How frequently must a SAR audit be conducted?

SAR audits must be conducted annually by payment system operators required to comply with RBI's data localisation directive. The report and attestation must be submitted to RBI and NPCI within regulatory timelines.

HomeRegulatory Compliance ServicesSAR Compliance Audit

SAR Compliance Audit | RBI Data Localisation Audit

Comply With RBI's Data Localisation Mandate Through a Structured System Audit Report Assessment

Q: What payment data must be stored in India under RBI's directive?

RBI's directive covers the full end-to-end transaction dataset — customer data including name and mobile number, payment sensitive data including card and account details, payment credentials, and complete transaction records covering origination, processing, and settlement. All data including backup copies must reside exclusively on India-based servers.

Q: What are the five domains covered under the SAR audit checklist?

The RBI and NPCI SAR checklist covers five primary domains: payment data elements — confirming data classification; data storage — confirming India-only server residency; access management — confirming controlled and logged access; data backup and restoration — confirming compliant tested procedures; and data security — confirming encryption, network controls, and monitoring.

Securexocean delivers SAR compliance audit services for payment system operators, fintech companies, and payment gateway providers required to demonstrate conformance with RBI's data localisation directive under the Payment and Settlement Systems Act, 2007.

Request a SAR Compliance Audit Assessment

SERVICE INTRODUCTION

The Regulatory Audit That Verifies Your Payment Data Stays in India

On 6 April 2018, RBI issued a directive requiring all payment system operators regulated under the Payment and Settlement Systems Act to store payment systems data exclusively on servers located within India. This localisation mandate covers the full end-to-end transaction data — customer data, payment sensitive data, payment credentials, and transaction data generated by systems processing Indian resident transactions.

The System Audit Report is the formal compliance instrument demonstrating conformance to RBI and NPCI. It must be conducted by a qualified external auditor and covers how payment data is stored, processed, backed up, accessed, and secured. Securexocean conducts SAR compliance audits against the RBI and NPCI SAR checklist, producing reports and attestations formatted for regulatory submission.

The Regulatory Audit That Verifies Your Payment Data Stays in India

THREAT LANDSCAPE

The Regulatory, Security, and Operational Case for SAR Audit Conformance

RBI's data localisation directive ensures payment data belonging to Indian residents remains within Indian jurisdiction — protecting against extraterritorial access, ensuring law enforcement access is governed by Indian legal frameworks, and shielding financial data during geopolitical disruptions affecting foreign-hosted infrastructure.

Localised storage enables Indian financial intelligence authorities to access complete transaction records for anti-money laundering investigations. The SAR audit framework additionally assesses overall payment system security posture covering access management, encryption, and monitoring — providing independent verification of payment system controls against RBI and NPCI criteria.

The Regulatory, Security, and Operational Case for SAR Audit Conformance

SAR AUDIT RISK AREAS

Control Gaps That Create Regulatory Exposure for Payment System Operators

Payment data stored in whole or in part on servers outside India including through non-Indian cloud regions

Backup copies of payment data replicated to offshore storage without compliant mirroring

Access management deficiencies allowing unauthorized or unlogged access to payment repositories

Inadequate data security controls for encryption at rest, in transit, and key management

Data backup and restoration procedures not tested to demonstrate recovery within required parameters

Absent data flow maps confirming payment data storage location at each processing stage

Third-party integrations resulting in payment data transiting or residing outside the compliant storage boundary

Our SEBI CSCRF Audit Methodology

A Five-Phase Audit Process From Scope Drafting to Regulatory Submission

Scope Drafting and Data Flow Mapping

All systems, servers, databases, backup infrastructure, and third-party integrations identified. Complete payment data flow map produced documenting processing, storage, backup, and recovery. Scope and data flow documentation agreed before fieldwork begins.

Audit Plan and Schedule Finalization

Audit plan developed covering RBI and NPCI SAR checklist domains — payment data elements, storage infrastructure, access management, backup and restoration, and data security. Schedule finalized and published before assessment commences.

SAR Checklist Assessment and Technical Review

Payment system environment assessed control-by-control against the SAR checklist. Data storage infrastructure reviewed confirming all payment data resides exclusively on India-based servers. Access management, encryption, and backup procedures evaluated for design and operational effectiveness.

Findings Documentation and Remediation Guidance

Observations documented with supporting evidence, risk classification, and remediation guidance. Remediation support provided to close identified gaps. Closure verification confirms corrective actions implemented before attestation finalized.

SAR Report and Attestation

Completed SAR audit report compiled against the full RBI and NPCI checklist. Auditor attestation confirms compliance with RBI's data localisation directive formatted for submission to RBI and NPCI.

Audit Toolset

Tools and Techniques

Our team uses RBI and NPCI SAR checklist assessment frameworks, data residency verification tools for storage infrastructure review, access management audit methodologies, encryption configuration review tools, backup and restoration testing frameworks, and data flow mapping and documentation tools.

DELIVERABLES

Documentation That Supports Remediation and Compliance Requirements

Documented audit scope and complete payment data flow mapping

Finalized audit plan aligned to RBI and NPCI SAR checklist domains

SAR checklist-based findings report covering all five audit domains

Remediation guidance and closure verification documentation

Formal SAR audit report with auditor attestation for RBI and NPCI submission

Post-submission support for regulatory queries and corrective action requirements

Frequently Asked Questions

Questions We Hear Most Often

All payment system operators regulated by RBI under the Payment and Settlement Systems Act — including domestic and international payment gateway operators, prepaid payment instrument issuers, card payment networks, and fintech companies operating regulated payment platforms. If your organization processes, stores, or transmits payment data relating to Indian transactions, the localisation requirement applies.

The full end-to-end transaction dataset — customer data including name and mobile number, payment sensitive data including card and account details, payment credentials, and complete transaction records covering origination, processing, and settlement. All data including backup copies must be stored exclusively on servers physically located within India.

Five primary domains: payment data elements confirming data classification; data storage confirming India-only server residency; access management confirming controlled and logged access; data backup and restoration confirming compliant and tested procedures; and data security confirming encryption, network controls, and monitoring.

RBI permits processing outside India for cross-border transactions where operationally necessary, subject to deletion from foreign systems within one business day and complete domestic storage of the transaction record including the foreign processing component. The SAR audit verifies this deletion and domestic storage process is implemented and operating.

Annually by payment system operators subject to RBI's localisation directive. The report and attestation must be submitted to RBI and NPCI within regulatory timelines. Securexocean supports annual SAR audit cycles with ongoing compliance maintenance between submissions.