Fintechs to lay out a code for technology vendors amid rising cyberthreats and security risks

Mumbai: Third-party technology vendors that register with the Unified Fintech Forum (UFF) and comply with its proposed code of conduct are likely to get preference from fintechs and regulated financial entities while being selected as technology partners, people familiar with the matter said. The move comes in the wake of a series of cyberattacks affecting financial institutions and exposing vulnerabilities in third-party technology systems and payment APIs.

The RBI-recognised self-regulatory organisation for the fintech sector is working on a framework for Technology Service Providers (TSPs) and Regulatory Technology, or RegTech, firms that will prescribe standards around governance, cybersecurity preparedness, operational resilience and accountability.

UFF will encourage its members to register and work with technology vendors that participate in the SRO-led framework, people cited above said. Over time, such registration could develop into a de facto accreditation mechanism, allowing lenders and fintech companies to differentiate between vendors on the basis of their adherence to prescribed technology and governance standards.


"UFF is in the process of developing a framework, including a Code of Conduct for Technology Service Providers and RegTech firms, to encourage responsible business practices, sound governance and greater adherence to technology and operational best practices," said Jatinder Handoo, chief executive officer of UFF.

"The framework is intended to promote a culture of accountability, transparency and responsible participation among entities that play an important role in the fintech value chain," he said.

Handoo said UFF would encourage its members to register and work with TSPs that are part of an SRO-led ecosystem.

The move assumes significance as banks, non-bank lenders and fintech companies increasingly outsource critical parts of their technology architecture to specialised third-party vendors. These firms provide services ranging from customer onboarding, KYC and document verification to credit assessment, loan origination and management systems, disbursements, collections and customer communication.

While many of these service providers are not directly regulated by the RBI, failures or security breaches at their end can have a direct impact on regulated entities that use their platforms.

Several recent cyber incidents involving third-party technology providers have brought these risks into sharper focus, prompting financial institutions to reassess how vendors are selected.