Trade Finance BD · Original revision handnote · Edition 2026.1
ICTFI — Information and Communication Technology in Financial Institutions
AIBB · Compulsory · 14 October 2026
Explain banking systems, payment infrastructure, cybersecurity and responsible technology adoption.
Use this revision pack with the full syllabus and official papers. Important topics are revision priorities, not a promise of future questions.
Contents
- A · ICT foundations and digital services
- B · Infrastructure and continuity
- C · Delivery channels and international messaging
- D · Cybersecurity and governance
- E · Payment and enterprise applications
- F · Emerging technology and responsible adoption
- Worked example
- Applied case and model response
- Terminology
- Official syllabus and papers
Revision priorities
Cybersecurity, payment channels and continuity — Syllabus priority. Editorial judgement based on syllabus importance.
AI, cloud, regtech and technology governance — Syllabus priority. Editorial judgement based on syllabus importance.
Syllabus-mapped handnotes
Module A
ICT foundations and digital services
Syllabus scope: Hardware; software; internet; e-commerce; digital banking; MFS
Hardware performs computing and communication functions; software defines instructions and workflows. Distinguish applications, operating systems, databases and networks. Digital banking extends access through connected channels but still requires reliable identity, authorisation, accounting and service support. E-commerce combines ordering, payment and fulfilment, each with different risks. Technology value should be assessed through service quality, efficiency, inclusion and resilience rather than novelty. A digital interface can conceal manual back-office work; analyse the entire process before calling it automated.
Apply it in bankingA mobile loan application can improve access while weak identity checks increase fraud. Evaluate both the customer journey and the control journey.
Practice question: Explain how ICT changes banking services and identify the controls that remain necessary.
Answer framework: use the explanation above, add the banking example, then address assumptions and controls. Expand to match the question’s marks and command words.
Module B
Infrastructure and continuity
Syllabus scope: Data centres; near/DR sites; networks; storage; databases; backups; core banking; switches; gateways
A core banking system records customers, balances and transactions; a switch routes payment messages; a gateway links service providers. Databases need consistency, access control and recovery. Backups are copies; disaster recovery is the tested ability to restore service with dependencies and authorised data. Recovery time objective states acceptable downtime; recovery point objective states acceptable data loss measured in time. Geographic separation and redundancy reduce some risks but do not resolve corrupt data or shared credentials. Test failover, restoration and reconciliation rather than checking only that a backup job ran.
Apply it in bankingA ransomware event affects production and accessible backups. Use protected backup arrangements and a tested restoration process with an independent integrity check.
Practice question: Design a resilient banking infrastructure and distinguish backup from disaster recovery.
Answer framework: use the explanation above, add the banking example, then address assumptions and controls. Expand to match the question’s marks and command words.
Module C
Delivery channels and international messaging
Syllabus scope: ATM/CDM/CRM; POS; cards; MFS; agent; biometrics; call centre; transfers; SWIFT; CHIPS; Fedwire
Channels differ in customer interaction, transaction limits, settlement, cash handling and fraud exposure. ATM cash withdrawal and POS purchase authorisation rely on controlled card and account processing. Agent banking expands reach but requires agent due diligence, liquidity, supervision and customer protection. Biometrics can support authentication but introduce privacy, liveness and recovery concerns. SWIFT primarily provides financial messaging; it is not identical to the transfer of settlement funds. International payment arrangements involve correspondent accounts, clearing and settlement networks with distinct roles and obligations.
Apply it in bankingA genuine SWIFT message may still represent an unauthorised instruction if credentials were compromised. Apply independent approval and reconciliation controls.
Practice question: Compare delivery channels and explain why a payment message is different from settlement.
Answer framework: use the explanation above, add the banking example, then address assumptions and controls. Expand to match the question’s marks and command words.
Module D
Cybersecurity and governance
Syllabus scope: Cyber risk; BB instructions; PCI DSS; ISO 27000; applicable law; incident controls
Cybersecurity protects confidentiality, integrity and availability. NIST CSF 2.0 organises outcomes through Govern, Identify, Protect, Detect, Respond and Recover; use the current six-function framework rather than the older five-function list. Controls include least privilege, multifactor authentication, patching, segmentation, logging and tested response. PCI DSS concerns payment-card security within its scope; an ISO management-system certification has a defined scope and does not prove that every system is secure. Manage third-party dependencies and verify that controls operate effectively. Apply current local regulatory and legal requirements alongside international frameworks.
