Secure networks for banks, NBFCs and ATM operators
Secure SD-WAN, NGFW, ZTNA and industrial 4G/5G routers for branches, ATMs and remote users, with controllers in your own DC and DR or hosted in India.
Key facts
- 2,500 ATM sites moved from VSAT to dual-LTE with day-1 zero-touch provisioning: more than double the bandwidth, direct cloud connectivity, higher uptime.
- 400+ enterprise and banking customers, 75,000+ devices deployed, in production since 2014.
- BFSI customers include NABARD, India1 ATM, Aadhar Housing Finance and Sarvatra.
- ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018 certified; 24×7 NOC in Pune.
- Controller in your DC and DR, with controller HA and DC–DR replication, or Nexapp-hosted in India.
- End-to-end post-quantum: hybrid ML-KEM key exchange (FIPS 203), ML-DSA authentication (FIPS 204), signed firmware, post-quantum TLS, and a CBOM.
What banks ask for, and what you get
Your RFP sets pass-or-fail clauses. Indian bank SD-WAN and ATM tenders are specific. Here is what you get against the most common requirements.
| What bank RFPs typically require | What you get |
|---|---|
| Transport-agnostic overlay across MPLS, ILL, broadband, LTE and VSAT; SD-WAN and legacy sites interoperating during migration | Hybrid WAN on the Nexapp Controller; hub-and-spoke, full-mesh (ADVPN) or site-to-site |
| Integrated VPN, firewall and IPS on the branch CPE | IPS, gateway antivirus, web filtering, anti-spam and InstaShield IP on the edge |
| Central management console and orchestrator in the bank's DC and DR, in HA | Self-hosted Controller with controller HA and DC–DR replication |
| Zero-touch provisioning | Serial-based zero-touch admission; config snapshots, diff and rollback |
| 180-day log retention; archive to bank storage | Retention set to your policy; syslog export to your SIEM or archive (RFC 5424 on SDWAN Lite 2.0) |
| Role-based access, TACACS+/RADIUS, SSH restricted to trusted hosts | TACACS+ and RADIUS; role-based access; on routers, SSH and other management services enabled per interface, WAN admin access off by default, plus ACLs |
| IPv4/IPv6 dual stack on underlay and overlay | IPv6 dual-stack on Instaroute router ports, with IPv4/IPv6 static routes and dual-stack IPAM |
| SASE-ready from day one | Same platform extends to Nexapp SSE (ZTNA, SWG, CASB, DLP, FWaaS) |
| Primary and secondary NOC in India, ISO 27001 | 24×7 NOC in Pune |
| No end-of-life for at least 7 years | End-of-life policy: coming soon |
| OEM-certified design on letterhead | On request |
Branches: secure SD-WAN with local breakout
When a branch link drops mid-morning, your tellers cannot post transactions. Your branches keep MPLS where needed and add broadband and 4G/5G under one encrypted overlay. Application-aware steering and sub-second SLA failover keep core banking and payments on the best path. VRF keeps your core banking, ATM, CCTV and guest traffic in separate segments.
ATMs and kiosks: dual-LTE on industrial routers
An ATM on one weak link goes offline with it. Instaroute routers give each of your ATMs two cellular links, SNMPv3 management and encrypted tunnels. You need no retail dongles or home routers. Our reference design is the 2,500-ATM VSAT-to-dual-LTE migration. See the full migration approach on the ATM solution page.
Remote users and vendors: ZTNA instead of VPN
Your staff, auditors and vendors need access, but not to everything. With Nexapp SSE, they reach named applications only, from devices that pass a posture check. You get passkey sign-in and a full session log. This helps you meet the telework and access-control expectations in the 2026 RBI Directions.
Regulatory obligations we help you meet
No regulator approves a network vendor. The obligations sit with your bank or NBFC. We give you controls and evidence that support them.
| Your obligation | How we help you meet it |
|---|---|
| RBI Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions (31 Jul 2026), issued separately for commercial banks, SFBs, payments banks, UCBs, NBFCs, AIFIs and credit information companies | MFA for privileged and remote access (ZTNA with posture checks), strong current cryptography on every IKEv2 tunnel, reviewed network configurations (VRF, zone firewall, DMZ), and logs exported to your SOC. Read the guide |
| 6-hour incident reporting to RBI (DAKSH) and to CERT-In | Central alarms, security events and session logs that speed your investigation |
| CERT-In Directions (2022): 180-day ICT logs within India; NIC/NPL time sync | India-hosted or self-hosted management and logs, with retention set to your policy; NTP servers set centrally, so your devices can sync to NIC or NPL time sources |
| RBI storage of payment system data (2018): stored only in India | Management and log data hosted by us in India or self-hosted in your DC |
| RBI expectations on outsourced IT, including network and security services: audit rights, incident notice, exit plans | On request |
| DPDP Rules 2025, substantive duties from about May 2027 | Encryption, access control and access logs you can keep for at least a year |
| SEBI CSCRF (for SEBI-regulated entities) | Network security, logging and SOC-integration evidence for your audits |
Check which 2026 Direction applies to your entity type. Sources differ on which earlier instruments each Direction replaces. So we map controls to the Direction you name.
Preparing for quantum-safe banking
Traffic you send today can be recorded now and decrypted later. In September 2026 an RBI Deputy Governor called on payment system providers and network operators to begin moving payment systems to quantum-safe cryptography. RBI also formed an expert committee on a quantum-secure financial ecosystem. There are no binding RBI dates yet, so you can start early. You get hybrid post-quantum key exchange (ML-KEM, NIST FIPS 203) on every IKEv2 tunnel, from ATM routers to SSE and the management plane. You also get ML-DSA authentication, post-quantum-signed firmware, post-quantum TLS 1.3 and crypto-agility. A CBOM shows which algorithms are in use. That supports the 2026 Directions' requirement for strong, non-deprecated cryptography. It protects you against harvest-now, decrypt-later.
How we work with banks
Your large RFPs set high turnover and reference thresholds for bidders. So we usually work as the OEM behind your system integrator or managed service partner. We take part in design, head-end build and the first rollout wave. Our NOC is available for your day-2 operations.
Related guides
Frequently asked questions
Can the SD-WAN controller run in our own data centre and DR?
Yes. The Nexapp Controller can be self-hosted in your DC and DR, with controller HA and DC–DR replication.
You can also run it Nexapp-hosted in India.
Will our logs stay in India for 180 days?
Management and logs are hosted by us in India or self-hosted, so they stay in India.
Retention is configurable, so logs can be kept for 180 days or longer. Logs export to your SIEM over syslog. This helps you meet CERT-In's 180-day retention requirement.
Is Nexapp RBI-approved?
RBI does not approve network vendors.
We help you meet the July 2026 Directions with segmentation, MFA-based access, logging and a CBOM. We map our controls to the Direction for your entity type.
How do you support 6-hour incident reporting?
Central alarms, security events and session logs give your SOC the evidence it needs quickly.
On managed services, our 24×7 NOC notifies you of incidents.
Is Nexapp quantum-safe for banks?
Every IKEv2 tunnel and TLS 1.3 session uses hybrid post-quantum key exchange (ML-KEM, FIPS 203).
You also get ML-DSA authentication and post-quantum-signed firmware. RBI has no binding post-quantum requirement yet, so this is early preparation, not a regulatory checkbox.
Share your RFP or branch and ATM count, and we will map every clause.
24×7 NOC in Pune · 75,000+ devices deployed · 400+ enterprise and banking customers since 2014.