Operational Aspects of CBS Environment

43.1 Introduction — What is CBS?

Based on the level of computerisation, banks may be categorised as non-computerised, partially computerised, or fully computerised. Core Banking Solutions (CBS) is a platform where Communication Technology and Information Technology merge to suit core banking needs. Under CBS, client software is installed at different branches to connect to the central server for accessing and updating customer information and transactions.

Finacle is by Infosys · BaNCS (Bank and Customer Services) is by TCS · Flexcube is by Oracle

43.3 Three Types of CBS Transactions

Transaction Flow — Key Points

• ▸Transactions by branch users, customers through alternate delivery channels, or third-party trusted vendors are ultimately reflected in the Central Database.
• ▸Branch user logs in with User ID + Password + biometric authentication at the CBS terminal.
• ▸Branch transactions follow Maker-Checker functionality: Maker (teller) initiates; Checker (authorising officer) validates.
• ▸Transactions are committed at the Central Database only after ALL legs of the transaction are completed.
• ▸System validates: account number, balance, teller (Maker) authority, officer (Checker) authority, and product-level parameters.
• ▸Transactions also flow from alternate delivery channels, Treasury systems, etc., into the core banking system.

43.7 Password Control — Basic Operational Controls

CBS Password Requirements

Operational Password Practices

• ▸i. All employees and users must maintain password secrecy.
• ▸ii. OS Password kept under Dual Control of Branch Manager and System Administrator — in a sealed cover; opened in presence of at least 2 persons; changed immediately on opening.
• ▸iii. Critical passwords for sensitive jobs (entering OS, local backups, monitoring disk space, creating/editing Master Records) known only to Branch Manager or System Administrator.

43.9 Logical Access Control

To safeguard assets, computer systems, and data integrity, the following must be ensured:

• ▸(a) Security policy addresses specific OS capabilities; available security features must be implemented.
• ▸(b) Chief Information Security Officer (CISO) ensures all available features are implemented.
• ▸(c) Process for granting access levels must be clearly defined.
• ▸(d) Users must have the MINIMUM access level needed to do their job.
• ▸(e) Users' access restricted to specific applications, menus within applications, files, and servers.
• ▸(f) File maintenance should be a separate access privilege.
• ▸(g) Maintenance restricted to minimum number of persons; properly approved and reviewed.
• ▸(h) Modem access should be restricted; modem passwords changed periodically.
• ▸(i) After-hours access must be controlled and monitored.

43.11 Role and Responsibilities of the Bank under CBS

As per RBI Circular No.1462/02.14.003/2012-13 dated February 28, 2013, banks must have documented policies and procedures covering the following IT areas:

Chapter 43 in 5 Lines

1. CBS merges Communication Technology + IT; client software at branches connects to central server via MPLS/VSAT/RF/3G/4G. Examples: Finacle (Infosys), BaNCS (TCS), Flexcube (Oracle). 12 functions from account management to CRM. Three transaction types: Cash, Clearing, Transfer.
2. Branch transactions follow Maker-Checker: teller (Maker) initiates, officer (Checker) authorises. System validates account number, balance, authority, and product-level parameters before committing. CBS is an OLTP system — simultaneous real-time debits/credits across customer ledgers, GL, and all sub-systems.
3. EOD must complete before BOD can run. BOD: new day start, time deposit processing, standing instructions, value date processing, salary, OD limit expiry. EOD: minimum balance calculation, mandatory reports, fallback procedures, day-end backup, log book and backup register entries, system shutdown, server room locked.
4. 4 Basic Operational Controls: Segregation of Duties, Four Eye Principle/Maker-Checker, Rotation of Duties, Ownership of systems. CBS enforces 10 password controls including min 8 chars, upper+lowercase, letters+numbers, 1 special character, no dictionary word, no reuse, disabled during leave, periodic change, multi-factor for critical modules, encrypted storage. OS password under dual control in sealed cover.
5. Operators have READ-ONLY access to Parameter/Master Files; printouts taken before and after any changes. CISO ensures security features are implemented; users get minimum access level. Daily backup: 6 sets per week + 12 monthly; fireproof cabinet storage + off-site. Banks must have 14 IT policy areas per RBI circular No.1462 (Feb 28, 2013); System Audit by Chartered Accountants is mandatory.