Process Over Substance: Inside the G20's Light-Touch AI Framework
Introduction
On September 1–2, 2026, the G20 Innovation Ministerial was held at the Carolina Inn in Chapel Hill, North Carolina. This gathering of ministers, senior officials, and high-profile technology executives marked the first sectoral ministerial of the G20 presidency held by the U.S. government this year. The two consensus documents that resulted from the meeting, the G20 Innovation Ministerial Statement and the Carolina Principles, are expected to dictate how the largest world economies regulate AI for many years. In this post, the content of the two documents will be discussed along with their role in the larger context of the U.S. G20 presidency that will culminate in the leaders’ summit in Miami scheduled for December and the response of the tech community, allied governments, and civil society to the framework.
The U.S. Presidency and the Road to Chapel Hill
The United States assumed the rotating G20 presidency on December 1, 2025, and immediately signalled a departure from the priorities pursued by South Africa, the previous chair, whose 2025 Johannesburg summit had emphasised climate finance and debt sustainability for developing economies, a summit the U.S. ultimately boycotted. In its opening statement, the State Department announced that the American presidency would organise the year around three themes: reducing regulatory burdens on economic growth, securing affordable and reliable energy supply chains, and "pioneering new technologies and innovations". The Innovation Ministerial in Chapel Hill was the clearest single expression of that third pillar, and it was scheduled ahead of the finance ministers' meetings in Asheville and the foreign ministers' meetings in Atlanta, with the full cycle set to close at the Leaders' Summit at Trump National Doral in Miami on December 14–15, 2026.
Symbolism was deliberately built into the choice of venue. White House science and technology advisor Michael Kratsios, who chaired the ministerial, argued that North Carolina's Research Triangle and its status as home to the nation's first public university made Chapel Hill an apt backdrop for a statement about translating research into commercial and public benefit. The venue also produced the framework's name: the Carolina Principles.
The Innovation Ministerial Statement: Six Pillars
The Innovation Ministerial Statement is organised around six pillars:
pro-innovation policy frameworks; technology for opportunity and prosperity (chiefly AI adoption in public services);
- skilled technical workforce development;
- intellectual property policy for AI;
- standards that support both AI-enabled standards development and standards for AI systems; and
- industrial innovation and supply-chain resilience.
All six ideas run together in one concept: "Old-fashioned or too rigid regulatory systems can limit innovation in an unintended way," and successful policymaking, short of restricting entrepreneurial initiatives, consists of creating the type of regulatory framework which is effective and flexible. The language is also marked by sensitivity to sovereignty, stating repeatedly that countries have the right "to formulate their policies and express their sovereignty on issues of emerging technology governance" and thus make it possible for twenty countries with different legislative customs to agree upon one text.
On IP, the statement treats the copyright-AI interface as unresolved by design, noting that questions about how doctrines such as prior consent and fair-use-style exceptions apply to AI training "remain appropriately resolved through each member's established legal processes" rather than through a harmonised international rule. On standards, it frames AI itself as a tool for regulatory efficiency for comparing safety and performance data across jurisdictions and reducing duplicative testing while affirming that market competition, not government selection, should determine which AI models succeed.
The Carolina Principles: Structuring the Technology Lifecycle
Where the Ministerial Statement sets out aspirations, the Carolina Principles operationalise them across the "science and technology development lifecycle". The document is structured in three parts. The first, Advancing Discovery and Strengthening Technology Development, calls for sustained public investment in foundational research, blended public-private financing across technology readiness levels, and streamlined administrative processes for R&D funding. The second, Accelerating Validation and Commercialisation, is the most operationally specific section, endorsing regulatory sandboxes, results-based funding mechanisms, and innovation-orientated public procurement to help technologies cross the gap from laboratory to market. The third, Enabling Technology Adoption, is the section that has drawn the most political attention: it commits members to apply existing sector-specific regulatory frameworks to AI wherever possible and to reserve new rulemaking only for "novel considerations that existing legal frameworks cannot adequately address" as defined in The Carolina Principles for Emerging Technologies, 2026, Section III.
