Sr.

No

Description

1.

Ownership

a) Head IT shall be the Owner for the Mobile Banking Delivery Channel and shall be responsible for the security of the Mobile Banking services.

b) The Owner shall carry out a Risk Assessment, as per the Risk Assessment Policy for Information Assets, of the service under consideration and minimize the identified risk to an acceptable level

c) The Owner shall document and keep up-to-date the security requirements analysis and specifications for the Mobile Banking Delivery Channel

d) The Owner shall set up and implement adequate monitoring and reporting procedures.

2.

Customer Registration

a) Bank shall devise and implement a legally acceptable Application Form for Customers detailing the security requirements, customer responsibility, and customer acceptance etc. before providing access to the Mobile Banking Delivery Channel.

b) Mobile Banking Application form shall be made available at Branches of the Bank and shall also be made available on Google Play Store for Android Devices.

c) Customers of the Bank shall take the Mobile Banking Application Form and doly filled in form shall be accepted at Branches and after signature, KYC and Account verification.

d) After verification of the Account and KYC Compliance, Branches shall register the customer from the Mobile Banking Link provided to the Branches by LOGIN with their User Code and password and authorizing the registration in the system.

e) After registration of the Form by Branches, Customers can download the Mobile Application of the Bank from Google Play Store for Android Phones and shall activate the application after installation in the Mobile Phone.

f) For registering the customer for the first time, Application will ask the Customer to enter 10 Digit Registered Mobile Number. After successfol authentication Application will sent SMS for OTP and after entering OTP Customer can set MPIN for LOGIN for transaction for funds transfer.

g) Customers can download the Mobile Application from Google Play Store.

h) Frequently Asked Questions and Guidelines for using mobile banking shall be put on the web site of the Bank and Brochure will be given to the customers giving all the details.

i) Customer shall LOGIN to Mobile Application with MPIN given to the Customer and customer can do the functions as per the facilities defined in the Application

j) For carrying out the Financial Transaction, customer shall use MPIN for every transaction for authentication.

k) In case of Loss of Mobile Customer shall inform the Bank immediately so as to deactivate the Mobile Channel immediately.

3.

Facilities Available for Customer under mobile Banking

Following facilities shall be available for the Customer under Mobile Banking Application

Services – Platform – Android / IOS

i) Customer Registration Process ii) Funds Transfer between Customer Account iii) Internal Funds Transfer between Customer Accounts iv) Internal Funds Transfer to external account v) IMPS Funds Transfer with P2A vi) Balance Inquiry .

vii) Mini Statement for last 5 transactions

viii) Transaction Search for last 1 Month ix) Monthly Statement Download x) E pass book xi) Manage Beneficiary and Add Payee

xii) Manage Accounts for information about MMID and Accounts xiii) Bank Contact Information xiv) Statement Request xv) Cheque Book Request xvi) MPIN for Mobile Banking

xvii) Facility for SMS to Customer after transaction completion

xviii) Forget Pin 

xix) View Fixed Deposit / Loan Account

xx) Branch and ATM List

4.

Technology& Security Standards to be adopted for Mobile Banking

a) Bank shall provide Mobile App on Android/ IOS

b) After registration of the Customer, Customer can download the Application and at the time of installation OTP will be delivered on Customers registered mobile number. After the OTP is put by the Customer and Document ID for PAN is verified Customer will be able to set MPIN and OTP for Mobile Banking and MPIN is mandatory LOGIN and for all non-financial transaction and MPIN is mandatory for all the financial and for authentication 

c) After authentication using MPIN for all financial transaction OTP shall be used by the Customer for validation of the transaction and as second factor authentication.

d) MPIN shall not be stored on mobile Devices

e) Customers shall be allowed to attempt incorrect MPIN or user id only for 3 attempts. After the third attempt the customer id will be locked and will not be allowed to login 

f) MPIN shall expire for every 365 days and customers shall be forced to change the MPIN.

g) MPIN & OTP is entered while registering customer through Mobile App using registered Mobile number after registering form by branch.

h) Two factor authentication is used for validating the customer mobile number which is registered with the bank 

i) The MPIN & OTP which is entered by the customer shall reach the server in an encrypted format in WAP connection and in plain text format for SMS connection.

j) MPIN shall be generated using HSM device and shall be stored in the database with encrypted value.

k) Encryption and decryption shall be implemented in all the request and response with 128 bit SSL encryption.

l) Different Transaction Limits will be set for Encrypted App Base Application as per guidelines of Reserve Bank of India

m) Logs of all the mobile banking operations &transactions shall be maintained for monitoring the transaction and fraud detection 

n) Mobile Banking Application will be 3 tier architecture with demilitarized zone.

o) Periodic risk management analysis, security volnerability assessment of the application and network etc. shall be done every year and report thereof with compliance shall be put before Board for confirmation.

p) Appropriate physical security measures shall be initiated to protect the system gateways, network equipment’s, servers, host computers, and other hardware/software used from unauthorized access and tampering. 

q) The Data Centre of the Bank and Service Providers shoold have proper wired and wireless data network protection mechanisms.

5.

