Cybersecurity is becoming core to financial regulation in India, as the banking and the capital market regulators step up efforts to prepare regulated entities for cyberattacks and fraud.
For the Reserve Bank of India (RBI) and the Securities and Exchange Board of India (Sebi), the focus is increasingly shifting beyond information technology systems and teams to making cyber risk a broader governance and business priority for regulated entities. The two regulators have expanded training and simulation exercises, while preparing for risks linked to newer technologies.
At a Financial Institution Benchmarking and Calibration (Fibac) event on Tuesday, RBI governor Sanjay Malhotra cited two key risks to the Indian economy and the banking sector: the uncertainties from geopolitics and trade tariffs and cyber risks.
A recent RBI survey had also said banks and non-bank lenders view artificial intelligence (AI)- enabled cyber threats as the biggest risk to their business over the next 12 months.
Both regulators said in their annual reports that the focus in the coming year is likely to remain on testing preparedness and identifying risks before they result in larger disruptions.
Sebi is looking at quantum-era risks and technology roadmaps for market infrastructure institutions, while RBI plans to initiate a micro-data analytics project for cyber risk. The central bank will undertake a thematic review to assess cyber risks emanating from usage of AI tools/systems by supervised entities. It also plans to issue guidelines on ‘digital forensic readiness’.
Among other measures, RBI said it will undertake a structured mapping of existing sector-specific cybersecurity requirements and review them in the light of the forthcoming financial sector cybersecurity strategy, the central bank said in its fiscal year 2026 (FY26) report on 29 May.
The measures come as the nature of cyber fraud changes. In its annual report for fiscal year 2026, RBI said the increasing incidence of money mules and the "dynamic" nature of cyber fraud has made it strengthen the regulatory and supervisory framework.
There were 10,114 cases of fraud reported by banks and financial institutions in FY26, the report said. Though the number of frauds have fallen in fiscal 2026 from 23,722, the total amount involved rose by 46.4% to ₹48,021 crore.
In July, state-owned Bank of Baroda said it had suffered a cyber breach that exposed about 1TB of customer and internal data after an employee's email account was compromised. The leaked files include branch audit reports, loan appraisal files, vigilance records and customer account-opening forms, among other documents circulating online.
“The measures represent a shift from treating cybersecurity as a technology issue to treating it as a board-level governance and risk-management obligation. These measures are appropriate, but their effectiveness will ultimately depend on how effectively regulated entities implement and continuously test these controls, rather than treating them as a periodic compliance exercise,” said Parnav Bhaskar, senior partner at SKV Law Offices.
To help smaller entities deal with such challenges, Sebi introduced the Market Security Operations Centre (M-SOC) in FY26, a facility intended to help smaller regulated entities access cybersecurity services such as detection, monitoring and incident response at a lower cost.
The National Stock Exchange of India Ltd (NSE) and BSE established M-SOCs in April 2025 as shared cybersecurity facilities. As of 30 March 2026, 376 market participants had been onboarded across the two M-SOCs, according to Sebi's annual report for fiscal 2026 released last week.
The market regulator conducted four cybersecurity tabletop exercises during FY26 in coordination with CERT-In (India's Computer Emergency Response Team, the nodal agency for responding to computer security incidents) and under the guidance of the high-powered steering committee on cyber security. This covered incident preparedness, response, recovery and third-party risk governance.
The exercises were aimed in particular at small and mid-sized regulated entities such as stock brokers, portfolio managers and asset management companies. A total of 202 participants from 107 unique regulated entities took part, as per Sebi.
During FY26, 36 incidents were reported at Sebi’s cyber incident reporting portal for the securities markets, up from 28 last year. These incidents involved data exfiltration, ransomware and security misconfiguration, among other issues.
Sebi also conducts annual IT inspections of market infrastructure institutions (MIIs) and stock brokers. In FY26, IT inspections were carried out for 18 intermediaries. In fiscal 2025, it carried out such inspections on 11 MIIs.
RBI has also taken several initiatives to disseminate cybersecurity awareness among citizens, including seniors. These include the Centre for Financial Literacy (CFL) project initiated in 2017.
Further, to curb the misuse of ‘mule accounts’ for diversion of funds in cyber frauds, RBI in 2024 rolled out MuleHunter.AI an artificial intelligence/machine learning-based solution. A ‘mule account’ is used by criminals to launder illicit funds. These are highly interconnected, making it difficult to trace and recover funds.
Is it enough?
“These are some very technical measures, while some are awareness-based measures. Based on the incidents, and as we all know, the number of incidents is increasing, so they are taking corrective measures," said Manu Zacharia, chief executive officer at HackIT Technology and Advisory Services. "The pace at which these regulatory bodies are implementing these measures, you can see, is increasing. Earlier, it was every two years, now it is probably one year or six months that new controls or guidelines are coming out.”
The central bank, on its part, worked with government agencies and other stakeholders on cyber risks and implemented a cyber-range initiative to improve preparedness across the banking sector. It also conducted a sectoral know-your-customer (KYC) and anti-money laundering risk assessment of the non-banking financial companies (NBFCs).
RBI operationalized a cyber-range platform at the Institute for Development & Research in Banking Technology (IDRBT). The platform allows supervised entities to conduct simulated cyberattack drills and test their response mechanisms.
“While the status of India as a cyber security hotspot, and the increasing number and sophistication of threat actors will likely create challenges from time to time, and the requirements of both regulators may need to evolve in view of these threats, we view the existing frameworks as largely adequate,” said Arun Prabhu, partner & co-head, digital +, TMT at Cyril Amarchand Mangaldas.
SKV Law's Bhaskar pointed to the need for more real-time monitoring and information-sharing between the regulators and regulated entities, particularly where multiple entities depend on the same third-party technology providers.
“The next step should be greater real-time monitoring and information-sharing between regulators and regulated entities, particularly for threats involving common third-party technology providers,” said Bhaskar.