II
Pension Fund Regulatory and Development Authority(Central recordkeeping agency) Regulations, 2015[See regulation 10 (1) (g)]Code of ConductThe central recordkeeping agency shall, -(1)Act with integrity, competence, diligence, respect, and in an ethical manner with all intermediaries and subscribers under the National Pension System or other pension scheme regulated by the Authority.(2)Exercise professional diligence while dealing with subscribers, which implies a standard of skill and care that is commensurate with honest market practice, good faith and the different profiles of consumers.(3)Prohibit from indulging in unfair conduct, which includes conduct that is misleading or abusive, while dealing with subscribers. The unfairness of any conduct shall be gauged based on whether it interferes with the ability of the subscriber to make an informed transactional decision.(4)Shall not disclose private/confidential information unless the prior written informed consent of the subscriber has been obtained, or the disclosure is required under law or in other identified circumstances(5)Have appropriate internal mechanisms to redress consumer complaints and consumers should be adequately informed of such mechanisms(6)Place the interests of the National Pension System and its subscribers above their own personal interests.(7)Be loyal to the National Pension System and use reasonable care and exercise independent professional judgment while executing its roles and responsibilities under the National Pension System.(8)Make full and fair disclosures of all matters that shall reasonably be expected to impair its independence and objectivity or interfere with its duties to the National Pension System. Central recordkeeping agency must ensure that such disclosures are prominent, are delivered in plain language, and communicate the relevant information effectively to Authority or National Pension System Trust.(9)Maintain independence and objectivity by, among other actions, avoiding conflicts of interest, refraining from selfdealing, and refusing any gift that shall reasonably be expected to affect their loyalty to the National Pension System.(10)Abide by all applicable laws, rules, and regulations, including the terms of the documents under National Pension System.(11)Maintain confidentiality and protection of National Pension System and subscriber information.(12)Communicate with subscribers (as may be applicable) and supervisory authorities in a timely, accurate, and transparent manner.
III
Pension Fund Regulatory and Development Authority(Central recordkeeping agency) Regulations, 2015[See regulation 18 (2) (c) ]Infrastructure RequirementsThe following Infrastructure requirements are indicative and shall be subject to change in line with emerging technologic requirements as may be specified by the Authority.(1)Network Requirement. - All the components of the central recordkeeping agency network solution and the software application should be designed with resilience to maintain the 24x7 services to all the stakeholders. A checklist of resilient equipment and component should be mentioned by the central recordkeeping agency. It is the responsibility of the central recordkeeping agency to design and deploy a network to ensure 24x7 services of the software application. The functional aspects of the technical infrastructure architecture are given below, but the central recordkeeping agency is expected to give the detailed solution. Response expected from central recordkeeping agency's with regard to network solution should include the following. -(b)Detailed Network diagram showing major components of the solution;(c)LAN and WAN components;(d)Connectivity and technical specifications with regard to connectivity;The network solution may be designed on the scope and guidelines given below.-(a)Design, installation & commissioning of the LAN and WAN;(b)The scope of work will also include IP addressing, planning for Redundancy & Security, etc. for various locations of user access as specified by Authority;(c)Maintenance of network links between the stakeholders and the central recordkeeping agency's data center shall be the responsibility of the central recordkeeping agency.(i)The bandwidth requirements for meeting the Expected Performance Requirement should be carefully assessed by the central recordkeeping agency's;(ii)The special requirements of the bandwidth at peak-times on peak-dates have to be assessed for performance complying with the Expected Performance Requirements;(iii)Redundancy in the form of alternative lines of connectivity like leased lines, ISDN, OFC, RF Links etc. will have to be provided for;(iv)An efficient system of monitoring the network performance and availability should be instituted for 24x7 functioning;(v)Internet bandwidth requirements at the Data Center will also have to be assessed by the central recordkeeping agency's so as to ensure compliance with the expected performance level;(d)All the Networking Elements (Routers, Switches and Firewall) should be from the same or compatible OEM;(e)Local Area Network connectivity, -(i)central recordkeeping agency shall design the complete LAN architecture for the application;(ii)central recordkeeping agency's has to plan and design the structured cabling and power cabling and all related works for the successful installation and commissioning of the LAN.(f)IP addressing, -(i)central recordkeeping agency has to design the IP-addressing schemes for the LAN and the WAN;(ii)central recordkeeping agency needs to design IP addressing keeping in mind the implementation of a Disaster Recovery location also.(g)Network Redundancy and Security, -(i)central recordkeeping agency must consider in the design that redundancy should be available at all critical points of the network;(ii)central recordkeeping agency must make sure that all primary links shall be properly backed up as required in the document;.(iii)central recordkeeping agency shall ensure by proper and careful design of necessary configuration & security policies for the LAN and WAN networks.(h)central recordkeeping agency has to be responsible for provisioning of the required connectivity services for successful and timely implementation between the Authority's location/s and its premises. It will be responsible for all service related issues which may arise with the bandwidth provider, -(i)central recordkeeping agency has to submit all relevant documents pertaining to the entire network, for Remote Management of the Network. This should minimally cover the User Manuals, Operation Manuals, Manufacturer Supplied Technical Documentation, Configuration of all the Network Devices, all relevant diagrams/documentation required in hard copy as well as soft-copy;(ii)central recordkeeping agency should provide free-of-cost orientation training for two man weeks to concerned officers of the Authority or its identified personnel in operation, testing, maintenance of hardware and software of the network equipment, interconnection details of attached hardware, general network capabilities and technologies involved and configuration and troubleshooting of the equipment.