Compliance guide · Indian financial sector

RBI, SEBI and IRDAI, one plan.

Banks, NBFCs, brokers, fund houses and insurers answer to their own regulator on cyber security, on top of CERT-In and the DPDP Act. The rules overlap more than they differ. Here is what each regulator asks in 2026, and how one programme can cover all three.

Plan your regulator readiness Compare the three
RBI directions of 31 July 2026 coveredOne programme, three regulatorsAI rules from RBI and SEBI included
In plain words

Each financial regulator has its own cyber rulebook. The RBI issued new Cybersecurity, Technology Risk, Resilience and Assurance Framework Directions on 31 July 2026, with separate versions for commercial banks, small finance banks, payments banks, urban co-operative banks, NBFCs and all-India financial institutions. SEBI’s Cybersecurity and Cyber Resilience Framework (CSCRF, August 2024) covers market entities from exchanges to brokers and fund houses. IRDAI’s 2023 guidelines cover insurers and intermediaries. All three expect fast incident reporting, regular audits and testing, and board oversight.

Checked against official sources on . General information, not legal advice.

RBI
Directions of 31 July 2026
SEBI
CSCRF, 20 August 2024
IRDAI
Guidelines, April 2023
Incident reports
Within 6 hours
Side by side

Three rulebooks, one foundation.

What each regulator adds on top of the basics that apply to everyone. Build the foundation once, then add each regulator’s extras.

Three regulators on one foundation. RBI, for banks and NBFCs, July 2026 directions: six-hour incident reports on the DAKSH portal, vulnerability scans every six months and penetration tests every year for critical systems, disaster recovery drills twice a year, and the FREE-AI framework for AI. SEBI, for market entities, the August 2024 CSCRF: rules that scale with entity size, regular cyber audits and VAPT, and since February 2025 responsibility for the output of AI tools. IRDAI, for insurers, the 2023 guidelines: six-hour reports to IRDAI and CERT-In, 180 days of logs, forensic auditors on standby, and a rule that your SOC vendor cannot be your forensic auditor. Shared by all three: CERT-In six-hour reporting, 180-day logs in India, yearly audits and board oversight. RBI · BANKS AND NBFCSCyber directions, Jul 2026• 6-hour reports on DAKSH portal• Scans 6-monthly, pen tests yearly• DR drills twice a year• FREE-AI framework for AI (2025)SEBI · MARKET ENTITIESCSCRF, August 2024• Rules scale with entity size• Regular cyber audits and VAPT• You own your AI’s output (2025)IRDAI · INSURERSGuidelines, April 2023• 6-hour reports to IRDAI, CERT-In• 180 days of logs kept• Forensic auditors on standby• SOC vendor can’t do forensicsSHARED BY ALL THREECERT-In 6-hour reporting · 180-day logs in India · yearly audits · board oversight
The three rulebooks differ in detail but share a foundation, so one well-built programme can satisfy all of them. RBI testing cycles shown are for critical and internet-facing systems of commercial banks.
Key dates

The rules keep getting sharper.

APR 2023IRDAI cyber guidelinesNOV 2023RBI IT governance directionAUG 2024SEBI CSCRF issuedFEB 2025SEBI: firms own AI outputAUG 2025RBI FREE-AI frameworkJUL 2026RBI cyber directions 2026 TODAY · NOV 2026
  1. APR 2023IRDAI cyber guidelines
  2. NOV 2023RBI IT governance direction
  3. AUG 2024SEBI CSCRF issued
  4. FEB 2025SEBI: firms own AI output
  5. AUG 2025RBI FREE-AI framework
  6. JUL 2026RBI cyber directions 2026

The RBI’s July 2026 directions took effect on the day they were issued, with no transition period, and repeal earlier cyber security and IT governance directions for the entities they cover.

Regulator by regulator

What each one asks of you.

