- Home
- Compliance
- SAR Compliance Audit
Regulatory compliance
SAR Compliance Audit
RBI requires payment system operators to store payment system data within India and submit a System Audit Report (SAR) confirming compliance. We assess your data flows and storage, close gaps and support you through SAR submission.
Why teams choose Adiroha
- Led by CISA and ISO 27001 lead auditors
- Clear scope, roadmap and timeline before we start
- Evidence organised in the Cydital platform
- Support through the external audit and beyond
Scope
What we cover
- Payment data inventory and flow mapping
- Storage location verification across systems and vendors
- Cross-border processing and deletion requirements
- Third-party and cloud provider assessment
- Evidence preparation for the SAR
- Board-approved compliance documentation
Deliverables
What you receive
- Data localisation gap report
- Data-flow diagrams
- Evidence pack for SAR
- Remediation plan
How we work
Discover. Assess. Remediate. Validate.
Discover
Understand your business, scope, stakeholders and the obligations that actually apply to you.
Assess
Gap assessment against the framework or regulation, turned into a prioritised, costed roadmap.
Remediate
Implement policies, controls and evidence with your teams, tracked in Cydital.
Validate
Internal audit before the external one, audit-day support, and continuous compliance after.
FAQ
Common questions
Who needs a SAR?
Payment system operators authorised by RBI, as required under RBI's directions on storage of payment system data.
Who can issue the SAR?
RBI requires the SAR to be conducted by a CERT-In empanelled auditor. We confirm the audit arrangement with you during scoping.
What data must stay in India?
RBI requires the entire data relating to payment systems to be stored in India. Some foreign processing is allowed, with data brought back within set timelines.
How often is a SAR required?
RBI sets the requirement for the SAR. We'll confirm the current submission expectations for your authorisation during scoping.
Do cloud providers need to be in India?
Payment system data must be stored in India, so cloud regions and backups must be located accordingly. We verify this across providers.
Related
Related services
DPDP Act 2023
DPDP Act 2023 readiness — data mapping, consent, notices, data principal rights, breach response and Significant Data Fiduciary obligations.
Learn moreCICRA
Compliance and information security assessment under the Credit Information Companies (Regulation) Act, 2005.
Learn moreISO 27001 Compliance
ISO 27001:2022 implementation — from gap assessment and ISMS design to internal audit and certification, led by certified lead auditors.
Learn moreTalk to a specialist about SAR Compliance Audit.
A free 30-minute consultation to understand your scope and timeline. We follow up with a fixed proposal.