RBI currently operates or controls at least seven technology/payments entities:
| Entity | Year | Legal Form | Mandate | Owned By | Public RTI? | CAG Audit? |
|---|---|---|---|---|---|---|
| IDRBT | 1996 | Society (1860 Act) | Banking tech research + .bank.in registry | RBI (fully) | ❌ Contested | ❌ |
| IFTAS | 2015 → acquired 2019 | Section 8 Company | Shared tech for cooperative banks | RBI (now) | ❌ | ❌ |
| ReBIT | 2016 | Pvt Ltd | IT & cybersecurity for RBI and regulated entities | RBI (fully) [^15] | ❌ | ❌ |
| NPCI | 2008 | Section 8 Company | Retail payments infrastructure | 65 member banks (RBI as regulator) | ❌ | ❌ |
| NPCI Intl (NIPL) | 2020 | Pvt Ltd | UPI/RuPay global expansion | NPCI (fully) | ❌ | ❌ |
| RBIH | 2022 | Section 8 Company | Fintech innovation, incubation | RBI (fully) | ❌ | ❌ |
| RBI IT Dept | — | Internal | Oversight of RBI's own IT | RBI | ✅ (via RBI) | ⚠️ (RBI internal) |
| RBI Fintech Dept | 2022 | Internal | Fintech regulation, sandbox | RBI | ✅ (via RBI) | ✅ (via RBI audit) |
Official vs Unofficial: RBI's own website (https://www.rbi.org.in/commonman/English/Scripts/Organisation.aspx) lists only DICGC as a fully-owned subsidiary. IDRBT, ReBIT, IFTAS, and RBIH are not listed on RBI's official organisation page. [13] This means they exist in a regulatory grey zone — acknowledged through press releases and board appointments, but not formally disclosed as RBI subsidiaries in the central bank's own organisational documentation.
| Function | Entities Involved | Accountability Deficit |
|---|---|---|
| Banking technology research | IDRBT, RBIH, RBI Fintech Dept | Three entities, zero published research audit |
| Cybersecurity for banking | ReBIT, IDRBT, RBI IT Dept | ReBIT should audit IDRBT — but their boards share members |
| Payments infrastructure | NPCI, IDRBT (hist.), IFTAS | Historical overlap allows blame-shifting |
| Cooperative bank tech | IFTAS, IDRBT | IFTAS serves these banks; IDRBT regulates their domain registration |
| Innovation / fintech | RBIH, RBI Fintech Dept, IDRBT | Same mandate, different legal forms, different accountability levels |
| IT systems for RBI | RBI IT Dept, ReBIT | Two entities for one central bank's internal IT |
Across all entities, the same pattern repeats:
Step 1 — Choose an opaque legal form
- Society (1860 Act) → No MCA filing, no RTI
- Section 8 company → Not a "government company" under Companies Act; no CAG
- Pvt Ltd → DINs tracked but board minutes not public
Step 2 — Populate with RBI insiders
- All board/council members are current or former RBI officials
- Chair is invariably a former RBI Deputy Governor [5][8]
- No independent statutory directors with external accountability mandate
Step 3 — Create overlapping mandates
- Multiple entities with similar functions → accountability diffuse
- No single entity owns a function exclusively → RBI reallocates at will
Step 4 — Circumvent procurement rules
- Societies and Section 8 entities not bound by General Financial Rules
- Single-source awards justified as "specialized expertise" or "technical exigency"
- No tender publication obligation
Step 5 — Control information flow
- RTI either does not apply or is contested
- Annual reports not standardised or comparable across entities
- Board minutes never published
- Security audits internal only (if any)
Step 6 — Reabsorb when convenient
- IFTAS: Build in IDRBT → spin off to IFTAS → acquire into RBI
- NPCI: Incubate with RBI support → push toward for-profit → retain controlling influence
NPCI operates India's most critical payments infrastructure (UPI, RuPay, IMPS, NFS, CTS, NACH, AePS, BBPS). [14]
Financials:
- FY25 surplus: ₹1,552 crore (42% increase from ₹1,095 crore in FY24)
- Operating income: ₹3,270 crore
- 65 member banks
Governance tensions:
- CEO interference (2018): RBI overruled NPCI board's preferred CEO candidate and forced the appointment of Dilip Asbe — documented in three board members' dissenting notes. [9]
- For-profit conversion debate: Proposals to convert NPCI from Section 8 to for-profit have been debated since 2023. [16] This would create a monopoly for-profit infrastructure operator with the same board, the same regulatory oversight (RBI), the same information controls — but now with shareholder pressure for returns.
