Financial Cyber Resilience: RBI and SEBI’s Measurable Safeguards

Why in News?

SEBI introduced an IT Resilience Index and FIRE-aligned incident reporting, while RBI’s 2026 directions strengthened measurable, board-supervised cyber resilience for commercial banks.

• SEBI’s IT Resilience Index applies to critical systems of stock exchanges, clearing corporations and depositories, collectively called Market Infrastructure Institutions.
• The index uses nine weighted parameters, led by availability and security at 20% each, to produce comparable evidence of operational health.
• MIIs must operationalise the index, early-warning system and real-time service-delivery monitoring by February 28, 2027.
• SEBI also aligned its incident portal with the FIRE format, allowing initial, intermediate and closure-stage reporting as facts emerge.
• RBI’s directions require commercial banks to report cyber incidents through DAKSH within six hours of detection and assign clear board-level responsibility.

• AI can accelerate personalised phishing, voice cloning, synthetic identities and automated vulnerability discovery, increasing both the speed and scale of financial attacks.
• The regulatory shift is from periodic compliance documents towards continuous visibility, comparable metrics, rapid incident disclosure and accountable recovery.
• The adopted instruments are operational-resilience rules; separate responsible-AI guidelines and kill-switch ideas remain proposed or under consideration.

UPSC Relevance

Prelims Relevance

• SEBI regulates securities markets; RBI regulates banks and payment-system segments under separate statutory powers.
• Market Infrastructure Institutions include stock exchanges, clearing corporations and depositories.
• FIRE means Format for Incident Reporting Exchange, developed by the Financial Stability Board.
• SEBI’s ITRI must be system-driven and computed half-yearly within 60 days after each half-year.
• RBI’s 2026 commercial-bank directions took effect immediately and exclude Small Finance Banks, Payments Banks and Local Area Banks from that specific instrument.
• Cyber resilience means maintaining mission-critical functions by anticipating, withstanding, containing and recovering from cyber incidents.

Mains Relevance

GS Paper 3

• Cybersecurity of critical financial infrastructure, operational continuity and technology-enabled financial fraud.
• Use of measurable resilience indicators, continuous monitoring, incident reporting and recovery testing.

GS Paper 2

• Regulatory governance through board accountability, independent security leadership and standardised disclosure.
• Proportionate regulation of emerging technology while distinguishing enforceable duties from policy proposals.

Essay

• Digital trust rests less on promises of perfect prevention than on measurable preparedness, transparent accountability and rapid recovery after failure.

Background and Context

SEBI's IT Resilience Index

The ITRI converts resilience of critical securities-market systems into a repeatable measurement and correction cycle.

• Its scope covers critical systems and connected systems that feed them, recognising that an exchange or depository can fail through dependencies outside the core application.
• Availability and security each carry 20% weight; integrity, governance, reliability and monitoring, business continuity, and modularity and flexibility each carry 10%.
• Scalability and an ‘others’ category, including incident handling, carry 5% each; detailed sub-parameters and thresholds are to be finalised through the Industry Standards Forum.
• Computation must be automatic and non-discretionary from system data; any manual retrieval requires prior discussion with the Standing Committee on Technology.
• Every half-year, MIIs must compare two consecutive periods and place corrective actions before their technology committee and Governing Board, linking metrics to accountability.

Reporting and Recovery as a Continuous Cycle

Operational resilience assumes some incidents will occur, so detection, disclosure, containment and learning must connect quickly.

• SEBI’s existing CSCRF requires regulated entities to report cyber incidents by email within six hours and through its incident portal within 24 hours.
• The FIRE-aligned portal standardises fields, definitions and classification, making reports easier to compare across incident types, firms and jurisdictions.
• Staged reporting accepts that the initial alert may be incomplete; entities can add intermediate findings and close the record after containment, investigation and remediation.
• The ITRI adds early warning and consolidated dashboards for system performance and service delivery, aiming to detect deterioration before it becomes a market-wide disruption.
• A good resilience metric must trigger action: thresholds, ownership, time-bound repair and retesting matter more than a high score presented without evidence.

RBI Duties and the AI Policy Boundary

RBI’s binding framework is technology-neutral, while several AI-specific safeguards remain at the proposal stage.

• The 2026 directions require commercial-bank boards to approve IT, business-continuity, information-security and cyber incident-response policies and review them at least annually.
• Banks need a Board-level IT Strategy Committee and an Information Security Committee; the Chief Information Security Officer must not report directly to the Head of IT.
• The framework requires inventories, access controls, continuous surveillance, security testing, business continuity, forensic readiness and six-hour RBI reporting through DAKSH.
• These are adopted duties, but proposed responsible-AI guidelines would separately address model governance, data integrity, human accountability and AI-enabled surveillance risks.
• A customer ‘kill switch’ to halt transactions during suspected fraud has been discussed, not established here as a universal enforceable right; answers should label it under consideration.

Way Forward

Make Resilience Verifiable

• Publish clear metric definitions and thresholds, then test whether the ITRI predicts service degradation rather than rewarding documentation quality.
• Run red-team and recovery exercises against AI-enabled phishing, synthetic identity, supply-chain compromise, cloud outages and corrupted model or transaction data.
• Connect staged incident reports with root-cause analysis, customer protection, cross-regulator threat intelligence and time-bound corrective action.
• Adopt AI-specific rules only after defining model ownership, independent validation, human override, audit trails and liability for automated financial decisions.

Conclusion

• SEBI and RBI are making resilience observable through metrics, monitoring, reporting and governance, while preserving the essential goal of uninterrupted and trustworthy financial services.
• In an answer, separate what is already binding from what is proposed, then judge each safeguard by whether it improves detection, containment, recovery and accountable learning.
• AI changes the pace and sophistication of attacks, but the durable regulatory test remains whether institutions can identify responsibility, preserve evidence, protect customers and restore critical services under stress.

UPSC Practice Questions

Prelims MCQ 1

With reference to SEBI’s IT Resilience Index for Market Infrastructure Institutions, consider the following statements:

1. It covers stock exchanges, clearing corporations and depositories specified by the circular.
2. Its computation is intended to be system-driven without manual intervention.
3. It is to be computed every month and submitted directly to the Financial Stability Board.

How many of the above statements are correct?

(a) Only one (b) Only two (c) All three (d) None

Answer: (b) Only two

Explanation:

Statements 1 and 2 are correct. Statement 3 is incorrect: MIIs compute ITRI half-yearly, with comparative analysis and corrective action placed before their technology committee and Governing Board.

Prelims MCQ 2

What is the principal purpose of the FIRE format used in SEBI’s cyber incident reporting portal?

(a) To rank financial institutions by profitability (b) To standardise incident fields, definitions and life-cycle reporting (c) To replace all reporting to CERT-In (d) To authorise automatic suspension of customer accounts

Answer: (b) To standardise incident fields, definitions and life-cycle reporting

Explanation:

FIRE supports harmonised, staged reporting from the initial alert through intermediate updates and final closure. It does not rank profitability or create an automatic account-suspension power.

UPSC Mains Questions

1. How do SEBI’s IT Resilience Index and FIRE-aligned reporting move financial-sector cybersecurity from periodic compliance towards measurable operational resilience? Explain.
2. AI-enabled fraud can operate at machine speed, while regulation often changes slowly. Suggest a technology-neutral accountability framework with targeted AI safeguards for India’s financial sector.

Sources: SEBI, IT Resilience Index Circular and RBI, Commercial Banks Cybersecurity Directions.

Frequently Asked Questions