Information Technology in Banking

Core banking system

A core banking system (CBS) keeps all customer accounts in one centralised database at the bank's data centre, with every branch and channel connected to it online. A customer therefore becomes a customer of the bank, not of one branch, and can transact from any branch, ATM or app. A separate disaster recovery (DR) site holds a copy of the data so that service can continue after a failure.

ATMs and cards

• An ATM lets customers withdraw cash and check balances without a teller.
• A debit card draws on the customer's own account; a credit card draws on a credit limit; a prepaid card is loaded in advance.
• A magnetic stripe stores fixed data that can be copied (skimming). An EMV chip generates a unique one-time security code (cryptogram) for each transaction, so a copied card cannot be reused.
• PIN (Personal Identification Number) is the secret number that authenticates the cardholder.
• CVV is the short security code printed on the card, used mainly for online (card-not-present) payments.

Mobile and internet banking

Customers use an app or website for balance enquiry, fund transfer and payments. Because these channels are open to the Internet, banks use two-factor authentication (2FA): two different kinds of proof, for example a password (something you know) plus a one-time password (OTP) sent to the registered phone (something you have). Transaction limits and instant SMS or email alerts add further protection.

SWIFT and RTGS

SWIFT stands for Society for Worldwide Interbank Financial Telecommunication. It is a member-owned cooperative incorporated in Belgium in 1973, with its registered office at La Hulpe. It provides a secure, standardised messaging network; it does not hold accounts or settle funds, which move through the banks' correspondent accounts.

Each institution is identified by a BIC (Business Identifier Code, ISO 9362), popularly called the SWIFT code. It has 8 characters, or 11 when the optional 3-character branch code is added: 4 for the institution, 2 for the country, 2 for the location.

RTGS (Real Time Gross Settlement) settles high-value payments one by one in real time. NRB owns and operates Nepal's RTGS system, which began operating on 12 September 2019.

Database and DBMS basics

• A database is an organised collection of related data; a DBMS is the software that creates and manages it (Oracle, MySQL, SQL Server, PostgreSQL).
• In a relational database, data sits in tables. A row is a record (tuple); a column is a field (attribute).
• A primary key uniquely identifies each record and cannot be empty; a foreign key refers to the primary key of another table.
• SQL commands: DDL defines structure (CREATE, ALTER, DROP); DML works on data (INSERT, UPDATE, DELETE); SELECT retrieves data.
• ACID properties of a transaction: Atomicity (all or nothing), Consistency, Isolation, Durability.

How NRB regulates IT in banks

NRB's Bank Supervision Department released the Information Technology Guidelines in August 2012 for commercial banks. Main expectations:

1. A board-approved IT strategy and policy, with the IT policy reviewed at least annually.
2. A senior official designated as Information Security Officer (ISO) to enforce the information security policy.
3. Card and PIN never under one person's control before delivery to the customer.
4. Magnetic stripe cards to be replaced with chip-based cards.
5. Online card payments authenticated by a second factor, with instant alerts by email, SMS or automated voice call; more than one factor for fund transfers through internet banking.
6. A business continuity and disaster recovery plan meeting the bank's RPO (Recovery Point Objective: how much data, measured in time, may be lost) and RTO (Recovery Time Objective: how long restoration may take).
7. An information systems (IS) audit every year.

In August 2023 NRB's Payment Systems Department added the Cyber Resilience Guidelines, organised around governance, identification, protection, detection, response and recovery, and testing.

Exam pointers

• CBS means one centralised database; the customer belongs to the bank, not the branch.
• Chip beats stripe because each transaction carries a fresh cryptogram.
• SWIFT carries messages, not money; a BIC has 8 or 11 characters.
• Primary key: unique and not empty. ALTER is DDL; UPDATE is DML.
• RPO is about data loss; RTO is about downtime.
• NRB IT Guidelines: issued August 2012, ISO designated, IS audit annually.