Chapter 12: Regulatory Requirements (IFSCA)

The establishment of the International Financial Services Centres Authority (IFSCA) under the International Financial Services Centres Authority Act, 2019, unified the regulatory, supervisory, and developmental powers previously dispersed across the Reserve Bank of India (RBI), Securities and Exchange Board of India (SEBI), Insurance Regulatory and Development Authority of India (IRDAI), and Pension Fund Regulatory and Development Authority (PFRDA) within India's International Financial Services Centres (GIFT IFSC).

In a global financial hub processing billions of dollars in multi-currency securities trading, cross-border banking, and international reinsurance, cyber security is not merely an internal technological matter—it is central to the systemic stability, market integrity, and international credibility of the entire IFSC ecosystem.

                           IFSCA REGULATORY GOVERNANCE MODEL
                                           │
                        [ STATUTORY AUTHORITY: IFSCA ]
                        (IFSCA Act, 2019 Unified Powers)
                                           │
        ┌──────────────────────────────────┴──────────────────────────────────┐
        ▼                                                                     ▼
[ CIRCULAR: March 10, 2025 ]                                [ AMENDMENT: March 10, 2026 ]
Guidelines on Cyber Security & Cyber                        Refined Proportionality Criteria,
Resilience for Regulated Entities in IFSC                   Enhanced MII Cyber Frameworks
        │                                                                     │
        └──────────────────────────────────┬──────────────────────────────────┘
                                           ▼
                   [ THE OVERSIGHT BODY ARCHITECTURE ]
                   - Governing Board / Senior Management
                   - Board-Level Technology / Risk Committees
                   - Appointment of CISO / "Designated Officer"
                   - Principle of Proportionality Enforcement

Key Regulatory Circulars Governing Cyber Resilience

The cybersecurity obligations applicable to financial institutions in the IFSC are established through comprehensive statutory circulars:

1. Guidelines on Cyber Security and Cyber Resilience for Regulated Entities in IFSCs (Circular dated March 10, 2025): The foundational regulatory framework establishing baseline cybersecurity mandates, governance structures, third-party risk rules, and audit obligations.
2. Amendment to the Guidelines on Cyber Security and Cyber Resilience for Regulated Entities in IFSCs (Circular dated March 10, 2026): Updates incorporating advanced supply chain controls, refined incident reporting timelines, and harmonized standards for Market Infrastructure Institutions (MIIs).

The Principle of Proportionality

A defining hallmark of the IFSCA cybersecurity regime is the Principle of Proportionality. Recognizing the immense diversity of financial market participants in GIFT City—ranging from massive international stock exchanges and global banking units down to boutique advisory firms and single-family offices—the guidelines do not enforce a rigid, one-size-fits-all burden.

Under the Proportionality Principle, cybersecurity controls must be calibrated in direct proportion to:

• The scale and operational complexity of the entity's business activities;
• The nature of financial transactions processed (e.g., retail deposits vs corporate advisory);
• The degree of interconnectedness with the broader national and global financial ecosystem; and
• The quantum and sensitivity of confidential client data stored or transmitted.

Crucial Regulatory Standard: While smaller entities may implement streamlined technological toolsets, every regulated entity, regardless of size, must demonstrate that it has formally identified its cyber risks, established an approved Information Security Policy, and implemented controls commensurate with its threat exposure.

The Oversight Body and the "Designated Officer"

• The Oversight Body: Refers to the governing collective responsible for directing and supervising cybersecurity governance. Depending on corporate structure, this comprises the Board of Directors, Managing Director, Chief Executive Officer, and specialized Board Risk Committees. The Oversight Body must possess sufficient technical literacy to evaluate cyber risk, approve Information Security policies, and ensure resource allocation.
• The CISO / Designated Officer: Every Regulated Entity must appoint a Chief Information Security Officer (CISO) or designate a qualified senior executive as the Designated Officer responsible for cybersecurity execution. The Designated Officer must have direct, unimpeded access to Senior Management and the Board, operating independently of commercial and IT delivery pressures.

The IFSCA Cyber Security and Cyber Resilience Framework mandates that every Regulated Entity (RE) must formulate, maintain, and enforce an enterprise Information Security (IS) Policy approved by its Governing Board. The framework establishes rigorous architectural and procedural baselines across the entire technology lifecycle.

                   CORE PILLARS OF THE IFSCA CYBER FRAMEWORK
                                       │
     ┌───────────────────┬─────────────┴─────────────┬───────────────────┐
     ▼                   ▼                           ▼                   ▼
[ 1. GOVERNANCE &   [ 2. ASSET & ACCESS         [ 3. NETWORK & DATA [ 4. THREAT & INCIDENT
  POLICY ]               CONTROLS ]                  SECURITY ]          MANAGEMENT ]
- Approved IS Policy- Exhaustive inventory      - Network segment   - Continuous SOC / SIEM
- Board-set risk    - Least privilege & SoD       DMZ isolation     - Mandatory VAPT
  appetite          - Phishing-resistant MFA    - AES-256 / TLS 1.3 - Cyber Crisis Management
- Dedicated CISO    - Strict PAM controls       - Cloud encryption    Plan (CCMP)

