conceal the existence, illegal source, or illegal
application of income to make it appear legitimate.
Money laundering is commonly used by criminals to make "dirty" money appear "clean" or
the profits of criminal activities are made to appear legitimate.

Core Banking System
Sec.3 of PML Act, 2002 defines 'money laundering' as: "whosoever directly or indirectly
attempts to indulge or knowingly assists or knowingly is a party or is actually involved in any
process or activity connected with the proceeds of crime and projecting it as untainted
property shall be guilty of the offence of money-laundering".
1. Prevention of Money Laundering Act (PMLA)
Under Section 12 of PMLA, every banking company, financial institution and intermediary,
is required to maintain a record of transactions as may be prescribed by rules and furnish
information to the Director within such time as may be prescribed.
The records to be maintained by such entities are set forth in rule 3 of PMLR. Such records
include record of cash transactions of value more than 10 lakhs or its equivalent in foreign
currency, integrally connected cash transactions taking place within a month, cash
transactions where forged or counterfeit notes are involved and suspicious transactions of
the nature described therein.
Under rule 6 of PMLR, such records are to be maintained for a period of ten years from
the date of transaction.
The key aspects of PMLA are as follows:
Maintenance of record of all cash transactions above ' 10 lakhs
All series of cash transactions of value less than ' 10 lakhs integrally connected if they
have taken place within a month (aggregate value above ' 10 lakhs)
All cash transactions here forged or counterfeit notes have been used.
All suspicious transactions made in cash or otherwise.
The period before which the transactions are to be reported to the Director are set forth
in Rule 8 of PMLR.
With respect to the transactions of 10 lakhs and more and the integrally connected
transactions referred to above, the information should be submitted every month before
the 15thday of the succeeding month.
The information relating to forged or counterfeit notes is required to be submitted within
seven days of the date of occurrence of the transaction.
The requirement of maintaining the records by such entities regarding the identity of their
clients is prescribed in Rule 9 of PMLR.
The documents that need to be obtained with respect to different kinds of clients such as
individual, company, partnership, trust and other unincorporated association have been
listed therein.
A copy of the said identification programme is required to be forwarded to Director. The
maintenance of records and reporting of transactions help in tracking transactions
involving money laundering or the persons involved in such transactions.

Core Banking System
Under section 13 of PMLA, the Director is empowered (without prejudice to any other
action that may be taken under PMLA) to impose a fine which shall not be less than 10
thousand but which may extend to 1 lakh for each failure.
Since the imposition of fine by the Director is without prejudice to any other action that
may be taken under PMLA it is possible that such entities may be exposed to penalty also
under Section 63.
In terms of Section 70 if the contravention is committed by such entities the officers in
charge of and responsible to the conduct of the business of such entity at the relevant time
are also liable to be proceeded with and punished.
It is therefore clear that such entities should have a robust system of keeping track of the
transactions of the nature referred to in Prevention of Money Laundering Act (PMLA) and
Prevention of Money Laundering Rules (PMLR) and report the same within the prescribed
period as aforesaid.
2. Three stages of Money Laundering
Placement of
proceeds derived
from illegal activities -
the movement of
proceeds, frequently
currency, from the
scene of the crime to a
place, or into a form,
less suspicious and
more convenient for
the criminal.
Layering involves the
separation of
proceeds from illegal
source using complex
transactions designed
to obscure the audit
trail and hide the
proceeds.
Layering involves sending the money through various financial transactions to change
its form and make it difficult to follow.
Layering may consist of several banks to bank transfers or wire transfers between
different accounts in different names in different countries making deposit and
withdrawals to continually vary the amount of money in the accounts changing the
money's currency purchasing high value items (boats, houses cars, diamonds) to change
the form of money-making it hard to trace.