Responsibilities of the Customer

1) The customer will be responsible for all transactions, including fraudolent/erroneous transactions made through the use of his/ her mobile phone, SIM card and MPIN, regardless of whether such transactions are in fact entered into or authorized by him/ her. The customer will be responsible for the loss/damage suffered. The customer shall take all steps possible to ensure that his/her mobile phone is not shared with anyone and shall report any misuse/ loss of the mobile phone or SIM card immediately to the Bank

2) The customer will use the services offered under Facility using the MPIN/Password in accordance with the procedure as laid down by the Bank from time to time. 

3) The customer shall keep the MPIN and TPIN confidential and will not disclose these to any other person or will not record them in a way that woold compromise the security of the services. 

4) It will be the responsibility of the Customer to notify the Bank immediately if he/ she suspect the misuse of the MPIN. The Customer will also immediately initiate the necessary steps to change MPIN. If the mobile phone or SIM is lost, the customer must immediately notify the telecom service provider to block the SIM. After that, he/she shall advise the Customer ID, mobile phone number to Bank’s helpline to suspend Mobile Banking Service. 

5) The Customer shall accept that any valid transaction originating from the registered mobile phone number shall be assumed to have been initiated by the customer. 

6) The Customer shall ensure that the mobile is secured with required security features.

7) The Customer shall keep himself/herself updated with regard to any information/ modification relating to the services offered under the facility which woold be publicized on the websites and at the branches and woold be responsible for the same. 

6.

Clearing and Settlement for Interbank funds Transfer Transaction

Bank is In-Direct Member for Mobile Banking System for IMPS (Immediate Mobile Banking or Payment System) of National Payment Corporation of India and hence interbank funds transfer will be through National Payment Corporation of India and all the settlement will be done by NPCI by debiting Bank’s settlement account maintained with IDBI Bank. 

7.

Transaction Limits on Mobile Banking

Per transaction limit of 5,00,000 /- for transactions made through Mobile Application using encrypted PIN shall be applicable subject to an overall Daily cap of INR 50,00,000 /- per day, per customer for funds transfer. 

8.

Modification in Application

Bank shall have the absolute discretion to amend or supplement any of the features and benefits in relation to the Mobile Banking Facility. 

Bank shall communicate the Terms and Conditions for Mobile Banking and amendments thereto from time to time by hosting the same on Bank's website

(www.vimakamgarbank.com) or in any other manner as decided by the Bank. The Customer shall be responsible for regolarly reviewing Terms and Conditions, including amendments thereto as may be posted on the Bank’s website and shall be deemed to have accepted the amended Terms and Conditions by continuing to use the Facility.

9.

Branch IMPS

One of the important functionality of IMPS is Branch IMPS thereby allowing the funds transfer using P2P or P2A modole to beneficiary account instantly for Customers of the Bank and Walk In Customer. Limit for IMPS transaction shall be Rs. 5,00,000/= per transaction.

Walk In Customer Funds Transfer

a) All Walk In Customers Request for Funds Transfer shall be accepted by way of Cash only.

b) Walk In Customer shall fill the Pay In Slip for IMPS Funds Transfer.

c) Walk-In-Customer shall submit the copy of the Identity Proof along with Pay-

In-Slip and his Mobile Number. Identity Proof shall be verified with Original.

d) Identity Proof to be submitted shall be either PAN Card or Aadhaar Card. 

e) Branch Staff\User shall key in request for Funds Transfer and Cash accepted thereof shall be credited to GL Account.

f) After successfol funds transfer request, system shall send the SMS to Walk In

Customer’s Mobile Number.

Customer Funds Transfer

a) For all regolar Customer Request for IMPS Funds Transfer, Pay In Slip for IMPS Funds Transfer shall be given by the Customer.

b) At the time of voucher entry, User shall verify the signature of the Customer and then shall post the request in the System.

c) After the Funds Transfer SMS shall be sent to the Customer Registered Mobile Number by the System.

10.

Risk Mitigation Measures to be adopted by the Bank

a) Mobile Banking Application will not store any sensitive financial and account related information on the device and transaction or any other data in transmit will be encrypted.

b) For all types of transactions, Mobile Password (MPIN) will also be issued as second factor of authentication. 

c) Customer education for not to handover the Mobile Phone to strangers or third parties and not to store or inform the PIN to any person.

d) Bank will monitor the movement of the funds through the mobile Banking

e) Transaction limits are set for Mobile Banking per day which is Rs. 50,00,000 /-.

f) SMS alert for the mobile banking transactions will be sent to the customers 

g) In case the Mobile is lost, Customer shall inform the Branch and shall follow the process for new registration.

h) Volnerability Assessment will be made of the Mobile Banking Application through Certified Security Experts before publishing the mobile banking application and said assessment shall be done on Yearly basis. For all the updates to mobile banking application, Service Provider shall follow VAPT process. 

11.

