Supervisory inspection
RBI, SEBI and IRDAI inspections that test evidence at transaction level, with findings that carry direct business consequences.
Loading page content
Financial services carries a regulatory load no other sector matches. RBI master directions on IT governance, risk and cyber security. SEBI's cybersecurity and cyber resilience framework. IRDAI information and cyber security guidelines. NPCI requirements for payment participants. CERT-In directions on top. And now DPDPA applying across all of it.
These regimes are not merely additive — they conflict in places. Payment data localisation sits awkwardly against global processing architectures. Prescribed record retention runs against erasure rights. Outsourcing directions constrain the cloud strategies that cost pressure demands.
Our BFSI practice specialises in reconciling those tensions into a single defensible control environment, and in preparing institutions for supervisory inspection — where the question is never whether you have a policy, but whether you can evidence the control operating on the date the inspector picks.
Priorities we work on
These are not hypothetical risks. They are the specific conditions we have had to design around on engagements in this sector.
RBI, SEBI and IRDAI inspections that test evidence at transaction level, with findings that carry direct business consequences.
RBI payment data storage requirements and sectoral residency rules constraining architecture and vendor choice.
Master directions on outsourcing of IT services imposing due diligence, audit rights, concentration limits and exit planning on every material vendor.
Guidelines governing lending service providers, data collection limits, consent and grievance mechanisms in the digital lending stack.
Model-driven credit decisioning and claims assessment attracting explainability, fairness and governance expectations from multiple regulators.
Certification without the eighteen-month scramble.
Readiness, implementation and audit support for ISO 27001, ISO 27701, ISO 42001, SOC 2 and PCI DSS — run as a project with dates, owners and a definition of done.
Explore capabilityOne operating model for privacy, security, risk and AI accountability.
We design the committees, policies, decision rights and reporting lines that let trust obligations be managed as one programme instead of four competing ones.
Explore capabilityRisk registers that change decisions, not just fill a folder.
Quantified technology, privacy and AI risk management — with a taxonomy, an appetite, and reporting that makes trade-offs explicit at the executive table.
Explore capabilityKnow what your vendors can reach — and what happens when one fails.
Vendor risk programmes that tier by real exposure, assess proportionately, contract properly and monitor continuously — instead of emailing a 300-question spreadsheet once a year.
Explore capabilityShip AI you can explain, defend and audit.
An AI management system aligned to ISO 42001 and the EU AI Act — model inventory, risk classification, evaluation, human oversight and the evidence trail regulators will ask for.
Explore capabilityPatient trust is clinical infrastructure.
Hospital networks, digital health platforms and life sciences organisations carry the most sensitive data category there is, under simultaneous Indian, US and European obligations.
Trust is the shortest path through enterprise procurement.
For product companies, security and privacy posture is not overhead — it is the thing that determines whether an enterprise deal closes this quarter or next year.
When the line stops, everything else is academic.
Manufacturers face converging IT and OT risk, extended supplier networks, and customer security requirements arriving through the supply chain rather than from a regulator.
Personalisation and consent, reconciled.
Retailers hold consumer data at the highest volume of any sector, monetise it through marketing technology, and must now make consent enforceable across that entire stack.
The questions that come up in almost every first conversation, whatever the sector.
Ask a practitioner directly. First responses come from the person who would run your engagement, within one business day.
Ask a question