Core Banking System
Integration involves conversion of illegal proceeds into apparently legitimate business
earnings through normal financial or commercial operations.
Integration creates the illusion of a legitimate source for criminally derived funds and
involves techniques as numerous and creative as those used by legitimate businesses.
e.g. false invoices for goods exported, domestic loan against a foreign deposit,
purchasing of property and comingling of money in bank accounts.
3. Anti-Money laundering (AML) using Technology
Negative publicity, damage to reputation and loss of goodwill, legal and regulatory
sanctions and adverse effect on the bottom line are all possible consequences of a bank's
failure to manage the risk of money laundering.
Banks face the challenge of addressing the threat of money laundering on multiple fronts
as banks can be used as primary means for transfer of money across geographies.
The challenge is even greater for banks using CBS as all transactions are integrated.
With regulators adopting stricter regulations on banks and enhancing their enforcement
efforts, banks are using special fraud and risk management software to prevent and
detect fraud and integrate this as part of their internal process and daily processing and
reporting.
4. Financing of Terrorism
Money to fund terrorist activities moves through the global financial system via wire
transfers and in and out of personal and business accounts.
It can sit in the accounts of illegitimate charities and be laundered through buying and
selling securities and other commodities, or purchasing and cashing out insurance policies.
Although terrorist financing is a form of money laundering, it doesn't work the way
conventional money laundering works.
The money frequently starts out clean i.e. as a 'charitable donation' before moving to
terrorist accounts. It is highly time sensitive requiring quick response.
INFORMATION TECHNOLOGY ACT
The Information Technology Act was passed in 2000 and amended in 2008. The ITA Rules
were passed in 2011.
The Act provides legal recognition for transactions carried out by means of electronic data
interchange and other means of electronic communication, commonly referred to as "electronic
commerce", which involve the use of alternatives to paper-based methods of communication
and storage of information, to facilitate electronic filing of documents with the Government.

Core Banking System
The Act provides the legal framework for electronic governance by giving recognition to
electronic records and digital signatures
The Amendment Act 2008 provides stronger privacy data protection measures as well as
implementing reasonable information security by implementing IS027001 or equivalent
certifiable standards to protect against cyber-crimes.
For the banks, the Act exposes them to both civil and criminal liability. The civil liability could
consist of exposure to pay damages by way of compensation up to 5 crores.
There may also be exposure to criminal liability to the top management of the banks and
exposure to criminal liability could consist of imprisonment for a term which would extend
from three years to life imprisonment as also fine.
Further, various computer related offences are enumerated in the aforesaid provisions which
will impact banks.
There have been many instances of 'phishing' in the banking industry whereby posing a major
threat to customers availing internet banking facilities.
Cyber Crimes
Cybercrime also known as computer crime is a crime that involves use of a computer and
a network. The computer may have been used in committing a crime, or it may be the
target.
Cybercrimes is defined as: "Offences that are committed against individuals or groups of
individuals with a criminal motive to intentionally harm the reputation of the victim or cause
physical or mental harm, or loss, to the victim directly or indirectly, using modern
telecommunication networks such as Internet (Chat rooms, emails, notice boards and
groups) and mobile phones.
The United Nations Manual on the Prevention and Control of Computer Related Crime
classifies such crimes into following categories:
Committing of a fraud by manipulation of the input, output, or throughput of a
computer based system.
Computer forgery, which involves changing images or data stored in computers,
Deliberate damage caused to computer data or programs through virus programs or
logic bombs,
Unauthorized access to computers by 'hacking' into systems or stealing passwords, and,
Unauthorized reproduction of computer programs or software piracy.
Cybercrimes have grown big with some countries promoting it to attack another
country's security and financial health.

Core Banking System
Computer related offences
CBS is a technology platform which provides integrated interface for bank and its
customers with access online, anytime and anywhere.
The IT Act recognizes risks of information technology deployment in India, various types
of computer-related offences and provides a legal framework for prosecution for these
offences.
Some of key provisions of IT related offences as impacting the banks are given here.
Section 43 provides for Penalty and compensation for
damage to computer, computer system, etc.
Accesses or secures access to such computer, computer system or computer network;
Downloads, copies or extracts any data, computer database or information from such
computer, computer system or computer network including information or data held or
stored in any removable storage medium;
Introduces or causes to be introduced any computer contaminant or computer virus into
any computer, computer system or computer network;
Damages or causes to be damaged any computer, computer system or computer network,
data, computer database or any other programs residing in such computer, computer
system or computer network;
Disrupts or causes disruption of any computer, computer system or computer network;
Denies or causes the denial of access to any person authorized to access any computer,
computer system or computer network by any means; (g) provides any assistance to any
person to facilitate access to a computer, computer system or computer network in
contravention of the provisions of this Act, rules or regulations made thereunder;
Charges the services availed of by a person to the account of another person by
tampering with or manipulating any computer, computer system, or computer network, he
shall be liable to pay damages by way of compensation to the person so affected.
Destroys, deletes or alters any information residing in a computer resource or diminishes
its value or utility or affects it injuriously by any means;
Steals, conceals, destroys or alters or causes any person to steal, conceal, destroy or alter
any computer source code used for a computer resource with an intention to cause
damage;

