I am from India and working on a B2C service product. There I have to transfer money to my customers, so I need their bank account number and IFSC code.

However, I was wondering if there are some norms or compliance for this.

I am requesting bank account details from my users and storing these details on my server in fully encrypted and hashed way which will be readable to only Super Admin to transact.

I am not storing any type of card details, just bank account numbers and IFSC codes.

I found several such questions but they were card-details centric. As we are not dealing with cards, I assume PCI DSS is not applicable to us.

What are the norms and compliance we need to follow as per RBI or any other Indian government body?

  • It maybe a good idea to ask the ISO or IT Security Manager of your company.
    – Jishan
    Sep 22, 2019 at 16:32

1 Answer 1


PCI-DSS applies only to credit card numbers so you are not in scope if you are only storing bank account details. RBI regulates financial institutions, you are most likely not in scope for that either. However if you are storing bank account details (including names of your customers) you are in scope for Data Protection Laws.

However Data Protection Laws tell you to adequately secure information, they are not as specific as PCI-DSS. A good starting point in terms of standards would probably be NIST 800-122.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .