FIU-IND Cybersecurity Audit Mandate

The Financial Intelligence Unit-India (FIU-IND) has mandated cybersecurity audits for registered Virtual Digital Asset Service Providers (VDA SPs). These audits must be performed specifically by CERT-In empanelled auditors. VDA SPs handle cryptocurrency and other digital assets, processing significant volumes of personal and financial data. The audit requirements cover data protection, access controls, incident response, and transaction monitoring - areas that directly overlap with DPDPA obligations. The audit must also certify compliance with the 'Travel Rule' (Originator/Beneficiary data exchange).

FIU-IND audits assess: (a) data protection measures including encryption and access controls; (b) incident response capabilities and procedures; (c) transaction monitoring systems for AML/CFT compliance; (d) identity verification and KYC processes; (e) cybersecurity governance and risk management; and (f) Travel Rule compliance for Originator/Beneficiary data exchange. Many of these assessment areas mirror DPDPA's security safeguard requirements under Rule 6, creating opportunities for harmonised compliance.

VDA SPs must comply with both FIU-IND cybersecurity requirements and DPDPA obligations. Key intersection points: (a) security safeguards - R.6 requirements for encryption, masking, and access controls align with FIU-IND audit criteria; (b) the Rule 6 logging mandate, which specifically requires technical measures to retain logs for one year for security detection; (c) breach notification - both frameworks require incident reporting; (d) data retention - transaction monitoring records must be balanced against R.8 retention limits; and (e) KYC data - processing falls under legitimate use (Section 7) for legal compliance. As reporting entities under the Prevention of Money-Laundering Act (PMLA), 2002, VDA SPs are also independently required by section 12 of the PMLA to maintain records of transactions and client identification, and the Prevention of Money-Laundering (Maintenance of Records) Rules, 2005 require these records to be retained for a minimum of five years. This PMLA retention obligation applies alongside, and may exceed, DPDPA retention limits. The stricter standard applies at each overlap point.

VDA SPs should: (a) align their cybersecurity framework with both FIU-IND and DPDPA requirements simultaneously; (b) conduct integrated audits covering both frameworks; (c) document the lawful basis for transaction monitoring data retention; (d) implement breach notification processes meeting both timelines; and (e) maintain separate consent for any processing beyond regulatory mandates.