VSAT to 4G/LTE migration for ATMs in India
To move ATMs from VSAT to 4G/LTE, banks and ATM operators replace the satellite terminal with an industrial dual-SIM router on two mobile operators. ATM traffic runs in encrypted IPsec tunnels over a closed-user-group private APN, and sites roll out in waves with zero-touch provisioning. Bank RFPs already define the pass mark: SBI's April 2022 RFP for 4G connectivity to about 15,000 off-site ATMs asks for 99.50% uptime, end-to-end latency of 100 ms or less and jitter of 10 ms or less. Nexapp has moved 2,500 ATM sites from VSAT to dual-LTE this way.
Key facts
| Typical bank uptime target | 99.50% for ATMs, 24×7 (SBI offsite ATM RFP) |
| Latency / jitter targets | ≤100 ms end to end over 1,000 packets; ≤10 ms jitter (SBI) |
| Minimum signal | ≥ -80 dBm (SBI) |
| Network model | Closed user group (private APN), single or multi-operator SIMs |
| Device class | SNMPv3-managed industrial routers; "retail products like USB dongle and home use router" not allowed (SBI) |
| Nexapp proof | 2,500 ATM sites moved from VSAT to dual-LTE with day-1 zero-touch provisioning |
Why banks are moving ATMs off VSAT
VSAT served India's off-site ATMs well where there was no wired link. Three things have changed.
- Bandwidth needs have grown. ATMs now carry software updates, video surveillance feeds and remote monitoring alongside transactions. In Nexapp's 2,500-ATM migration, sites gained more than double the bandwidth they had on VSAT.
- Cloud and data-centre architectures. Banks want each ATM to reach cloud services and their switch directly, without routing everything through a satellite hub.
- 4G coverage. Mobile networks now reach most ATM locations, and two operators at one site give path diversity that a single satellite link does not.
A note on cost: VSAT and 4G costs depend on each bank's contracts, so we do not quote a generic saving. Build the comparison per ATM per month from your own VSAT invoices, SIM tariffs, router cost and managed-service fees.
What Indian bank RFPs ask for
SBI's April 2022 RFP for 4G LTE connectivity to about 15,000 off-site ATMs is a useful benchmark because it turns expectations into measurable clauses (SBI RFP):
- Closed user group: the network "should be a closed user group for Bank and should not have any physical and logical interference with other customers of the service provider or Internet route/traffic".
- Multi-operator SIMs: single or multi-SIM, with multi-SIM "from Different SP".
- Bandwidth: committed rate up to 2 Mbps, and never below 128 kbps.
- Performance: 99.50% uptime, latency of at most 100 ms, jitter of at most 10 ms, packet loss below 10 in 1,000, signal of at least -80 dBm.
- Security: SHA-2 or stronger, DH Group 5 or above, perfect forward secrecy, encrypted management traffic from a dedicated interface, and protection against DoS, replay and rogue IPsec gateways.
- Manageability: SNMPv3 or higher and no retail-grade hardware.
- Resilience: ATMs must keep working "in case of internet suspension by the government or by use of jammers".
One clarification matters: these are bank requirements, not RBI rules. No RBI instruction mandates dual-SIM or LTE for ATMs. RBI does require payment system data to be stored only in India (April 2018), which makes the location of your router controller and logs a gating question (RBI FAQ).
Reference architecture
A typical design has four parts.
- At the ATM: an industrial router with two cellular modules, or one module with dual-SIM arbitration, each SIM from a different operator. Nexapp's IR11004GD and IR11004GDW are dual-module routers in the Instaroute Lite Series; the router picks the active SIM by signal, latency or data usage.
- Transport: private APN / closed user group on each operator, with IPsec IKEv2 tunnels from each ATM to the bank's data centre and DR hub. Instaroute routers take the operator's APN as a per-site variable in the SDWAN Lite 2.0 template, with SIM PIN lock and per-modem keepalive.
- Management: a central platform for zero-touch provisioning, alarms and firmware. Instaroute SDWAN Lite 2.0 scales to 100,000 devices per deployment, runs Nexapp-hosted in India or self-hosted in the bank's DC, and manages devices out of band without a public IP.
- Segmentation: ATM traffic in its own zone, separate from branch and corporate networks, which supports the secure-interconnection requirements of the RBI Directions of 31 July 2026 (DSCI).
