Resources Categories

Back

INDUSTRY FACT FILE · BANKING

Main Products and Services in the Banking Sector

What banks offer their customers, the systems that deliver each product, and where those systems create cybersecurity and compliance exposure.

In this document

1. How banks earn their money

2. Products and services by customer segment

3. Deposits, lending and payments in detail

4. Transaction banking, treasury and distribution

5. Digital banking and partner ecosystems

6. The systems behind the products

7. Product trends that change the attack surface

8. Mapping products to Codec Networks engagements

1. How banks earn their money

A bank's business model rests on four pillars: taking deposits, lending, moving money and earning fees for services. Every pillar now depends on technology, and each creates a distinct type of cyber exposure.

Revenue stream	How it works	Security relevance
Net interest income	Interest earned on loans and investments minus interest paid on deposits	Loan origination, core banking and treasury systems must be trustworthy and available
Fee and commission income	Cards, payments, transaction banking, account services, lockers, forex	Card switches, payment gateways and digital channels are prime fraud targets
Treasury and markets income	Trading in government securities, forex and money markets	Dealing systems, SWIFT and settlement interfaces need strict access control
Distribution income	Selling insurance, mutual funds and other third-party products	Customer data shared with partners must be protected and minimised
Government business	Tax collection, pension disbursement, welfare transfers, agency business	High-volume, high-visibility services with zero tolerance for outage or error

2. Products and services by customer segment

Customer segment	Main products	Main services
Retail customers	Savings and current accounts, fixed and recurring deposits, home, vehicle, personal, education and gold loans, credit and debit cards	Internet and mobile banking, UPI, bill payments, lockers, wealth and insurance distribution, NRI services
MSMEs	Working-capital loans, term loans, overdrafts, trade finance, merchant acquiring	Cash management, GST and tax payments, POS and QR acceptance, supply-chain finance, TReDS
Corporates	Term loans, working capital, structured finance, bank guarantees, letters of credit	Transaction banking, payroll, liquidity management, host-to-host and API banking, forex and derivatives
Government and PSUs	Government accounts, deposits, project and infrastructure finance	Tax and fee collection, pension and subsidy disbursement, Direct Benefit Transfer, treasury services
Rural and agricultural customers	Kisan Credit Card, crop and farm loans, SHG and microfinance lending	Business correspondent services, Aadhaar-enabled payments, government scheme accounts
Financial institutions and fintechs	Correspondent and sponsor-bank services, co-lending, escrow and nodal accounts	Sponsor-bank services for UPI and payment aggregators, banking-as-a-service, settlement

3. Deposits, lending and payments in detail

3.1 Deposits

Savings, current, fixed and recurring deposits are the foundation of the bank's balance sheet and its customer relationship. Account opening increasingly happens through video-based KYC (V-CIP) and digital onboarding, which makes identity verification controls and device security central to fraud prevention.

3.2 Lending

Banks lend to retail, MSME, corporate, agricultural and government customers. Retail lending is now heavily digital, with loan origination systems integrated with credit bureaus, Account Aggregators, lending service providers and co-lending NBFC partners. Each integration carries customer data and credit decisions across organisational boundaries.

3.3 Payments

Banks operate or participate in every major payment rail: UPI and IMPS through NPCI, NEFT and RTGS through RBI, card networks, NACH mandates, Bharat Bill Payment System, Aadhaar-enabled payments and SWIFT for cross-border transfers. Banks also act as sponsor banks for UPI apps and as escrow banks for payment aggregators.

Authentication is changing

From 1 April 2026, RBI's Authentication Directions require domestic digital payment transactions to use at least two factors of authentication, with at least one dynamic factor, while allowing banks to adopt alternatives to SMS OTP such as biometrics and device-bound tokens.

4. Transaction banking, treasury and distribution

Transaction banking: cash management, collections, payables, payroll, liquidity and escrow services, increasingly delivered through host-to-host connections and APIs integrated with corporate ERP systems.
Trade finance: letters of credit, bank guarantees, export and import finance, often relying on SWIFT messaging and document-handling platforms.
Treasury and markets: management of liquidity, investments, forex and derivatives, connected to market infrastructure such as CCIL.
Third-party distribution: insurance, mutual funds and other investment products sold through branches and digital channels, requiring secure data sharing with partners.
Digital rupee: banks participate in RBI's e-rupee (CBDC) pilots for retail and wholesale use, adding new wallet and settlement systems.