That last commitment is the crux of what commentary has called the U.S.'s "light-touch" pitch to the world. Rather than proposing a new international AI regulator, the Carolina Principles ask governments to extend the jurisdiction of existing sector regulators and financial supervisors handling AI in finance and health authorities handling AI in medical devices and to treat novel, cross-cutting AI regulation as an exception rather than a default. Commerce Secretary Howard Lutnick announced that all twenty G20 members, including China, endorsed the framework, calling it a product of "an enormous amount of work" given the divergent starting positions in the room. The timing was pointed: the framework was finalised roughly a month after the European Union's AI Act reached its most consequential enforcement milestone, with binding obligations for high-risk AI systems taking effect on August 2, 2026, a contrast Elon Musk, participating in the ministerial, invoked directly in criticising EU-style regulation.
Reception: Consensus Inside, Scepticism Outside
Inside the Carolina Inn, the mood among industry leaders was buoyant. In a fireside conversation with Secretary Lutnick, OpenAI's Sam Altman described AI as "incredible magic of intelligence in a bottle" while warning that continued infrastructure build-out, more data centres, and more compute would be necessary to keep costs manageable. Nvidia's Jensen Huang and Palantir's Alex Karp offered similarly optimistic assessments, and Anthropic's participation in a voluntary model-testing arrangement with the U.S. government's safety and security institute was cited by OSTP Director Kratsios as evidence that industry-government cooperation, rather than statutory mandate, could deliver trustworthy AI.
Outside the security perimeter, several hundred demonstrators, like students, faculty, and local organisers, gathered to protest what they characterised as an unaccountable alliance between government and AI capital, chanting slogans against both the technology's labour-market effects and the data centre buildout it requires. The juxtaposition captured a tension that runs beneath the consensus text itself: a framework designed to secure the broadest possible international agreement necessarily says less about how risks Labour displacement, energy demand, and algorithmic harm will be managed than it does about how innovation will be accelerated.
Conclusion
The Carolina Principles represent a coherent and, by G20 standards, unusually specific attempt to answer a question that has vexed multilateral technology governance for a decade: how do twenty economies with incompatible regulatory philosophies agree on anything regarding AI? The answer Chapel Hill produced was to agree on process rather than on substantive limits. Whether that process-based consensus proves durable will depend on what happens between now and the Miami Leaders' Summit in December, when heads of state, rather than ministers, will decide whether to elevate the Carolina Principles into the G20's broader economic agenda or treat them as a single ministerial's contribution to a much longer conversation.
References
- https://assets.publishing.service.gov.uk/media/6a996786f5b35599aec19180/g20-innovation-ministerial
- https://www.commerce.gov/sites/default/files/2026-09/THE-CAROLINA-PRINCIPLES-FOR-EMERGING-TE
- https://www.commerce.gov/news/press-releases/2026/09/g20-innovation-ministerial-concludes-conseNSUS statement
- https://www.whitehouse.gov/releases/2026/09/g20-innovation-ministerial-concludes-with-consensus-sstatement/
- https://www.state.gov/policy-issues/g20/feed/
- https://g20.org/g20-united-states/
- https://dailytarheel.com/480187/university/university-g20-event-1/
- https://qz.com/g20-us-light-touch-ai-framework-chapel-hill-090326
- https://explainx.ai/blog/g20-carolina-principles-ai-regulation-chapel-hill-2026
- https://enterprisedna.co/resources/news/us-g20-carolina-principles-ai-regulation-enterprise-september-2026/
- https://www.cnbc.com/2026/09/02/g20-innovation-ministerial-live-updates.html
- https://fortune.com/2026/09/05/tech-ceos-ai-data-centers-g20-protests-sam-altman-nvidia-jensen-huang-palantir-alex-karp-chapel-hill-north-carolina-ai-backlash/
- https://www.wunc.org/education/2026-09-02/protest-chapel-hill-unc-g20-innovation-technology-sam-a
- https://www.cfr.org/articles/us-g20-presidency-narrow-agenda-2026
Related Blogs
Introduction
The advent of AI-driven deepfake technology has facilitated the creation of explicit counterfeit videos for sextortion purposes. There has been an alarming increase in the use of Artificial Intelligence to create fake explicit images or videos for sextortion.
What is AI Sextortion and Deepfake Technology
AI sextortion refers to the use of artificial intelligence (AI) technology, particularly deepfake algorithms, to create counterfeit explicit videos or images for the purpose of harassing, extorting, or blackmailing individuals. Deepfake technology utilises AI algorithms to manipulate or replace faces and bodies in videos, making them appear realistic and often indistinguishable from genuine footage. This enables malicious actors to create explicit content that falsely portrays individuals engaging in sexual activities, even if they never participated in such actions.
