Finding · F-IAQ2-PAY-01
Bulk payout API accepted requests without customer 2FA
ClosedPAY-01 · Payment APIs secured with mTLS, signing and customer 2FAPayments SecurityQ2 2026 Unified Program Review
Fraud indicator
Rating
No
High
Medium
Low
Requirement to validation
Requirement
ISO-A.8.24 · ISO-A.8.5 · RBI-DPSC-2021-4 · SOC2-CC6.1 · SOC2-CC6.7
mapped
Policy
Payments Security Policy
pol-payments
Control
PAY-01
Payment APIs secured with mTLS, signing and customer 2FA
Application
PayGate Payment Gateway · Meridian Customer Portal
mapped
Evidence · Q3
2 items
2 approved · 0 pending · 0 rejected
Test · Q3
Pass
TST-RBI-PAY-01 · High confidence
Finding
F-IAQ2-PAY-01 · High
Closed
Action
Deepa Menon
REM-F-IAQ2-PAY-01 · Closed
Validation
Validated
as recorded
Observation
Raised 2026-06-20 in the Q2 2026 internal audit baseline. The portal's bulk-payout endpoint accepted signed requests without a second factor for 2 of 12 corporate customers on a legacy plan.
Applications: PayGate Payment Gateway, Meridian Customer Portal.
Potential risk
Unauthorised or erroneous transactions could go undetected and expose Meridian to financial loss and regulatory action.
Root cause
Legacy API plan was excluded from the 2FA rollout.
Agreed action plan
Remediate: bulk payout api accepted requests without customer 2fa.
Management response: Management agreed and committed to remediate before the Q3 review.
- Action
- REM-F-IAQ2-PAY-01
- Owner (FPR)
- Deepa Menon
- Target date
- 31 Jul 2026
- Priority
- High
- Status
- Closed
- Validation
- Validated · planned 26 Sep 2026
Evidence for this control (4)
| Evidence | Title | Control | Source system | Collected | Status |
|---|---|---|---|---|---|
| Q2-EV-039 | PayGate Payment Gateway · system export (Q2) | PAY-01 | PayGate Payment Gateway | 6 Jun 2026 | Rejected |
| Q2-EV-040 | Meridian Customer Portal · configuration report (Q2) | PAY-01 | Meridian Customer Portal | 11 Jun 2026 | Rejected |
| RBI-REQ-035 | PayGate: mTLS enforced on payout API | PAY-01 | 4 Oct 2026 | Accepted | |
| RBI-REQ-036 | Meridian Customer Portal: Payment initiation requires 2FA | PAY-01 | Meridian Customer Portal | 9 Oct 2026 | Accepted |
Tests of this control (2)
| Test | Control | Cycle | Tested | By | Result | Confidence |
|---|---|---|---|---|---|---|
| TST-RBI-PAY-01 | PAY-01 · Payment APIs secured with mTLS, signing and customer 2FA | Q3 2026 Unified Program Review | 5 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit (IS Audit cell) | Pass | High |
| TST-Q2-PAY-01 | PAY-01 · Payment APIs secured with mTLS, signing and customer 2FA | Q2 2026 Unified Program Review | 18 Jun 2026 | Farah Khan, Vikram Mehta · Meridian Internal Audit | Fail | High |