Apply it in bankingIf a vendor has remote access, define the authorised purpose, time, permissions, monitoring and revocation. A service contract alone is not an access control.
Practice question: Prepare a cybersecurity framework for a bank and explain the six NIST CSF functions.
Answer framework: use the explanation above, add the banking example, then address assumptions and controls. Expand to match the question’s marks and command words.
Module E
Payment and enterprise applications
Syllabus scope: MICR; cheque clearing; BACH/BACPS; BEFTN; RTGS; ERP; CRM; email; antimalware
MICR supports machine-readable cheque identification; image-based clearing still requires cheque validity and duplicate checks. EFT and gross-settlement arrangements have different processing and liquidity characteristics. ERP integrates enterprise resources and accounting; CRM supports customer relationships and service records. Integration requires controlled data mapping, reconciliation and exception handling. Email security combines technical filtering with identity verification and staff awareness. Antimalware is one layer; it cannot compensate for unrestricted access, unpatched systems or poor recovery. Explain what each application does and where its financial or operational risk arises.
Apply it in bankingWhen two systems show different balances, identify the authoritative record, transaction identifiers and reconciliation breaks before making an adjustment.
Practice question: Explain payment-system and enterprise-application controls with a reconciliation example.
Answer framework: use the explanation above, add the banking example, then address assumptions and controls. Expand to match the question’s marks and command words.
Module F
Emerging technology and responsible adoption
Syllabus scope: Fintech; regtech; AI/ML; blockchain; crypto; cloud; IoT; data mining/warehousing
Fintech changes financial delivery; regtech supports regulatory compliance. AI can classify, forecast or assist review, but outputs depend on data, design and oversight. Assess bias, explainability, privacy, security and model drift. A blockchain records transactions under its consensus rules; immutability does not prove that the input was true. Cloud services require clear shared responsibilities, access controls, resilience and exit plans. Warehouses organise data for analysis; mining seeks patterns that still need validation. Cryptocurrency exposure and regulatory permission must be assessed separately from the technical ability to process a token.
Apply it in bankingAn AI credit model should be tested on relevant populations and monitored after deployment. A high aggregate accuracy can hide harmful subgroup errors or changing data.
Practice question: Assess a proposed AI or cloud banking service using business value, risk and governance.
Answer framework: use the explanation above, add the banking example, then address assumptions and controls. Expand to match the question’s marks and command words.
Worked example
Availability and recovery objectives
A service operates 30 days continuously and is unavailable for 90 minutes. Calculate observed availability. Its RTO is two hours and actual restoration takes three hours; its RPO is 15 minutes and recovered data is 10 minutes old. Assess the objectives.
- Total period = 30×24×60 = 43,200 minutes.
- Availability = (43,200−90)/43,200×100 = 99.7917%.
- Actual restoration of three hours breaches the two-hour RTO.
- A 10-minute data gap meets the stated 15-minute RPO; assess integrity and reconciliation as well.
Common mistake: Availability, RTO and RPO measure different things; meeting one does not establish compliance with the others.
Case clinic
Vendor access and ransomware
A vendor account stays active after maintenance. Attackers use it to encrypt payment servers, and the latest backup is incomplete. Recommend actions.
Model response
Contain compromised access and preserve evidence. Activate incident response and continuity arrangements, assess impacted services and prevent duplicate or unauthorised payments.
Restore from verified clean backups and reconcile transaction states before normal processing. Communicate accurate service information and complete required reporting through authorised roles.
Remove standing vendor access, strengthen privilege approval and monitoring, and test recovery against the defined RTO/RPO. Assess root cause and dependencies; purchasing another security tool without control ownership will not resolve the underlying weakness.
Practice marking guide · 20 marks- Containment and evidence (5)
- Recovery and reconciliation (6)
- Communication and reporting (3)
- Access and resilience improvements (6)
Terminology and comparisons
| RTO / RPO | Acceptable restoration time versus acceptable age of recovered data. |
|---|
| Authentication / authorisation | Proving identity versus granting permission for an action. |
|---|
| SWIFT / settlement | Financial messaging versus discharge of the payment obligation through funds transfer. |
|---|
| Backup / resilience | A stored copy versus the ability to maintain and recover critical service. |
|---|
Official references
Official papers are linked for comparison; their full text and official model answers are not reproduced. This pack’s explanations, examples and cases are original. Numerical examples are practice assumptions. Current law, instructions and subsequent amendments must be checked for regulatory answers.