(2)Call center. - The subscribers of National Pension System are spread across the length and breadth of the country. In order to provide better service to them the Authority requires that the central recordkeeping agency should establish an Inbound Call Center with the following service features. -(a)Separate Toll free numbers for institutions and subscribers;(b)Interactive voice response or IVR;(c)Hindi / English speaking customer service executives;(d)Scaling up on pro-rata basis to meet the subscriber needs;(e)The average wait time for a caller should never exceed 3 minutes.However, Authority may direct central recordkeeping agency on extending further services or scaling up. The Call Center strategy, delineated below, attempts to provide the right kind of services to the subscribers spread across the nation. It should be possible to scale up each component as and when growth in demand occurs. Key requirements from call centre are provided below. -(a)There should be a response and identification system wherein the caller will be guided through the call login process and send his identification for verification using a unique T Pin;(b)It should use the same database and complaint registering software which is used for call logging on the internet;(c)There should be provision for operator assistance and call escalation;(d)There should be strict adherence to declared service levels and it should be monitored by designated personnel;(e)Authority may if it deems fit appoint an external agency to audit the security and compliance of the service levels.(3)Data center. - The Data Center is the central engine on which depends the quality of services to the stakeholders. Its design, implementation and management should be well conceived by central recordkeeping agency. The data center should provide the following. -(b)Standard technologies;(c)Guaranteed service levels;(d)High quality support, operation and monitoring of the application;(e)Data and Application availability seven days a week, twenty-four hours a day;(f)Centralized network management and operations capability;(g)Facility for centralized management of enterprise client/server systems;(h)Custom Security options, Multiple security levels;(i)Backup and Archival Services;(4)Space/rack requirement. - The requirement of rack space should be assessed and proposed by the central recordkeeping agency with a plan to store and maintain master and transaction data.(5)Bandwidth Requirement. - The requirement of bandwidth should be assessed and proposed by the central recordkeeping agency in tune with the requirements taking into consideration the various redundancy mechanisms required to maintain service level compliance and uptime needs as specified by Authority.(6)Data center related scope of services. - The services required amongst other would fall under the following category. -(a)Server & application hosting;(b)Performance optimization(7)Disaster recovery center. - The Business Continuity Solution for central recordkeeping agency system should ensure delivery of services to the stakeholders in the event of complete failure of the central recordkeeping agency Data Centre. The DR site must be invoked automatically when the production site fails to provide its services. Central recordkeeping agency is required to submit a detailed architecture and components of the DR solution. DR site shall be setup and maintained by the central recordkeeping agency.The following are the requirements of the DR site. -(a)The DR site should be designed as the backup (mirror) site to the production site,(b)central recordkeeping agency has to offer an optimized, connectivity solution from the central recordkeeping agency application site to the DR Site;(c)The DR Site needs to deploy the entire central recordkeeping agency application solution;(d)central recordkeeping agency needs to ensure that the DR Site is kept current with the latest version of the application builds, and all solution components;(e)central recordkeeping agency shall simulate routine tests to ensure that the fail-over to the DR Site happens, without any service downtime. central recordkeeping agency may consider running all services and transactions off the DR Site, at least once in three months, on a non-peak day;(f)central recordkeeping agency will have to perform DR drills every quarter of the year;(8)Backup and recovery. - Considering the magnitude of operations and the criticality of the data handled by central recordkeeping agency, the central recordkeeping agency has to ensure business continuity plan be put into place. For continuity of operations the Applicant needs to propose a solution for a replication site and regular risk assessment strategies. The Applicant shall put in place. -(a)A documented back up strategy and recovery wherein back up schedules and responsibilities are clearly laid out at an organization level;(b)The back-up media should be stored in a secured place and any incidence occurring due to misplacement of media should be immediately reported to Authority;(c)There should be a regular and updated anti-virus strategy;(d)All archival media should be stored in suitable facilities and one copy each of media should be stored in fire proof facilities in the premises;(e)There should be a copy of media stored outside the premises;(f)There should be regularly scheduled restore facilities to test the health of the archive backups and the media;(g)Back up log should be maintained for a period of two year;(h)All systems - applications, data tuned parameters and critical hard copy documents would be regularly backed up;The Authority may if it deems fit conduct an audit of the backup media through its officers or through an external agency.(9)Disaster recovery plan. - Central recordkeeping agency must ensure the following. -(a)There should be a documented disaster recovery and business recovery plan with regards to its operations;(b)The Applicant must have a replication site at a location not in the physical proximity of the premises;(c)The Applicant must ensure near real time replication of the transaction data of the live server;(d)The replication site should be hosted with the same physical and technical security requirements as the primary sites;(e)There should be a documented escalation process and designated personnel who shall be responsible for contact and action in case of disaster;(f)There should be routine disaster response drills, the reports of which should be communicated to Authority every three months.(g)All systems should be adequately covered by insurance;The Authority may if it deems fit conduct an audit of the DR site through its officers or through an external agency.