BCP/DR Posture Assessment: Meeting RBI and SEBI RC.1–RC.4 Without 3 Months of Consultancy

The SEBI CSCRF Respond and Recover domain — specifically sub-categories RC.1 through RC.4 — consistently shows the lowest average maturity score across all regulated entity categories. At 1.7 out of 5, resiliency and continuity is where Indian BFSI organisations are most exposed, and where regulators are increasingly directing inspection attention.

The irony is that most regulated entities have a Business Continuity Plan document. The gap is not documentation — it is operationalisation. An untested BCP is not a plan; it is a fiction. SEBI and RBI both require evidence of actual test execution, not just the existence of a document.

What RC.1–RC.4 Actually Require

RBI DPSC Resiliency Requirements

For payment-focused regulated entities, RBI's Digital Payment Security Controls (DPSC) framework adds specific availability and recovery obligations on top of SEBI CSCRF RC requirements:

• 99.5% availability for core payment processing systems (calculated monthly, per payment channel)
• 4-hour RTO for ATM processing infrastructure
• Same-day recovery for RTGS and NEFT critical payment rails
• Quarterly DR drills for internet banking and mobile banking platforms (not just annual)
• Communication protocol to RBI within 2 hours of any outage exceeding 30 minutes on payment channels

Industry RTO/RPO Benchmarks for Indian BFSI

Regulators do not mandate specific RTO/RPO values for most systems — but they do expect the values an organisation sets to be achievable, tested, and reflective of the financial and operational impact of unavailability. These are the industry benchmarks that SEBI and RBI inspectors use as reference points:

BIA Methodology: The Foundation SEBI Checks First

The Business Impact Analysis is the document SEBI inspectors go to before evaluating anything else in the RC domain. Without a credible BIA, the RTO/RPO values in your BCP are unverifiable — and the entire resiliency programme is considered theoretical.

A SEBI-compliant BIA for a regulated entity must cover four elements:

1. Critical Process Inventory

Every business process that, if disrupted, would cause regulatory breach, financial loss, customer harm, or reputational damage must be documented. For a mid-sized private bank, this typically yields 40–80 critical processes across payments, lending, trade finance, and back-office functions.

2. Dependency Mapping

For each critical process: which applications support it? Which infrastructure? Which third-party vendors? Which staff categories? A disruption to any dependency propagates to the process. The BIA must trace these chains — a payment process that depends on CBS, which depends on Oracle DB, which depends on specific DBAs, which depend on VPN access, which depends on an ISP.

3. Financial Impact Calculation

SEBI expects the RTO to reflect the point at which financial loss, regulatory breach, or customer harm becomes material. "We estimated 4 hours" is not sufficient. "Transaction revenue loss of ₹2.4Cr/hour for the UPI channel, plus regulatory breach after 2 hours of outage under RBI DPSC" is a defensible basis.

4. RTO/RPO Agreement and Sign-Off

RTO and RPO values must be formally agreed between IT, the business process owner, and senior management — and signed off. An IT-determined RTO that the business has never reviewed or accepted is not a valid BIA output.

A BCP that has never been tested is not a plan — it is a document. SEBI requires evidence of test execution, not just documentation. The distinction is categorical.

The 9 RC Failures That Appear in Every SEBI Inspection

The 3-Tier DR Test Evidence SEBI Accepts