Background on the Alarming Increase in AI Sextortion Cases
Recently there has been a significant increase in AI sextortion cases. Advancements in AI and deepfake technology have made it easier for perpetrators to create highly convincing fake explicit videos or images. The algorithms behind these technologies have become more sophisticated, allowing for more seamless and realistic manipulations. And the accessibility of AI tools and resources has increased, with open-source software and cloud-based services readily available to anyone. This accessibility has lowered the barrier to entry, enabling individuals with malicious intent to exploit these technologies for sextortion purposes.
The proliferation of sharing content on social media
The proliferation of social media platforms and the widespread sharing of personal content online have provided perpetrators with a vast pool of potential victims’ images and videos. By utilising these readily available resources, perpetrators can create deepfake explicit content that closely resembles the victims, increasing the likelihood of success in their extortion schemes.
Furthermore, the anonymity and wide reach of the internet and social media platforms allow perpetrators to distribute manipulated content quickly and easily. They can target individuals specifically or upload the content to public forums and pornographic websites, amplifying the impact and humiliation experienced by victims.
What are law agencies doing?
The alarming increase in AI sextortion cases has prompted concern among law enforcement agencies, advocacy groups, and technology companies. This is high time to make strong Efforts to raise awareness about the risks of AI sextortion, develop detection and prevention tools, and strengthen legal frameworks to address these emerging threats to individuals’ privacy, safety, and well-being.
There is a need for Technological Solutions, which develops and deploys advanced AI-based detection tools to identify and flag AI-generated deepfake content on platforms and services. And collaboration with technology companies to integrate such solutions.
Collaboration with Social Media Platforms is also needed. Social media platforms and technology companies can reframe and enforce community guidelines and policies against disseminating AI-generated explicit content. And can ensure foster cooperation in developing robust content moderation systems and reporting mechanisms.
There is a need to strengthen the legal frameworks to address AI sextortion, including laws that specifically criminalise the creation, distribution, and possession of AI-generated explicit content. Ensure adequate penalties for offenders and provisions for cross-border cooperation.
Proactive measures to combat AI-driven sextortion
Prevention and Awareness: Proactive measures raise awareness about AI sextortion, helping individuals recognise risks and take precautions.
Early Detection and Reporting: Proactive measures employ advanced detection tools to identify AI-generated deepfake content early, enabling prompt intervention and support for victims.
Legal Frameworks and Regulations: Proactive measures strengthen legal frameworks to criminalise AI sextortion, facilitate cross-border cooperation, and impose offender penalties.
Technological Solutions: Proactive measures focus on developing tools and algorithms to detect and remove AI-generated explicit content, making it harder for perpetrators to carry out their schemes.
International Cooperation: Proactive measures foster collaboration among law enforcement agencies, governments, and technology companies to combat AI sextortion globally.
Support for Victims: Proactive measures provide comprehensive support services, including counselling and legal assistance, to help victims recover from emotional and psychological trauma.
Implementing these proactive measures will help create a safer digital environment for all.
Misuse of Technology
Misusing technology, particularly AI-driven deepfake technology, in the context of sextortion raises serious concerns.
Exploitation of Personal Data: Perpetrators exploit personal data and images available online, such as social media posts or captured video chats, to create AI- manipulation violates privacy rights and exploits the vulnerability of individuals who trust that their personal information will be used responsibly.
Facilitation of Extortion: AI sextortion often involves perpetrators demanding monetary payments, sexually themed images or videos, or other favours under the threat of releasing manipulated content to the public or to the victims’ friends and family. The realistic nature of deepfake technology increases the effectiveness of these extortion attempts, placing victims under significant emotional and financial pressure.
Amplification of Harm: Perpetrators use deepfake technology to create explicit videos or images that appear realistic, thereby increasing the potential for humiliation, harassment, and psychological trauma suffered by victims. The wide distribution of such content on social media platforms and pornographic websites can perpetuate victimisation and cause lasting damage to their reputation and well-being.
Targeting teenagers– Targeting teenagers and extortion demands in AI sextortion cases is a particularly alarming aspect of this issue. Teenagers are particularly vulnerable to AI sextortion due to their increased use of social media platforms for sharing personal information and images. Perpetrators exploit to manipulate and coerce them.
