Consider the following statements regarding the RBI's directive on storage of payment system data:

1. Payment system data relating to Indian transactions must be stored only in India.

2. Every payment system provider must be owned and operated by a public sector entity.

3. Payment system providers must submit their data storage audit report to the Comptroller and Auditor General.

Which of the statements given above is/are correct?