RBI, SEBI Strengthen Cyber Shield for Financial Sector Players

The Reserve Bank of India and the Securities and Exchange Board of India have both set out fresh steps to strengthen cyber resilience among the entities they regulate. The measures, reported on 12 August 2026, are recorded in the two regulators' annual reports for 2025-26: the RBI's report released on 29 May 2026 and SEBI's report released on 6 August 2026 through SEBI Press Release No. 43/2026.

What the RBI has done

The chapter on Regulation, Supervision and Financial Stability in the RBI Annual Report 2025-26 records the following:

• Cyber Range: the RBI has operationalised a Cyber Range on a platform deployed at the Institute for Development and Research in Banking Technology (IDRBT). Supervised entities can run cyber drills on simulated attack scenarios to test preparedness and response.
• Digital forensic readiness: a set of baseline requirements on digital forensic readiness is at an advanced stage of finalisation.
• Thematic studies: the RBI carried out thematic studies on payment system reconciliation in scheduled commercial banks, manpower adequacy in IT and cybersecurity across the three lines of defence, Security Operations Centre (SOC) operations, transaction monitoring and customer data protection, security of customer data across systems in supervised entities, and vulnerability management.
• Cyber mapping: a mapping exercise assessed cyber risk exposure and interdependencies between commercial banks and ICT service providers, using questionnaires covering all major banks and areas such as security tools, AI applications, account aggregators and threat intelligence platforms.
• MuleHunter.AI: the report describes this tool, which uses behavioural and transactional features drawn from real fraud patterns to flag suspected mule accounts used to route fraud proceeds.

RBI agenda for 2026-27

For the current year, the RBI plans to start a micro-data analytics project on cyber risk, carry out a thematic review of cyber risks arising from the use of AI tools and systems by supervised entities, and map existing sector-specific cybersecurity requirements for review in the light of the forthcoming Financial Sector Cybersecurity Strategy.

What SEBI has done

The SEBI Annual Report 2025-26 says SEBI has designed an AI-enabled platform, Cyber-Sec Audit Compliance (C-SAC), to fully automate the tracking and oversight of cybersecurity audits of regulated entities. The report tracks regulated entities' participation in cybersecurity table top exercises during the year. Looking ahead, SEBI says it will conduct sector-specific cybersecurity training with Rashtriya Raksha University and NISM, and will advance quantum readiness compliance to prepare the market for quantum-era risks.

Who is affected

Banks, NBFCs and other RBI-supervised entities should expect drills on the Cyber Range, forensic readiness requirements once finalised, and supervisory questions on how they use AI tools. Stock brokers, depository participants, asset management companies and other SEBI-regulated entities should expect their cybersecurity audits to be tracked through the C-SAC platform and continued participation in table top exercises.

What finance and audit teams can do now

• Check whether SOC coverage, vulnerability management and customer data protection meet the areas the RBI has already reviewed.
• List every AI tool used in customer-facing or operational processes, with its owner and risk assessment, ahead of the RBI's thematic review.
• Prepare forensic readiness basics now: log retention, evidence handling and incident timelines.
• For SEBI-regulated entities, keep cybersecurity audit findings and closure evidence in a form that can be uploaded and tracked.

Updated on 27 September 2026: added the specific RBI and SEBI measures from their 2025-26 annual reports, including the IDRBT Cyber Range, forensic readiness norms, the RBI's 2026-27 cyber agenda and SEBI's C-SAC platform, with links to the official reports.