- NIPL subsidiary: NPCI International Payments Limited (for-profit, ₹200 crore paid-up capital) already operates globally with no additional governance framework.
| Dimension | IDRBT | IFTAS | ReBIT | RBIH | NPCI |
|---|---|---|---|---|---|
| Independent board majority | ❌ | ❌ | ❌ | ⚠️ Partial | ⚠️ Member banks |
| Public RTI access | ❌ | ❌ | ❌ | ❌ | ❌ |
| CAG audit | ❌ | ❌ | ❌ | ❌ | ❌ |
| Competitive procurement | ❌ (IKCON) | Unknown | Unknown | Unknown | ⚠️ MDR-based |
| Published board minutes | ❌ | ❌ | ❌ | ❌ | ❌ |
| Conflict of interest register | ❌ | ❌ | ❌ | ❌ | ❌ |
| Term limits / cooling-off | ❌ | ❌ | ❌ | ❌ | ❌ |
| Independent security audit | ❌ (proven) | Unknown | Unknown | Unknown | ⚠️ Periodic |
[1] Medianama, June 2026: "Security vulnerabilities in RBI's .bank.in registry exposed sensitive data" — 33+ unauthenticated endpoints, 5,576 records, no security audit, no disclosure mechanism. https://www.medianama.com/2026/06/223-security-vulnerabilities-rbi-bank-in-registry-sensitive-data
[2] CashlessConsumer .bank.in investigation report: Documents no-tender award of `.bank.in` registry portal to IKCON Technologies. https://bankin-report.cashlessconsumer.in/report.pdf
[3] Deepak Kumar — IDRBT Director profile: Confirms simultaneous directorships at NPCI, IFTAS, ReBIT, RBIH, Indian Overseas Bank, and IDRBT Governing Council membership. Accessed 2026-07-11. https://www.idrbt.ac.in/director/
[4] IKCON Technologies Leadership Team: Lists Mahesh Jarati alongside Divakar Talagadadeevi and Madhu Kiran Boindala. Accessed 2026-07-11. https://www.ikcontech.com/our-leadership-team/
[5] IDRBT Governing Council page: N.S. Vishwanathan Chair, Deepak Kumar, and other members. Accessed 2026-07-11. https://www.idrbt.ac.in/governing-council/
[6] IDRBT Former Directors page: Smt. K. Nikhila served 24-Jan-2024 to 01-May-2024 ~3 months; Deepak Kumar assumed charge 02-May-2024. Accessed 2026-07-11. https://www.idrbt.ac.in/former-directors/
[7] IDRBT "The Journey of IDRBT": Documents EERC Rangarajan Committee 2009 recommendation to shed operational services; creation of IFTAS; transfer of INFINET, SFMS, Banking Community Cloud. Accessed 2026-07-11. https://www.idrbt.ac.in/the-journey-of-idrbt/
[8] RBI Press Release: RBIH Governing Council announced — includes Kris Gopalakrishnan Chair, A.P. Hota, T. Rabi Sankar, Deepak Kumar, K. Nikhila. Accessed 2026-07-11. https://www.rbi.org.in/scripts/FS_PressRelease.aspx?fn=9&prid=50666
[9] Medianama, February 2018: "How the RBI Forced National Payments Body to Hire Government Favourite as CEO" — documents RBI overruling NPCI board's CEO choice; three independent directors wrote dissenting notes. https://www.medianama.com/2018/02/223-rbi-forced-national-payments-body-hire-government-favourite-ceo
[10] Medianama, January 2022: "New fintech division set up at RBI to address issues, leverage opportunities" — Fintech Department established 4 Jan 2022, subsuming DPSS fintech unit. https://www.medianama.com/2022/01/223-rbi-fintech-department-established
[11] IDRBT Tenders page: All published tenders — no `.bank.in` portal tender found. Accessed 2026-07-11. **Negative evidence**: absence of tender where all other IDRBT procurement is listed. https://www.idrbt.ac.in/tenders/