Erosion of Trust: Misusing AI-driven deepfake technology erodes trust in digital media and online interactions. As deepfake content becomes more convincing, it becomes increasingly challenging to distinguish between real and manipulated videos or images.
Proliferation of Pornographic Content: The misuse of AI technology in sextortion contributes to the proliferation of non-consensual pornography (also known as “revenge porn”) and the availability of explicit content featuring unsuspecting individuals. This perpetuates a culture of objectification, exploitation, and non-consensual sharing of intimate material.
Conclusion
Addressing the concern of AI sextortion requires a multi-faceted approach, including technological advancements in detection and prevention, legal frameworks to hold offenders accountable, awareness about the risks, and collaboration between technology companies, law enforcement agencies, and advocacy groups to combat this emerging threat and protect the well-being of individuals online.
.webp)
Introduction
The recent investigation of Patan Cyber Crime Police as part of Operation Mule Hunt 2.0 reveals the sheer scale and intricacy of India's burgeoning cyber fraud economy. Police found that a total of 13 current accounts were being operated at a cooperative bank in the Patan district of Gujarat and used for siphoning 398.43 crore of cyber fraud transaction data on 228 cybercrime cases across states. Further investigations against 14 current account holders and intermediaries show the indispensability of mule accounts in laundering criminal money. The recent incident cannot be taken as isolated; the story points at a formalised and industrialised fraud economy with a robust banking infrastructure, a growing payment gateway, and complex networks.
What Is a Mule Account and Why Should You Care?
The term "mule account" is benign but plays a critical role in modern cybercrime networks. The Reserve Bank of India defines a mule account as a bank account that serves as a vehicle to transfer money proceeds from unlawful transactions and can be operated by people coerced by the prospect of high earnings or by way of inducement.
This mechanism can be witnessed through the investigation of the Patan cybercrime incident, where an investor can be defrauded by a fake investment website, employment fraud, or a digital arrest scheme. After transactions from the victim account, funds would quickly flow into the mule account, which would be held by a legitimate KYC customer. These transactions would then be passed on, between 1 lakh and 5 lakh transactions within hours, to multiple accounts as alleged by the Indian Cyber Crime Coordination Centre (I4C) before they get difficult to trace by being passed through informal channels or converted to cryptocurrency.
In the Patan case, it is alleged that the middlemen enticed locals and offered commissions to open firms and current accounts at Harij Nagrik Sahakari Bank and subsequently gave up their ATM cards, checkbooks, SIMs, and net banking facilities to the operators of the account. It is estimated that such accounts channeled an amount of 398.43 crore to 228 Indian cybercrime cases.
The Scale of India's Mule Account Crisis
The scale of the mule account ecosystem is reflected in India's rapidly worsening cybercrime statistics. As of data from the National Cyber Crime Reporting Portal (NCCRP), a total of 22.68 lakh complaints were registered in 2024, a jump by 42% from 2023. This was not even half the rate of financial loss, which jumped by 206% in 2023 (22,845 crore) and stood at 22,495 crore in 2025 (complaints jumped to 28.15 lakh). The increase in fraudulent transactions therefore outweighs the stability in financial losses significantly.
Mule accounts are the backbone of this crime network. To curb this phenomenon, the Indian Cyber Crime Coordination Centre (I4C) launched a Suspect Registry along with Indian banks and financial institutions in September 2024. 24.67 lakh accounts of suspected mules were identified in this, preventing over 8,031 crore in fraudulent transactions. Despite these efforts, a recent statement from the ED found over 12,000 crore being routed via mule accounts, shell firms, and cryptocurrency.
This isn't isolated to certain banks. 2024 alone saw over 65,000 mule accounts detected in Karnataka. By analyzing the Citizen Financial Cyber Frauds Reporting and Management System, about 40,000 such accounts were detected in SBI branches, and thousands more were detected across the PNB, Canara Bank, Kotak Mahindra Bank, and Airtel Payments Bank. The Patan case also clearly highlights that cooperative banks' lack of compliance and lower levels of transaction-monitoring systems contribute to easily creating and using mule accounts.
Operation Mule Hunt: Gujarat's Coordinated Offensive
This bust in Patan is just one manifestation of a much wider coordinated effort by the state government. Operation Mule Hunt 1.0, which ran from November to December 2025 across the state of Gujarat, was a month-long campaign by Gujarat Police's Cyber Centre of Excellence (CCOE) that unearthed 2,289 crore of fraudulent transactions, led to the registration of 565 FIRs, arrest of 638 accused, and impounding of 913 mule accounts with connections to over 4,000 cases of cybercrime nationwide.