  • RBI cyber directions, July 2026Separate directions for banks, NBFCs and other regulated entities. For commercial banks: incident reports within six hours on the RBI’s DAKSH portal, vulnerability assessments every six months and penetration tests every year for critical and internet-facing systems.
  • RBI FREE-AI framework, August 2025The RBI’s framework for responsible AI in finance: 7 principles, 6 pillars (infrastructure, policy, capacity, governance, protection and assurance) and 26 recommendations, including AI audits and AI incident reporting.
  • SEBI CSCRF, August 2024One framework for market entities, from exchanges and depositories to brokers and fund houses, with requirements that scale with each entity’s size and category.
  • SEBI rules on AI tools, February 2025A regulated entity using AI is solely responsible for the security of investor data, the output of its AI tools and compliance with the law, whether the AI is built in-house or bought.
  • IRDAI cyber security guidelinesFor insurers and intermediaries: report incidents to IRDAI and CERT-In within six hours, keep 180 days of logs, and have forensic auditors lined up before an incident.
  • CERT-In, for everyoneThe CERT-In directions apply on top: six-hour reporting, 180-day logs in India and yearly audits by CERT-In empanelled auditors.Read our guide →
One programme

Built once, mapped three ways.

  1. Weeks 1–2

    Applicability register

    Which rules apply to which systems and entities, written down, as the RBI’s 2026 directions expect.

  2. Weeks 2–4

    Gap check

    Your controls scored against each regulator, with one combined fix list instead of three.

  3. Ongoing

    Testing on the right cycle

    Vulnerability scans and penetration tests timed to your regulator’s cycle, plus testing of AI models and chatbots.

  4. Week 5

    Six-hour drill

    One incident, three reports: CERT-In, your regulator and, if personal data is hit, the DPDP Board.

  5. Weeks 4–8

    AI governance

    An AI inventory, policy and testing evidence that answer the RBI’s FREE-AI framework and SEBI’s AI rule.

Where your regulator requires a CERT-In empanelled auditor, we are not one. We prepare you, test between audits and help fix findings, and the empanelled auditor performs the formal audit.
Questions

Questions from regulated teams.

Q01What changed with the RBI’s July 2026 directions?
The RBI replaced its earlier cyber security and IT governance directions with new entity-specific Cybersecurity, Technology Risk, Resilience and Assurance Framework Directions, effective immediately on 31 July 2026. For commercial banks they set six-hour incident reporting on the DAKSH portal, vulnerability assessments every six months and penetration tests every twelve months for critical and internet-facing systems, and disaster recovery drills at least twice a year.
Q02We are an NBFC. Which RBI rules apply?
NBFCs have their own version of the July 2026 directions, as do small finance banks, payments banks, urban co-operative banks and all-India financial institutions. The structure is similar to the bank version, but check your own direction for the exact requirements and timelines.
Q03Do SEBI’s rules on AI apply to us?
If you are a SEBI-regulated entity and use AI or machine learning tools, yes. Since February 2025 you are solely responsible for investor data security, for the output of the AI tools you rely on and for legal compliance, even when the tool comes from a vendor. Testing what your AI actually does is the best evidence you can have.
Q04Is the RBI’s FREE-AI framework mandatory?
FREE-AI is a framework of principles and recommendations published by the RBI in August 2025, not a binding direction in itself. Expect supervisors to ask how you follow it, and expect parts of it to appear in future directions.
Q05Can our SOC provider investigate an incident for us?
Not if you are regulated by IRDAI. Its 2025 circular says a vendor that runs your SOC, attack surface monitoring, red teaming or yearly assurance audits should not be engaged as the forensic auditor for that incident. Empanel an independent forensic auditor in advance.
Q06Can HanulSec do our regulatory VAPT?
Where the regulator requires a CERT-In empanelled auditor for the formal audit, no: we are not empanelled. We can run testing between audits, test AI systems, prepare you for the audit and help fix findings, and we will tell you plainly which work needs an empanelled firm.
Sources

Checked against the official text.

This guide is general information, not legal advice. Rules and dates change, so check the official text and ask your lawyer before making decisions for your company. We update this page when the rules change.

Next hops

Related guides and services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings