Jump to a page or a control
Protect · Established tier · Digital Channels
Online channels limit SMS and email one-time PINs, bind devices, hold transactions after key account changes, and keep tamper-proof transaction logs for five years.
Status
Partial evidence1 item only partly supports it.
Exposure
Critical
3 evidence items from 1 sources
CCSA · Protect
Below FoundationalNot blocking this domain's next tier.
Two legacy channels still accept an SMS one-time PIN as the only factor for high-risk transactions. The Circular 1213 deadline passed on Jun 25, 2026.
Remediation · Digital Channels
Move corporate internet banking and the legacy IVR to device-bound or FIDO authentication.
Every item is read-only, dated, hashed and re-runnable. This is what an examiner can test.
ev-pr03-1
SMS one-time PIN is still the only factor on 2 of 6 channels
Core banking Fraud management system · config · collected 5 h ago (Oct 15, 2026 · 08:59 UTC) · limit 48 h
Powered by Mesh APIGET /fms/v2/channels/authentication-policybda3e9a2c84bac20375e2c3d555ee1271a1626aed78091a91f912f217b2a6cfcev-pr03-2
24-hour hold after key account changes on all 6 channels
Core banking Fraud management system · config · collected 5 h ago (Oct 15, 2026 · 08:59 UTC) · limit 48 h
GET /fms/v2/rules/AFASA-HOLD-24H9e88e4aed134ba3aa375b2a0ee79e7c1e5d35534306b2f9e15819480cb9df5daev-pr03-3
Transaction logs are tamper-evident and kept for 5 years
Core banking Fraud management system · export · collected 5 h ago (Oct 15, 2026 · 08:59 UTC) · limit 48 h
GET /fms/v2/logstore/integrity18210f724bf23d7402237623ef0451b6e0548d54b953b252a8a2ec0605d8492d