[12] IDRBT IT Vendor Management: Principles & Practices ITVM_Final.pdf: A guide on procurement best practices, not IDRBT's own binding purchase manual. Accessed 2026-07-11. https://www.idrbt.ac.in/wp-content/uploads/2022/07/ITVM_Final.pdf
[13] RBI Organisation and Functions page: Lists DICGC as fully-owned subsidiary. IDRBT, ReBIT, IFTAS, and RBIH are NOT listed as subsidiaries — they exist outside RBI's own official organisational disclosure. Accessed 2026-07-11. https://www.rbi.org.in/commonman/English/Scripts/Organisation.aspx
[14] NPCI Board of Directors page: Confirms board composition and RBI-nominated directors. Accessed 2026-07-11. https://www.npci.org.in/board-directors
[15] ReBIT LinkedIn and company description: "ReBIT is a wholly owned subsidiary of the Reserve Bank of India" — 1,001-5,000 employees, established 2016. https://in.linkedin.com/company/reserve-bank-information-technology-pvt-ltd
[16] NPCI for-profit conversion debate: Shareholder proposal to convert NPCI from Section 8 not-for-profit to for-profit to compete internationally. https://www.sanskritiias.com/current-affairs/npci-from-not-for-profit-to-for-profit
| Data Point | Value | Source |
|---|---|---|
| .bank.in portal — unauthenticated API endpoints | 33+ | [^1] |
| User records exposed | 5,576 | [^1] |
| Wildcard certs issued | N/A — unverified claim removed pending RTI | ❌ Not independently verified |
| Orphan Super Admin accounts | 1,072 | [^1] |
| IDRBT Director appointment gap (Nikhila→Deepak) | 1 day | [^6] |
| Nikhila's tenure as IDRBT Director | ~92 days (24 Jan – 1 May 2024) | [^6] |
| Deepak Kumar's concurrent directorships | 6+ (NPCI, IFTAS, ReBIT, RBIH, IOB, IDRBT GC) | [^3] |
| IDRBT's legal form | Society under 1860 Act | IDRBT website |
| IFTAS acquisition by RBI | 2019 | [^7] |
| IDRBT employees transferred to IFTAS | 431+ | IDRBT historical records |
| NPCI FY25 surplus | ₹1,552 crore (+42% YoY) | NPCI financials |
| NPCI operating income FY25 | ₹3,270 crore | NPCI financials |
| NPCI member banks | 65 | NPCI website |
| NIPL paid-up capital | ₹200 crore (incorporated 3 Apr 2020) | Company check |
| ReBIT employees | 1,001-5,000 | [^15] |
| RBI entities NOT listed on RBI's own org page | IDRBT, ReBIT, IFTAS, RBIH | [^13] |
| RBIH established | March 2022, Section 8, ₹100 Cr capital | [^8] |
| RBI Fintech Department established | 4 January 2022 | [^10] |
| ITVM Procurement Manual publication | July 2022 | [^12] |
This report is published under Creative Commons Attribution 4.0 International (CC BY 4.0). You are free to share and adapt with attribution.
Compiled: 2026-07-11 | Author: CashlessConsumer / DPI Watch
Companion files in this repository:
- chapters/DeepakKumar.md — Raw investigation notes
- chapters/rbi-subsidiaries-survey.md — Historical survey of all entities
- annexures/reference-matrix.md — Cross-verification matrix, negative evidence analysis, timeline, legal framework
- AGENTS.md — Project index and pipeline
Known caveats: The byelaw amendment allegation remains unverified pending access to IDRBT Governing Council minutes. All other claims are sourced from publicly accessible webpages, published reports, and legally obtained corporate records.