Module 5 · Reference Architecture for Indian Regulated Workloads

Why this module exists. Architects designing for Indian regulated workloads navigate four to six overlapping regulator expectations. The cost of architecting for one regulator at a time is rework; the cost of architecting for all simultaneously is one-time complexity. This module is the integrated reference.

The recurring architectural requirements

• Data localisation — RBI (payment data), DPDP (SDF cross-border restrictions), sector-specific telco/insurance.
• Segregation — production from non-production; customer data from operational data; admin paths from user paths.
• Audit logging — 180+ days retention (CERT-In); regulator-accessible.
• Encryption at rest + in transit — universally expected.
• Disaster recovery with geographic separation — RBI/SEBI/IRDAI mandate.
• Continuity testing — annual at minimum.
• CISO independence + reporting line — RBI/SEBI explicit.

A reference architecture for Indian banking digital workloads

┌─────────────────────────────────────────────────────────────┐
│  Customer-facing zone (DMZ)                                  │
│  - WAF + DDoS protection (Indian-region edge)                │
│  - API gateway with rate limiting                            │
│  - Front-end services (TLS termination at WAF)               │
│  - All traffic logged with full request/response             │
└───────────────────────┬─────────────────────────────────────┘
                        │  mTLS only
┌───────────────────────▼─────────────────────────────────────┐
│  Application zone (private)                                  │
│  - Microservices in service mesh (Istio)                     │
│  - Database access via service identity, not IP              │
│  - All inter-service mTLS                                    │
└───────────────────────┬─────────────────────────────────────┘
                        │  encrypted, audited
┌───────────────────────▼─────────────────────────────────────┐
│  Data zone (most-restricted)                                 │
│  - Core banking DB (Indian-region only)                      │
│  - PII storage with field-level encryption                   │
│  - All access via DBA-approved jump host with session record │
│  - Continuous backup to immutable storage in different AZ    │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│  Out-of-band: Admin access                                   │
│  - Bastion host with MFA + session recording                 │
│  - JIT privileged access via PAM platform                    │
│  - No direct admin path from public internet                 │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│  Logging + monitoring                                        │
│  - Centralised SIEM with 180-day hot + 7-year cold retention │
│  - CERT-In-compliant time-source sync                        │
│  - SOC monitoring 24×7                                       │
│  - Behavioural analytics for insider risk                    │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│  DR site (Indian secondary region)                           │
│  - Active-active for online-banking surface                  │
│  - Async-replicated for core banking                         │
│  - Annual full failover test                                 │
└─────────────────────────────────────────────────────────────┘

The data-localisation specifics

Architectural implication: data classification + storage routing. The “primary” region selection is constrained.

Segregation patterns

Four segregations every Indian regulated architecture maintains:

• Production vs non-production. Separate cloud accounts / subscriptions; no shared services; explicit-cross-environment access only via documented procedures.
• Customer-facing vs back-office. Separate networks; separate teams with separate access roles.
• Admin paths vs user paths. Bastion / PAM for admin; no admin tooling on customer-facing surface.
• Crypto operations. HSM-backed key operations isolated; application-level access via tightly-scoped APIs.

Logging architecture for regulator compliance

• Application logs include user ID, action, target, timestamp, source IP — at minimum.
• Security-relevant events include authentication results, authorisation decisions, privileged operations.
• Time source synchronised to NIC / NPL (CERT-In requirement).
• 180-day hot retention for incident-search; 7-year cold retention for regulator and legal needs.
• Tamper-evident storage — immutable buckets, signed log entries, or write-once storage.

The cloud-provider question

RBI and SEBI permit cloud use under specific conditions. Architectural implications:

• Use of MEITY-empanelled cloud providers preferred for regulator comfort (AWS, Azure, GCP all empanelled).
• Customer-managed encryption keys (CMK / BYOK) for sensitive workloads.
• Customer-controlled access logging (CloudTrail, Azure Activity Log) retained per regulator schedule.
• Documented exit plan — required under RBI IT Outsourcing Master Direction.

The architecture-review milestones

Indian regulated workloads need architecture review at:

1. Pre-build — architecture committee approval before construction.
2. Pre-production — security architecture sign-off before launch.
3. Annual — re-validation against current regulator expectations.
4. Material change — any architectural change is re-reviewed.

Document each review with the questions asked, decisions made, residual risks. The artefact is regulator-defensible evidence of architectural diligence.

Key takeaways

• Recurring requirements: localisation, segregation, audit logging, encryption, DR, continuity testing, CISO line.
• Reference pattern: DMZ → app zone (mesh) → data zone, with out-of-band admin and 24×7 logging.
• Localisation specifics vary by data type; classification drives storage routing.
• Four segregations: prod/non-prod, customer/back-office, admin/user paths, crypto operations.
• Logging architecture: regulator-mandated retention, immutable storage, time-source compliance.
• Architecture-review milestones documented; regulator-defensible artefact.