Let’s Connect

IFSCA – Advisory on heightened Cyber Security risks arising from Frontier AI models for REs

  • Regulatory Updates
  • IFSCA – Advisory on heightened Cyber Security risks arising from Frontier AI models for REs

The International Financial Services Centres Authority (“IFSCA”/ “Authority”) has issued a Circular dated June 04, 2026, bearing reference number
IFSCA-CSD/MSC/3/2026-DCS (“Circular”) prescribing an advisory on heightened cyber security risks arising from frontier Artificial Intelligence (“AI”) models.

Background:

  • The Authority has issued an advisory on heightened cyber security risks arising from frontier AI models, supplementing the existing cyber security and cyber resilience framework applicable to Regulated Entities (“REs”) and Market Infrastructure Institutions (“MIIs”) in IFSCs.
  • The advisory supplements the existing cyber security and cyber resilience framework prescribed under:
    • Guidelines on Cyber Security and Cyber Resilience for Regulated Entities in IFSCs dated March 10, 2026, bearing reference no. IFSCA-CSD/MSC/1/2026-DCS (“RE Cyber Security Guidelines”); and
    • Guidelines on Cyber Security and Cyber Resilience for Market Infrastructure Institutions (“MIIs”) dated April 20, 2026, bearing reference no. IFSCA-CSD/MSC/2/2026-DCS IFSC (“MII Cyber Security Guidelines”).
  • The aforesaid guidelines are collectively referred to as the “Existing Cyber Security Guidelines”, and the advisory is required to be read in conjunction with the same.
  • IFSCA noted that frontier AI models have significantly increased cyber security risks by accelerating the identification and exploitation of known and previously unknown (zero-day) vulnerabilities, thereby reducing the time between vulnerability disclosure and exploitation.
  • Recognising that such capabilities are expected to become more widely accessible, IFSCA has advised REs to strengthen their security posture, reassess cyber security risks and implement mitigating controls in accordance with the principle of proportionality.
  • To enhance preparedness against emerging AI-driven cyber threats, IFSCA has prescribed various measures under Annexure A of the Circular for adoption by REs. The Circular is effective immediately.

The Key measures prescribed under Annexure A are as follows:

  • REs shall presume and prepare for the rapid exploitation of newly disclosed critical vulnerabilities and incorporate risks arising from frontier AI models into their cyber security risk assessments, which are required to be periodically reviewed by the Board (or, in the case of MIIs, the Standing Committee on Technology).
  • REs shall prepare for vulnerability patch waves, wherein a large number of vulnerabilities across the technology stack are identified and weaponised within a compressed window.
  • REs shall maintain a Software Bill of Materials (“SBOM”), including open-source components, to facilitate timely impact assessment and remediation during vulnerability patch waves.
  • REs are encouraged to implement phishing-resistant Multi-Factor Authentication (MFA) and strong identity controls for internet-facing and privileged access and prioritize patching of vulnerabilities most likely to be exploited.
  • MFA enrolment, as well as any modification to a registered MFA device, shall be permitted only through an authorised process supported by robust identity verification.
  • REs shall maintain an inventory of APIs and associated applications and implement appropriate controls, including rate-limiting and throttling controls to detect and prevent automated abuse and shall restrict API connectivity to a whitelist of authorised entities.
  • REs shall ensure that critical service providers assess risks arising from frontier AI models and demonstrate preparedness for accelerated exploit timelines, while ensuring timely remediation of vulnerabilities in third-party systems and dependencies.
  • REs shall strengthen monitoring and detection capabilities to identify potential AI-driven attacks and are encouraged to establish rapid response mechanisms for credential compromise, including automated containment and continuous monitoring measures.
  • REs are encouraged to adopt AI-assisted vulnerability detection tools to address AI-driven threats. Where such tools are used, REs should ensure:
    • Such use is authorised.
    • Sensitive or regulated data is not exposed to unapproved external services.
    • The model provider’s data-handling, retention and confidentiality terms are adequate.
  • REs shall ensure appropriate human oversight and shall subject AI-generated or AI remediated code to rigorous security testing prior to deployment in production environments.

A copy of the Circular along with Annexure A is attached herewith for your ready reference.

Source category: IFSC Insurance Office

Attachments

Comments are closed