This was followed up with the second installment of the operation, which was kicked off in all districts of Gujarat in 2026. The two-week campaign, which began across the state on January 8 this year, resulted in the Surat City Police alone arresting 77 people and uncovering close to 23.85 crore in fraudulent transactions. In what looks like one of the single largest single-district bust-ups in the operation, the Patan incident itself, with a staggering 398.43 crore routed through only 13 accounts, is remarkable.
The extraordinary nature of the operation is seen in the intelligence capabilities that drove it. It wasn't that police accidentally stumbled upon the Patan network; they worked back on it. After using data from the union government’s inter-agency platform, SAMANVAYA, a coordination platform for data on cybercrimes and the NCCRP, they traced suspicious clusters of transactions in the Harij Nagrik Sahakari Bank accounts to build a chain of evidence connecting the accountholders to the middlemen and, from the middlemen, to the whole ring of fraud. Twenty accused have been chargesheeted under the Bharatiya Nyaya Sanhita (BNS), and fourteen have been arrested, while six are still absconding.
The Human Cost Nobody Talks About
Behind every crore of scam money lies a real person who actually lost the real money. Of the 75%+ fraud losses incurred in 2025, 75% are from investment scams alone. Victims of stock trading scams lost ₹4,636 crore, spread across 2.28 lakh complaints filed in 2024. "Digital arrest" scams, in which fraudsters posing as law enforcement officials psychologically blackmail the victims to transfer money, claimed ₹2,576 crore between 2022 and the first quarter of 2025.
For the victims it's never about the money: it's the retired teacher's lifetime savings from Chhattisgarh, the small trader's capital from Rajkot, the emergency money of the Bhopal family, or just savings from an ordinary person. And the mule accounts' networks are why most of it is never retrieved. Once the money is thrown into the layering chain, it's exponentially more difficult to trace it after every jump.
Then there's another category of victims that often gets overlooked, and they are the mule account holders themselves, many being semi-literate people from semi-urban or rural backgrounds approached with ₹10,000 in commission and with no awareness about the legalities of lending their bank details. With the BNS now they stand to get convicted for grave crimes, but the awareness of this trap is very low.
Recommendations and Suggestions
This isn't something India is facing passively. I4C, along with RBI, has developed Mule Account Hunter software. This software can be used by banks for the detection of suspect accounts through the use of behavioral analysis, device intel, and transaction pattern recognition. The Union Home Minister has directly asked all cooperative banks across the country to adopt this software at the earliest. Failure to do so, he warned, would make consumer safety from cyber fraud incomplete.
Apart from technology, three other areas need to go hand in hand: stringent KYC enforcement for cooperative and small finance banks; the prime locations of the mule recruitment network; greater awareness for the masses regarding the criminal liability one takes up when lending their accounts; and efficient inter-agency coordination so that the intelligence gathered on platforms like SAMANVAYA is converted into arrests before the accounts are dumped and the network reforms in another location.
Operation Mule Hunt 2.0 proves that this is feasible. 13 accounts in a small district of Gujarat. 398 crore. 228 victims. 14 arrested. The pipeline did exist, and it has been broken.
Yet, even as one network is broken, another is forming, somewhere right now. The accounts will appear legitimate. The holders of these accounts may not even realize what they have got into. That is the true danger of the mule accounts and work that cannot stop.
Conclusion
The Patan investigation has clearly shown that mule accounts have now moved from being a subsidiary tool of financial crime to becoming the infrastructure that underpins the economy of cyber-fraud in India. Every financial fraud, including investment fraud, digital arrest fraud, and phishing scams, is backed by a string of real bank accounts where the proceeds of crime are transferred and the trail is obscured. Though attempts such as the I4C Suspect Registry have made attempts to break down this network, it remains an overwhelming task. Robust KYC norms, real-time monitoring of transactions, and coordination between banks, police, and regulators are the key in preventing further industrialisation of cyber financial fraud in India.
References
- https://timesofindia.indiatimes.com/city/ahmedabad/operation-mule-hunt-2-0-gujarat-
- police-bust-rs-398-43-crore-cyber-fraud-14-held/articleshow/131594240.cms?utm_source=contentofinterest&utm_medium=text&utm_campaign=cppst
- https://the420.in/india-cybercrime-2024-42-percent-spike-sims-imei-mule-accounts/
- https://www.thehansindia.com/news/national/ed-explains-how-mule-accounts-and-crypto-networks-enabled-12000-crore-cyber-fraud-1047606
- https://www.zigram.tech/article/mule-accounts-tier-1-tier-2-cities-india/
- https://risk.lexisnexis.com/global/en/insights-resources/article/stopping-money-mules-in-india
- https://timesofindia.indiatimes.com/city/ahmedabad/operation-mule-hunt-2-0-gujarat-police-bust-rs-398-43-crore-cyber-fraud-14-held/articleshow/131594240.cms
Introduction
India is becoming more digital. People are using cards and phones to pay for things. This means there is a risk of people stealing card information and committing fraud. The Payment Card Industry Data Security Standard or PCI DSS is a set of rules that helps companies keep card information safe. It was created by the PCI Security Standards Council, which was started by Visa, Mastercard, American Express, Discover and JCB. The goal of PCI DSS is to reduce the risk of data breaches and card fraud by making sure companies have security controls in place. For India, where digital payments are becoming more popular, PCI DSS is becoming a thing to do.
Applicability in India
PCI DSS applies to all companies in India that store, process or transmit card information. This includes banks, payment companies like Razorpay, PayU and CCAvenue and online sellers. Even companies that use a hosted payment page are responsible for following the rules. Companies that have their payment forms and handle card information have to follow more rules.
Why PCI DSS Matters
Payment security is very important for customers to trust a company. If a company has a security breach it can expose a lot of card information. Damage the company's reputation. In India, where cybercrime's a big problem, PCI DSS helps companies keep card information safe. It has rules for firewalls, encryption, access controls and regular testing to prevent fraud.
Regulatory Landscape: The RBIs Role
PCI DSS is not a law in India. The Reserve Bank of India or RBI has made it a requirement. The RBI has rules that require companies to follow PCI DSS and have security audits. Non-bank companies have to get permission from the RBI and follow rules to store payment information in India. This makes PCI DSS a standard for keeping card information safe in India.
Key Requirements and the Compliance Process
The current version of PCI DSS has twelve requirements that companies have to follow. These requirements include building a network protecting card information and regular testing. Companies have to start by identifying what parts of their system handle card information. Then do a gap analysis to see what they need to do to comply. Smaller companies can usually do this in a week but bigger companies may take several months.
Common Challenges and Practical Solutions
Some problems companies face when trying to comply with PCI DSS include old computer systems that cannot handle modern encryption and unclear rules that make it hard to know what to do. Some solutions include separating the card information system from the rest of the network using tokens and encryption to keep card information safe and regularly checking for vulnerabilities.
Business and Regulatory Benefits
Following PCI DSS rules can help companies avoid penalties and have security breaches. It can also make it easier for companies to work with banks and card networks and build trust with customers. Regulators also look favorably on companies that follow the rules.
Recent Developments and Trends
The RBI has been making rules and requiring companies to follow PCI DSS more closely. As digital payments become more popular it is likely that the RBI will keep making rules to keep card information safe.
As India's digital economy grows, keeping payment information safe is becoming more important. PCI DSS is a set of rules that helps companies keep card information safe. The RBI has made it a requirement for companies to follow these rules. Companies that follow the rules can build trust with customers. Avoid security breaches.
Conclusion
As India's digital economy deepens, protecting payment data is no longer optional; it is the price of participating in the card ecosystem. PCI DSS gives banks, fintechs, gateways and merchants a common, internationally recognised language for security, while RBI's guidelines add local regulatory teeth. Organisations that treat compliance as a continuous discipline, rather than a once-a-year audit exercise, will find it easier to earn customer trust, avoid costly breaches, and scale with confidence. For every business touching cardholder data in India, the message is clear: PCI DSS compliance is now foundational to running a secure, trustworthy digital payments operation.
References
- https://www.pcisecuritystandards.org/document_library/
- https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx
- https://www.rbi.org.in/Scripts/NotificationUser.aspx
- https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11822
- https://www.incorpx.io/blog/pci-dss-compliance-ecommerce-fintech-india
- https://cyraacs.com/pci-dss-compliance-checklist
- https://www.skydo.com/blog/pci-dss-compliance-guide
- https://www.cybercrime.gov.in/
