For regulated financial entities
The rulebook your regulator holds you to, clause by clause.
AuditSahi holds 21 rulebooks and 1,060 obligations, each read from the regulator's own document. Tell it what you are and it works out which instruments apply, at which tier, and shows the clause that says so. Anything it could not read in a primary source is marked unverified.
-
NBFCs and housing finance companies
Regulated by the Reserve Bank of India
The RBI Cybersecurity, Technology Risk, Resilience and Assurance Directions for NBFCs, issued on 31 July 2026 with immediate effect, apply by scale-based regulation layer and asset size. The RBI digital lending rules apply to lenders that use apps and lending service providers. Alongside them sit the DPDP Act and the CERT-In Directions.
Layer in the Directions Who it covers Base Layer, below Rs 500 crore Non-deposit taking NBFCs with assets under Rs 500 crore Base Layer, Rs 500 crore and above Non-deposit taking NBFCs with assets of Rs 500 crore or more Middle Layer Deposit taking NBFCs, and non-deposit taking NBFCs of Rs 1,000 crore and above Upper Layer and Top Layer The largest NBFCs, placed there by RBI -
SEBI regulated entities
Brokers, registrars, asset managers, advisers and others
SEBI's Cybersecurity and Cyber Resilience Framework is built on NIST CSF 2.0 and applies across 22 categories of regulated entity, with obligations that step up by size band and recurring audit and reporting cycles. AuditSahi places you in your band from your category and the figures that define it, and shows the clause.
-
Insurers and insurance intermediaries
Regulated by IRDAI
The IRDAI Information and Cyber Security Guidelines 2026, with CERT-In and the DPDP Act alongside them. An intermediary that takes card payments also answers to RBI's payment data localisation rules and to PCI DSS, which is voluntary and shown as such.
-
Banks and co-operative banks
Regulated by the Reserve Bank of India
RBI issued separate Directions on 31 July 2026 for commercial banks, urban co-operative banks, small finance banks and payments banks. The co-operative bank Directions are tiered by the digital services a bank offers rather than by its size. AuditSahi holds each as its own instrument, so a bank sees its own rulebook and not a neighbour's.
-
Payment businesses
Aggregators, card data, UPI and NPCI members
RBI's payment aggregator Directions, the payment data localisation requirement and NPCI's rules are switched on by what you do: whether you aggregate payments, hold card data or sit on the UPI rails. Each is shown with the question that turned it on.
-
Every business in India
Whatever it does
The DPDP Act and its Rules apply to every organisation that processes personal data, with most duties starting on 13 May 2027. The CERT-In Directions of 28 April 2022 apply to every body corporate: synchronised clocks, a point of contact, incident reporting within six hours and logs kept for 180 days in India. AuditSahi covers both for any company, regulated or not.
Three sample organisations
What the rules engine returns for three fictional entities.
The demo shows these three, with no account needed, so you can see a rulebook of each kind before you set up your own.
- Meridian Capital FinanceNon-deposit taking NBFC, Rs 640 crore, digital lending. RBI Directions for NBFCs, RBI digital lending rules, DPDP, CERT-In.103 obligations
- Kestrel SecuritiesStockbroker and depository participant. SEBI CSCRF, DPDP, CERT-In.105 obligations
- Anantara Insurance BrokingComposite insurance broker that takes card payments. IRDAI guidelines, DPDP, CERT-In, RBI payment data localisation, PCI DSS.200 obligations
The names are invented. The counts come from the rules engine for each profile, and voluntary standards are shown but not counted.
Worth adopting
The standards that help you grow.
Beside the obligations, AuditSahi lists the voluntary standards worth adopting for your organisation and the reason for each. ISO 27001 is the one larger customers and partners ask for. PCI DSS reaches you through your card contracts if you handle card data. Where a regulator itself requires a certification, as SEBI's framework does for its largest entities, it appears as an obligation, not a suggestion. Voluntary standards are shown but never counted in your checklist.
Find out what applies to you, free.
The free account shows which rulebooks apply to your organisation, at what tier, with the clause that says so. Nothing to upload.