5. Digital banking and partner ecosystems

Most banking interactions now happen outside the branch: internet and mobile banking, UPI apps, WhatsApp and chat-based banking, API banking and partner platforms. Banks increasingly provide services through partners—fintechs, NBFCs, business correspondents and banking-as-a-service platforms—so the bank's security perimeter extends into its partners' systems.

Open and API banking: APIs for corporate customers, fintech partners and Account Aggregator data sharing, where the bank acts as a Financial Information Provider.
Co-lending and partnerships: joint lending with NBFCs and digital lending partners governed by RBI's co-lending and digital lending directions.
Business correspondents: agent networks that extend banking into rural areas using micro-ATMs and handheld devices.
Sponsor-bank services: banks connect UPI apps, payment aggregators and co-operative banks to national payment systems.

6. The systems behind the products

Mapping products to systems is the first step in scoping any security assessment. It shows which applications, interfaces and suppliers carry the most business risk.

Title: Figure 2: Where cyber risk sits in banking operations — systems at each stage and the attacks that typically target them. - Description: Figure 2: Where cyber risk sits in banking operations — systems at each stage and the attacks that typically target them.

Figure 2: Where cyber risk sits in banking operations — systems at each stage and the attacks that typically target them.

Product / service	Systems that deliver it	Key cyber and compliance touchpoints
Accounts and deposits	Core banking, CRM, V-CIP and KYC platforms, CKYCR interface	Identity assurance, data protection, privileged access
Internet and mobile banking	Web and mobile apps, API gateway, authentication server, fraud engine	Application security testing, authentication rules, anti-phishing and rogue-app monitoring
UPI and IMPS	UPI switch, NPCI interfaces, PSP and TPAP integrations	API security, transaction monitoring, mule detection
Cards and ATMs	Card management system, card switch, ATM switch (often a shared service provider), HSMs	PCI DSS, baseline controls for ATM switch providers, limit-change monitoring
RTGS, NEFT and SWIFT	Payment hub, SWIFT interface, treasury systems	SWIFT CSP, privileged access, maker-checker, segregation
Retail and MSME lending	LOS, LMS, bureau and AA connectors, LSP and co-lending APIs	API data minimisation, partner assurance, DPDP
Transaction banking	Corporate portals, host-to-host and API channels, ERP connectors	Integration security, file integrity, customer authentication
Data centre and recovery	Primary and DR data centres, backup systems, cloud workloads	Half-yearly DR drills, backup isolation, cloud security

7. Product trends that change the attack surface

Trend	What is changing	Security implication
Credit on UPI and digital lending	Credit lines and RuPay credit cards on UPI; instant digital loans	Account takeover now exposes credit limits, not only balances
New authentication factors	Biometrics, device binding and tokens supplement SMS OTP from April 2026	Authentication and recovery flows must be retested
Cloud and core modernisation	Workloads move to cloud and modern core platforms	Misconfiguration and shared-responsibility gaps; migration risk
Open APIs and partnerships	More fintech, co-lending and BaaS integrations	Partner APIs can overshare data or become entry points
AI in operations and service	AI-driven fraud detection, chatbots and underwriting	Prompt injection, data leakage and model manipulation risks
Deepfakes and voice cloning	Synthetic voices and video used against KYC and staff	Call-back and verification controls must assume impersonation

8. Mapping products to Codec Networks engagements

If the bank offers…	Recommended starting engagement
Internet and mobile banking	Mobile and web application testing, authentication review, anti-phishing and rogue-app monitoring
UPI, IMPS and sponsor-bank services	API security testing, transaction-monitoring review, mule-detection use cases in the CSOC
Cards and ATMs	PCI DSS readiness, ATM switch provider assessment, card-switch privileged-access review
SWIFT and treasury	SWIFT CSP independent assessment support, privileged-access and segregation review
Digital lending and co-lending	Partner API testing, DPDP privacy review, third-party risk assessment
Transaction banking	Host-to-host and API integration testing, file-integrity controls review
Data centre, DR and cloud	DR drill observation, backup security testing, cloud posture assessment

Talk to Codec Networks

Contact

Codec Networks Pvt. Ltd.

New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001

Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana

Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124

Email: mktg@codecnetworks.com Web: www.codecnetworks.com

Note: Product descriptions are general and based on public information available as of October 2026. Product rules are governed by RBI directions and NPCI and card network rules, which change frequently. Confirm current requirements against official circulars.