A REALLY USEFUL GUIDE FOR FINANCIAL SERVICES USING FILE TRANSFER
Four regulators. One deadline.
And the way you move data.
Why India's financial services institutions are rethinking managed file transfer between now and 2027.
Could you prove, today, exactly how every file leaves your organisation?
For years that question rarely came up. Now, four separate regulators have made answering the question unavoidable – and they've all done it at roughly the same time.
Who send it?
When?
To whom?
Did it cross the border?
The four drives converging at once
This isn't one new rule you can plan around. It's four rulebooks arriving together, each independently demanding controlled, auditable, encrypted data movement.
Any one of these would justify a fresh look at how you move data. Together, they create genuine urgency across all companies in the financial services industry – all at once.
DPDP Act & Rules 2025
Notified in November 2025, with hard enforcement by May 2027 and penalties reaching Rs 250 crore for security failures. Every movement of personal data must be auditable.
SEBI CSCRF (2024)
Covers all capital market entities – mutual funds, brokers, AMCs. Expects data sovereignty with no ad-hoc routing, SOC monitoring, and breach reporting within 6 hours.
RBI Master Directions (2023-24)
Payment data must stay in India. Offshore-processed digital lending data must return within 24 hours. NBFC controls scale up with asset size.
IRDAI Cyber Security Guidelines (2023)
Cover insurers, brokers, TPAs and web aggregators. Mandate NIST CSF-aligned controls and treat every third-party outsourcing arrangement as a regulated data transfer event.
DPDP penalty for security failures
SEBI CSCRF breach-reporting window
RBI deadline to repatriate offshore lending data
What regulators are actually asking for
Strip away the acronyms, and the four frameworks ask for broadly the same six capabilities. The reason email attachments and consumer document-sharing applications no longer pass muster is simple: they can't satisfy regulatory requirements with evidentiary proof.
Encryption in transit & at rest
RBI, SEBI CSCRF and IRDAI all mandate it – ad-hoc email can't provide audit evidence.
Full audit trails
Who moved what, when, to whom - producible within a 6-hour breach-reporting window.
Data residency controls
Proof that data never left India, with no ad-hoc routing across borders.
24-h repatriation
RBI requires offshore-processed digital lending data home within a day, via automated, logged workflows.
Retention & deletion alignment
Satisfy RBI/SEBI retention periods while honouring DPDP erasure rights – two things that can conflict.
Third-party risk management
Every vendor file exchange is now a regulated event under IRDAI and DPDP processor obligations.
Why now – and why a managed approach
Six capabilities, one platform.
The temptation is to treat this as six problems, or four, and patch each with whatever's closest to hand. That's understandable – it's how file transfer grew up in most organisations. It started off fine, and over the years it got rough around the edges: a script here, a manual workaround there, and no single place to prove what happened.
A managed file transfer platform such as Axway Managed File Transfer (MFT) exists precisely so these capabilities stop being things you assemble by hand. Encryption in transit and at rest, security and control, full audit trails, data residency controls, automated repatriation workflows, granular retention and deletion, and governed third-party connections aren't bolted on – they're the foundation. Compliance stops being a scramble every time an auditor or a breach clock starts ticking.
Axway Managed File Transfer makes these the foundation, not an afterthought:
- Encryption in transit and at rest
- Security and control
- Full audit trails
- Data residency controls
- Automated repatriation workflows
- Granular retention and deletion
- Governed third-party connections
And here's the reassuring part: moving to a platform like this is far less painful than most teams fear. Done in an orderly, structured way – lower-value flows first, then the critical ones, then the long tail – it becomes the least dramatic part of your year. It's also the natural moment to modernise: clear out old, unused flows, and bake the regulator's expectations into your testing regime before you go live, rather than discovering a gap afterwards.
1
Move the lower-value flows first
Start with the easiest, lowest-risk file transfers to build momentum and confidence.
2
Migrate the critical flows
Bring across the regulated, high-stakes transfers once the process is proven.
3
Clear the long tail – and modernise
Retire old, unused flows and bake regulator expectations into testing before go-live.
Copyright © 2026, Axway, All rights reserved.