News

Reserve Bank of India sets deadlines for ATM control measures

June 27, 2018

After more than a year waiting for ATM deployers to respond to its urgings to update their ATMs from Windows XP to Windows 7, the Reserve Bank of India seems to have reached the limits of its patience.

In a June 21 notification, India's central bank scolded commercial banks and white label ATM deployers for "the slow progress ... in addressing these issues."

To prod them to pick up the pace, RBI directed deployers to implement certain control measures within a defined timeframe:

• Implement security measures such as BIOS password, disabling USB ports, disabling auto-run facility, applying the latest patches of operating system and other softwares, terminal security solution, time-based admin access, etc., to be completed by August 2018.
• Implement anti-skimming and whitelisting solution, to be completed by March 2019.
• Upgrade all the ATMs with supported versions of operating system. Such upgrades shall be carried out in a phased manner to ensure that in respect of the existing ATMs running on unsupported versions of operating system:
  • Not less than 25 percent of them shall be upgraded by September.
  • Not less than 50 percent of them shall be upgraded by December.
  • Not less than 75 percent of them shall be upgraded by March 2019.
  • All of them shall be upgraded by June 2019.

Underscoring that it definitely means business, RBI warned that "any deficiency in timely and effective compliance with the instructions … may invite appropriate supervisory enforcement action under applicable provisions of the Banking Regulation Act, 1949 and/or Payment and Settlement Systems Act, 2007."