Banking technology glossary

Short definitions of the payments, lending, trustee and mobile app security terms used by Indian banks, NBFCs and trustee companies, with links to the RBI, SEBI, NPCI and OWASP sources behind them.

CERSAI: CERSAI, the Central Registry of Securitisation Asset Reconstruction and Security Interest, is the central registry set up under Section 20 of the SARFAESI Act, 2002 to register securitisation, asset reconstruction and security interest transactions.
CFSS (Core Financial Services Solution): A Core Financial Services Solution (CFSS) is the core system RBI requires certain NBFCs to implement, akin to the core banking solution adopted by banks. It must be implemented by Middle and Upper Layer NBFCs with 10 or more fixed point service delivery units.
Co-lending: Co-lending is an arrangement, formalised through an ex-ante agreement, in which a regulated entity that originates loans and a partner regulated entity jointly fund a portfolio of secured or unsecured loans in a pre-agreed proportion, sharing revenue and risk.
Debenture trustee: A debenture trustee is a trustee appointed in respect of an issue of debentures of a body corporate. It must be registered with SEBI and acts for debenture holders, monitoring the issuer's security, covenants and payments.
Device binding: Device binding links a customer's mobile banking app to a specific registered device, using a combination of hardware, software and service information, so that stolen credentials alone are not enough to use the account from another phone.
IMPS switch: An IMPS switch is the bank-side software that connects a bank to NPCI's Immediate Payment Service (IMPS), an instant, 24x7 interbank electronic fund transfer service, and processes transfers addressed by mobile number and MMID, account number and IFSC, or Aadhaar number.
PSP bank: In UPI, a payment service provider (PSP) is the regulated bank that provides the customer-facing UPI app and connects it to NPCI. A sponsor bank is a direct UPI member that brings a smaller bank, called a sub-member, onto UPI through its own membership.
RASP (runtime application self-protection): Runtime application self-protection (RASP) is security built into a mobile app that checks, while the app runs, whether the device, the app code and its connections can be trusted, and blocks, limits or reports the session when it detects rooting, tampering, debugging or a hostile network.
Security cover certificate: A security cover certificate shows whether the assets securing an issue of debentures are sufficient to cover the amount outstanding. Under SEBI's Master Circular, debenture trustees certify security cover every quarter.
UPI switch: A UPI switch is the bank-side software that connects a bank's core banking system and customer apps to NPCI's Unified Payments Interface. It receives, validates and routes UPI debit and credit requests so that UPI payments can be posted to the bank's customer accounts.