Core Banking System
Some examples of offences in IT Act which could impact banks are as follows:
Section 65: Tampering with Computer Source Documents
Whoever knowingly or intentionally conceals, destroys or alters or intentionally or
knowingly causes another to conceal, destroy or alter any computer source code
used for a computer, computer program, computer system or computer network,
when the computer source code is required to be kept or maintained by law for
the time being in force, shall be punishable with imprisonment up to three years,
or with fine which may extend up to 2 lakh rupees, or with both.
The explanation clarifies "Computer Source Code" means the listing of programme,
Computer Commands, Design and layout and program analysis of computer
resource in any form.
Section 66: Computer Related Offences
If any person, dishonestly, or fraudulently, does any act referred to in section 43,
he shall be punishable with imprisonment for a term which may extend to three
years or with fine which may extend to 5 lakh rupees or with both.
Section 66-B:Punishment for dishonestly receiving stolen computer resource or
communication device
Whoever dishonestly receives or retains any stolen computer resource or
communication device knowing or having reason to believe the same to be stolen
computer resource or communication device, shall be punished with imprisonment
of either description for a term which may extend to three years or with fine which
may extend to rupees one lakh or with both.
Section 66-C: Punishment for identity theft
Whoever, fraudulently or dishonestly make use of the electronic signature,
password or any other unique identification feature of any other person, shall be
punished with imprisonment of either description for a term which may extend to
three years and shall also be liable to fine which may extend to rupees one lakh.
Section 66-D: Punishment for cheating by personation by using computer
resource
Whoever, by means of any communication device or computer resource cheats by
personation, shall be punished with imprisonment of either description for a term
which may extend to three years and shall also be liable to fine which may extend
to one lakh rupees.
Section 66-E: Punishment for violation of privacy
Whoever, intentionally or knowingly captures, publishes or transmits the image of
a private area of any person without his or her consent, under circumstances
violating the privacy of that person, shall be punished with imprisonment which may
extend to three years or with fine not exceeding two lakh rupees, or with both.

Core Banking System
Sensitive Personal Data Information (SPDI)
Section 43A of the IT Amendment Act imposes responsibility for protection of stakeholder
information by body corporate.
It states as follows: "Where a body corporate, possessing, dealing or handling any
sensitive personal data or information in a computer resource, which it owns, controls or
operates, is negligent in implementing and maintaining reasonable security practices and
procedures and thereby causes wrongful loss or wrongful gain to any person, such body
corporate shall be liable to pay damages by way of compensation, to the person so
affected".
The IT Act has a specific category, "sensitive personal data or information," which
consists of password, financial information (including bank account, credit card, debit card
or other payment details), physical, physiological and mental health conditions, sexual
orientation, medical records, and biometric information.
One of the largest stakeholders of SPDI are include banks apart from insurance
companies, financial institutions, hospitals, educational institutions, service providers, travel
agents, payment gateway providers and social media platforms, etc.
Hence, at a corporate level, every bank should develop, communicate and host the
privacy policy of the bank.
The policy should include all key aspects of how they deal with the personal information
collected by the bank.
To provide practical perspective of how compliance to the provisions of IT Act specifically
relating to privacy and protection of personal information, the next section provides an
overview of requirements of privacy policy of a bank.
Privacy Policy
Every bank deals captures Personal Information of customers as per definition of IT Act.
Hence, it is mandatory to ensure security of personal information.
This information must be protected by maintaining physical, electronic, and procedural
safeguards by using appropriate security standards such as ISO 27001 to ensure
compliance with regulatory requirements. Further, the employees of banks should be
trained in the proper handling of personal information.
The specific information collected is to be confirmed with the customers. The type of
information collected could be Non-Personal and Personal Information.
For example, when the customer visits the website of the bank, information about the IP
address of the device used to connect to the Internet is collected.
Further, additional information such as browser used, browser version, operating system
used is also collected, the use of cookies on visiting website and option to disable them
has to be informed and provided to user.

Core Banking System
The Personal Information provided by customer such as name, address, phone number,
and email is collected and used by bank to offer new online experiences.
In case of online bill payment, personal information about the transactions, and how
customer interacts with third parties such as utility company or Phone Company is
collected.
The customer must be provided access to change information for their account or
application by logging on to their account online or telephoning customer service.
The customer should be able to control how their non-personal information is collected
and used online.

5. Core Banking System

More Related Content

What's hot (20)

Similar to 5. Core Banking System (20)

More from Ashish Desai (12)

Recently uploaded (20)

5. Core Banking System