A 7-step migration playbook
- Survey signal before you ship hardware. Measure signal strength and latency for at least two operators at every ATM. Sites weaker than -80 dBm need an external antenna (with a lightning conductor, as SBI specifies), an outdoor unit such as the IR1105-ODU-4G, or a different carrier mix.
- Agree the pass criteria. Write down uptime, latency, jitter and packet-loss targets per site, and how they are measured, before the pilot.
- Pilot a representative set of sites. Mix urban, semi-urban and rural locations. Run 4G alongside VSAT and compare.
- Pre-stage with zero-touch provisioning. Import router serial numbers by CSV into the management platform. Engineers on site just mount the router and insert SIMs; each device admits itself by serial number and pulls its configuration on power-up. Nexapp's 2,500-ATM rollout used day-1 zero-touch provisioning.
- Cut over in waves. Move sites region by region. Keep VSAT live until each site passes acceptance tests, then decommission it.
- Roll firmware carefully. Use canary rollouts: update a small group, watch alarms, then continue or roll back.
- Hand over to 24×7 operations. Set alarm rules for signal, latency and SIM switches, and connect the NOC to the bank's ticketing system through the platform's REST API.
Internet suspension, jammers and weak signal
The SBI clause on suspensions and jammers is the hardest to answer. A cellular link depends on the operator's network, so plan for it explicitly:
- Ask each operator, in writing, whether its private APN / closed-user-group service stays up during public internet suspensions.
- At high-risk sites, keep a third path such as wired broadband or retained VSAT.
- Monitor SIM switches and signal drops centrally so the NOC sees an outage pattern before customers do.
Security and compliance
- Encryption: IPsec IKEv2 tunnels with hybrid post-quantum key exchange (ML-KEM, NIST FIPS 203) on Nexapp routers. Check that tunnel settings also meet your RFP baseline, such as SBI's SHA-2, DH Group 5 or above, and PFS; Instaroute IPsec supports AES-GCM, SHA-2 and DH groups 14–16. Harvest now, decrypt later is a real concern for payment data with a long confidentiality life.
- Firmware: signed NexappOS firmware, so ATMs run approved images.
- Logs: CERT-In's 2022 Directions require ICT logs kept for 180 days within India and incident reports within 6 hours (Internet Society). Keep router and management logs in India, Nexapp-hosted or in your own DC.
- Reporting: the RBI Directions of 31 July 2026 require 6-hour incident reporting to RBI through DAKSH (KPMG India). Central alarms help your team detect and report quickly.
Proof: 2,500 ATMs moved to dual-LTE
Nexapp moved 2,500 ATM sites from VSAT to dual-LTE with day-1 zero-touch provisioning. The result: more than double the bandwidth, direct cloud connectivity and higher uptime.
Sources
SBI 4G LTE offsite ATM RFP (2022); RBI payment data storage FAQ (2018); CERT-In Directions (28 Apr 2022) via Internet Society; RBI Directions (31 Jul 2026) via DSCI and KPMG India.
Frequently asked questions
How long does it take to migrate thousands of ATMs from VSAT to 4G?
The pace is set by your field teams, not by configuration.
With zero-touch provisioning, each site visit is limited to mounting the router and inserting SIMs, so the rollout moves as fast as the site survey, SIM logistics and field capacity allow.
Is 4G reliable enough for ATMs?
With two operators, dual-SIM arbitration and central monitoring, 4G can meet bank targets such as SBI's 99.50% uptime.
Survey each site and add a third path where signal is weak.
Does RBI require dual-SIM routers for ATMs?
No. Dual-SIM and multi-operator requirements come from bank RFPs.
RBI does require payment system data to be stored in India, which affects where your management platform and logs sit.
What is a private APN / closed user group?
A private APN keeps ATM traffic on a dedicated operator network segment, separate from other customers and the public internet.
SBI's RFP requires this.
Can we keep VSAT as a backup?
Yes. Many banks keep VSAT or wired broadband at high-risk sites as a third path during migration or permanently.
Where are the router controller and logs hosted?
With Nexapp, in India when Nexapp hosts, or in your own data centre when you self-host.
Planning an ATM migration? Get the reference design and a site-survey checklist.
24×7 NOC in Pune · 75,000+ devices deployed · 400+ enterprise and banking customers since 2014.