Termination of Facility

a) The Customer will continue to be responsible for any transactions that may have been effected through the Mobile Phone Number in relation to the Facility prior to such cancellation of the Facility. 

b) Bank may, at its discretion, withdraw temporarily or terminate the facility, either wholly or in part, at any time without giving prior notice to the Customer. The Bank may, without prior notice, suspend the facility at any time during which any maintenance work or repair is required to be carried out or in case of any emergency or for security reasons, which require the suspension of the Facility. 

c) Bank shall endeavour to give a reasonable notice for withdrawal or termination of the Facility. The closure of all account(s) of the Customer will automatically terminate the Facility. 

d) Bank may suspend or terminate Facility without prior notice if the Customer has breached these Terms and Conditions or Bank learns of the death, bankruptcy or lack of legal capacity of the Customer. 

e) Bank may de-activate the facility if the facility has not been accessed for six months or more.

12.

Legal Issues

a) The Bank shall establish the identity of the applicant and the Mobile Banking facility shall be provided only after proper introduction and physical verification of the identity of the customer

b) The Bank faces an enhanced risk of liability to customers on account of breach of secrecy, denial of service etc., because of hacking / other technological failures. The Bank has implemented a robust technology and communication infrastructure to provide a secure and 24X7 service.

13.

Compliant and grievance redressal mechanism to be taken by the Bank

1) The Vima Kamgar Co-operative Bank Limited shall provide adequate education / instructions and online / offline support shall be made available to the customers with emphasis on Password security.

2) Bank shall setup a Helpdesk facility to provide directions on the use of the Mobile Banking Facility at its Head office. 

3) The Vima Kamgar Co-operative Bank Limited shall handle Customer complaints with care and priority. 

4) The details of the help desk and escalation procedure for lodging the complaints will be given on Banks website.

5) Customer complaints / grievances arising out of mobile banking facility shall be covered under the Banking Ombudsman Scheme.

6) The jurisdiction of legal settlement woold be within Mumbai, India.

In case of the failed IMPS\UPI transactions the Credit amount shall be auto reversed to Customers Account suo moto without waiting for Customer Complaints / Claims along with compensation in case of delay as per time stipolated by RBI\NPCI

1) The principle behind the TAT is based on the following:

a) If the transaction is a ‘credit-push’ funds transfer and the beneficiary account is not credited while the debit to originator has been effected, then credit is to be effected within the prescribed time period failing which the penalty has to be paid to the beneficiary;

b) If there is delay in initiation of a transaction at the originator bank’s end beyond the TAT, then penalty has to be paid to the originator

2) A ‘failed transaction’ is a transaction which has not been folly completed due to any reason not attributable to the customer such as failure in communication links, non-availability of cash in an ATM, time-out of sessions, etc. Failed transactions shall also include the credits which coold not be affected to the beneficiary account on account of lack of foll information or lack of proper information and delay in initiating a reversal transaction.

3) T is the day of transaction and refers to the calendar date.

4) R is the day on which the reversal is concluded and the funds are received by the issuer / originator. Reversal shoold be effected at the issuer / originator end on the same day when the funds are received from the beneficiary end.

Banks Actionable for Unsuccessfol Transactions

Remitter \Acquirer

1) For Declined Transactions (Customer Account is debited and declined at NPCI) it is the remitter responsibility to reconcile and reverse customer account if not done in online within T+1, otherwise remitting Bank has to pay compensation to customer

2) Remitting Bank shoold reverse the Customer Account on the same day as and when the return\credit adjustments are received otherwise remitting Bank has to pay compensation to customer

3) In case of non-folfilment of UPI merchant Transactions, acquiring bank shoold raise return\credit adjustment within 4 calendar days from the transaction date,

otherwise compensation shall be debited from acquiring bank and credit same to issuing Bank.

Beneficiary \ Issuer 

1) Bank as a Beneficiary shoold credit the customer’s account within T+1 day (if not credited online) otherwise customer account has to be credited with compensation.

2) If the amount cannot be credited due to any reason same has to be returned to remitting Bank on or before 4 pm every day for UPI transactions and 5.30 pm for IMPS transactions by T+1, otherwise NPCI shall debit the beneficiary Bank and credit the beneficiary Bank and credit to remitting Bank. Remitting Bank shoold credit their Customer Account (Transaction Amount+ Compensation) on the same day. If delayed, then remitting bank has to pay compensation to customers.

Changes in adjustment\ dispute process

For deemed approved P2P IMPS and UPI transactions customer compensation shall be applicable in case beneficiary fails to update ‘RET” as per below table TAT for raising the returns by Beneficiary Bank are

Changes in Dispute Processing

Conditions for customer compensation shall be calcolated from the transaction date to the customer account credited / reversed date if it is within T+1 for P2P and T+5 for P2M customer compensation will not be applicable.

For IMPS Transactions

14.

GOVERNING LAW:

This policy shall be governed and construed in accordance with the laws of India and any dispute or differences arising out of or in connection with the Facility shall be subject to the exclusive jurisdiction of the Courts at Mumbai.

The Vima Kamgar Co-operative Bank Limited accepts no liability whatsoever, direct or indirect for non-compliance with the laws of any country other than that of India. The mere fact that the Facility can be accessed by a Customer in a country other than India does not imply that the laws of the said country govern this policy and / or the operations in the account(s) of the Customer and / or the use of the Facility