I am from India and working on a B2C service product. There I have to transfer money to my customers, so I need their bank account number and IFSC code.
However, I was wondering if there are some norms or compliance for this.
I am requesting bank account details from my users and storing these details on my server in fully encrypted and hashed way which will be readable to only Super Admin to transact.
I am not storing any type of card details, just bank account numbers and IFSC codes.
I found several such questions but they were card-details centric. As we are not dealing with cards, I assume PCI DSS is not applicable to us.
What are the norms and compliance we need to follow as per RBI or any other Indian government body?