Let’s Connect

IFSCA – Amendment to Circular on Guidelines on Cyber Security and Cyber Resilience for Regulated Ent

  • Regulatory Updates
  • IFSCA – Amendment to Circular on Guidelines on Cyber Security and Cyber Resilience for Regulated Ent

The International Financial Services Centres Authority (“ IFSCA ”) has issued a circular dated March 10, 2026, bearing reference number IFSCA-CSD0MSC/1/2026-DCS (“ Circular ”), regarding an amendment to the circular titled “Guidelines on Cyber Security and Cyber Resilience for Regulated Entities in IFSCs” (“ Cyber Security Circular ”).

The amendment follows representations from various Regulated Entities (REs) regarding challenges in complying with the certain provisions of the Cyber Security Circular dated March 10, 2025 bearing Ref. No. IFSCA-CSD0MSC/13/2025-DCS.

The changes introduced in the Cyber Security Circular are as follows:

1. Amendment to Para 21

Existing Provision

The following categories of REs are exempted from the requirements mentioned in these Guidelines:

  • The REs operating in the form of a branch of a regulated Indian or foreign entity.
  • The REs providing services to their group entities only e.g. Global In-House Centres (GICs).
  • The REs which have less than 10 employees.
  • Foreign universities set up in IFSCs.

Changes Introduced

Substitution of Para 21 to define specific categories of Regulated Entities (REs) exempted for three (3) years.

Revised Provision

The following categories of REs are exempted from the requirements mentioned in this Circular for a period of three (3) years from the date of its issuance:

  • The RE operating in the form of a branch of a regulated Indian or foreign entity;
  • The RE providing services to its group entities only e.g. Global In-House Centre (GIC); and
  • The RE having less than 10 employees.

2. Amendment to Para 22

Existing Provision

The exemptions to the REs provided vide para 21, are subject to fulfilment of the following conditions:

  • REs shall adopt the Cyber Security and Cyber Resilience framework and IS Policy of its parent entity.
  • The CISO of the parent entity shall act as the Designated Officer for the REs in IFSC.
  • The parent entity of REs, in India or overseas, shall be regulated by a financial sector regulator in its home jurisdiction and cyber security and cyber resilience framework of the parent entity shall include within its scope, the REs in IFSC. The Designated Officer of the RE shall certify that all the necessary systems/processes have been put in place, which are in line with these Guidelines within 90 days of the end of each financial year. The said undertaking shall be submitted to the respective Department/ Division of IFSCA responsible for supervision of the RE.

Changes Introduced

Substitution of Para 22 to prescribe compliance conditions for exempted REs during the exemption period.

Revised Provision

The REs specified in para 21 shall comply with the following conditions during the exempted period:

  • The RE shall adopt the Cyber Security and Cyber Resilience framework and IS Policy of its parent entity or the holding company of such parent entity;
  • The CISO of the parent entity shall act as the Designated Officer for the RE;
  • The parent entity or the holding company of such parent entity of the RE, in India or overseas, must be regulated by a regulator/ Government Body in its home jurisdiction;
  • The Designated Officer of the RE shall certify that all the necessary systems/processes, in line with these Guidelines, have been put in place, and shall submit the same to the respective supervision Department/ Division of IFSCA within ninety (90) days of the end of each financial year; and
  • The RE shall submit the annual cyber security audit report to IFSCA.

3. New Para 23

Existing Provision

Newly Inserted

Changes Introduced

Insertion of a new Para 23 to provide exemptions for additional specific categories of REs.

Revised Provision

The following categories of REs are exempted from the requirements mentioned in this Circular for a period of three (3) years from the date of its issuance:

  • Foreign university set up in the IFSC;
  • The RE which has been established as newly incorporated standalone entity within the IFSC and does not have any parent organisation; and
  • Credit Rating Agency.

Provided that the Designated Officer of such RE shall, during the exempted period, certify that the RE has implemented adequate cybersecurity measures proportionate to its risk exposure, and shall submit the same to the respective supervision Department/ Division of IFSCA within ninety (90) days of the end of each financial year.

The Circular is issued in exercise of powers conferred by Section 12 and 13 of the International Financial Services Centres Authority Act, 2019.

The Circular has come into effect immediately.

A copy of the Circular is attached herewith for your ready reference.

Source category: IFSC Insurance Office

Attachments

Comments are closed