For services provided over the internet (online and mobile banking, phone banking, online trading, digital wallets and payments, API-based services) the FI should implement security commensurate with the risk; secure communication channels with encryption and digital signatures; minimise exposure to code injection, cross-site scripting, man-in-the-middle, DNS hijacking, DDoS, malware and spoofing; address mobile application risks (Annex C); distribute mobile apps only through official stores or other secure channels; actively monitor phishing campaigns against the FI and its customers, report them for takedown and alert customers with protective advice; and disallow rooted or jailbroken devices from transacting through its mobile apps unless the app is secured in a sandbox or container.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.