Question 1

Which cybersecurity Direction applies to Commercial Banks?

Accepted Answer

Reserve Bank of India (Commercial Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026 (RBI/DoS/2026-27/410), issued 31 July 2026 and in force on issuance. Commercial Banks — banking companies other than Small Finance Banks, Payments Banks and Local Area Banks. Foreign banks operating through branch mode get a 'comply or explain' route for selected requirements, subject to the Reserve Bank accepting the explanation.

Question 2

Which cybersecurity Direction applies to Small Finance Banks?

Accepted Answer

Reserve Bank of India (Small Finance Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026 (RBI/DoS/2026-27/419), issued 31 July 2026 and in force on issuance. Small Finance Banks. The Directions apply as a whole — unlike the UCB and NBFC instruments, there is no internal grading by size or by digital services.

Question 3

Which cybersecurity Direction applies to Payments Banks?

Accepted Answer

Reserve Bank of India (Payments Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026 (RBI/DoS/2026-27/428), issued 31 July 2026 and in force on issuance. Payments Banks. The Directions apply as a whole — there is no internal grading, though a risk-based approach is permitted for non-critical systems.

Question 4

Which cybersecurity Direction applies to Urban Co-operative Banks?

Accepted Answer

Reserve Bank of India (Urban Co-operative Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026 (RBI/DoS/2026-27/437), issued 31 July 2026 and in force on issuance. Primary (Urban) Co-operative Banks, graded into Levels I to IV by the digital services they offer and their interconnectedness with centralised payment systems — not by asset size.

Question 5

Which cybersecurity Direction applies to All India Financial Institutions?

Accepted Answer

Reserve Bank of India (All India Financial Institutions – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026 (RBI/DoS/2026-27/456), issued 31 July 2026 and in force on issuance. Export-Import Bank of India, NABARD, SIDBI, National Housing Bank and NaBFID, named individually in the notification. No internal grading. This is the Direction most often missing from secondary summaries of the family.

Question 6

Which cybersecurity Direction applies to NBFCs?

Accepted Answer

Reserve Bank of India (Non-Banking Financial Companies – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026 (RBI/DoS/2026-27/461), issued 31 July 2026 and in force on issuance. All NBFCs, with chapters attaching by scale-based regulatory layer and, within the Base Layer, by an asset-size test at ₹500 crore. Core Investment Companies are treated with the smallest Base Layer NBFCs.

Question 7

Which cybersecurity Direction applies to Credit Information Companies?

Accepted Answer

Reserve Bank of India (Credit Information Companies – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026 (RBI/DoS/2026-27/470), issued 31 July 2026 and in force on issuance. Entities within the definition of Credit Information Company under section 2(e) of the Credit Information Companies (Regulation) Act, 2005. No internal grading.

Protect

Operate

Build

Reserve Bank of India (Urban Co-operative Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026

Which level are you?