RBI Cybersecurity Framework for Banks 92: Para 92: vendor certificate that code is free of known vulnerabilities, malware and covert channels

The bank obtains a certificate or written confirmation from the developer or vendor that the application is free of known vulnerabilities, malware and covert channels, and again on every material change (significant code changes affecting functionality, security or performance, judged by risk assessment).