Core Mandatory Pillars of the IFSCA Framework

1. Governance and Policy Formulation:
   • The IS Policy must define the entity's Cyber Risk Appetite and measurable Cyber Resilience Objectives.
   • Annual mandatory policy reviews, updated to address emerging threat vectors, regulatory amendments, and audit findings.
2. Asset Management and Visibility:
   • Maintaining an exhaustive, current inventory of all hardware, software, cloud repositories, network devices, and data assets.
   • Identifying and classifying all Critical Information Infrastructure (CII) and high-value systems, assigning explicit business owners and technical custodians.
3. Access Control and Authentication:
   • Enforcing the Principle of Least Privilege and Segregation of Duties (Maker-Checker).
   • Mandatory deployment of Multi-Factor Authentication (MFA) for all remote connections, cloud administration, and high-value transactional systems.
   • Comprehensive Privileged Access Management (PAM) vaulting and session logging for administrative credentials.
4. Network Architecture and Boundary Protections:
   • Enforcing multi-tier network segmentation; isolating public-facing services within Demilitarised Zones (DMZs).
   • Deploying Next-Generation Firewalls (NGFW), Web Application Firewalls (WAF), and Intrusion Prevention Systems (IPS) at all external perimeters.
   • Disabling unneeded network protocols, ports, and services; enforcing strict baseline hardening (CIS Benchmarks).
5. Data Protection and Cryptography:
   • Encrypting sensitive data at rest using approved symmetric standards (AES-256) and in transit across public/private networks using modern cryptographic protocols (TLS 1.3).
   • Enforcing Data Loss Prevention (DLP) controls across network egress points, email gateways, and managed endpoints.
   • Operating cryptographic key lifecycles inside FIPS-validated Hardware Security Modules (HSMs).
6. Continuous Monitoring and Vulnerability Management:
   • Operating continuous 24/7 security event logging, centralizing telemetry into an enterprise SIEM.
   • Conducting regular vulnerability assessments and independent Vulnerability Assessment and Penetration Testing (VAPT) at least annually (semi-annually for high-criticality entities).
   • Applying security patches in accordance with strict statutory timelines.

Regulatory compliance in the GIFT IFSC is reinforced through rigorous external audit oversight, binding incident reporting deadlines, and specialized resilience standards for market infrastructure institutions.

                     INCIDENT NOTIFICATION ESCALATION LADDER
                                        │
           [ CYBERSECURITY INCIDENT DETECTED AT REGULATED ENTITY ]
                                        │
           ┌────────────────────────────┴────────────────────────────┐
           ▼                                                         ▼
[ CRITICAL / SEVERE INCIDENT ]                            [ STANDARD / LOW INCIDENT ]
Disruption to trading, core banking,                      Minor malware blocked, non-critical
data breach, or systemic ransomware                       phishing report, localized event
           │                                                         │
           ▼                                                         ▼
[ INITIAL REPORT TO IFSCA & CERT-In ]                     [ INTERNAL RESOLUTION & LOGGING ]
Mandatory notification within:                            Documented in quarterly cyber dashboard
• 2 to 6 HOURS of discovery                               submitted to Board Risk Committee
           │
           ▼
[ COMPREHENSIVE FORENSIC ROOT CAUSE ANALYSIS (RCA) ]
Detailed technical report submitted within:
• 14 to 21 DAYS of incident closure

1. Mandatory Incident Reporting Timelines

Under IFSCA guidelines and national cybersecurity directives (CERT-In):

• Initial Notification: Regulated entities must report any cybersecurity incident affecting critical systems, customer data integrity, or core operational availability to the IFSCA and CERT-In within 2 to 6 hours of discovery.
• Interim Operational Updates: The entity must provide periodic operational updates as forensic containment, eradication, and recovery progress.
• Detailed Root Cause Analysis (RCA): A formal, comprehensive post-incident investigation report—detailing the initial attack vector, compromised assets, exploitation timeline, remediation actions taken, and systemic preventative measures—must be submitted to the IFSCA within 14 to 21 calendar days of incident closure.

---

2. Comprehensive Cyber Security Audits

Every Regulated Entity must undergo an independent, thorough cybersecurity audit to evaluate the design and operational effectiveness of its cybersecurity posture:

• Auditor Independence: The audit must be conducted by an independent external auditing firm possessing relevant certifications (e.g., CERT-In empanelled auditors, CISA, CISSP). The external auditor cannot be the same entity that manages or implements the IT controls.
• Scope: Evaluates compliance with IFSCA guidelines, IS Policy enforcement, network architecture, vulnerability management, VAPT report findings, and third-party risk controls.
• Reporting to the Board and IFSCA: Audit findings, management responses, and remediation roadmaps must be presented directly to the Governing Board / Audit Committee and submitted to the IFSCA along with compliance certificates.

---

3. Exemption Categories Provided by IFSCA

To uphold the Principle of Proportionality without creating excessive administrative burdens, the IFSCA provides specific Exemption Categories:

• Category I Exemptions (Purely Group-Reliant Entities): Regulated entities that have no independent IT systems, maintain zero local server infrastructure in GIFT City, process no independent retail client transactions, and rely 100% upon the shared, enterprise cybersecurity infrastructure of a regulated parent bank or global financial institution.
• Exemption Conditions:
  • The entity must formally apply for and obtain written exemption from the IFSCA.
  • The entity must demonstrate that the parent entity's cybersecurity framework meets or exceeds IFSCA standards.
  • The parent entity must submit an annual compliance certificate confirming that the IFSC branch is fully covered under the parent group's global security operations and audits.

---

4. Additional Stringent Requirements for Market Infrastructure Institutions (MIIs)

Because international stock exchanges, clearing corporations, and depositories constitute the systemic backbone of the IFSC, they are subjected to heightened regulatory standards: