IFSCA circular IFSCA-CSD0MSC/1/2026-DCS · 10 Mar 2026
Official title
Amendment to the Circular titled “Guidelines on Cyber Security and Cyber Resilience for Regulated Entities in IFSCs”
Summary
Check the official recordThe International Financial Services Centres Authority has amended its cyber security guidelines to provide three-year exemptions for specific categories of Regulated Entities. Entities such as branches of regulated firms, Global In-House Centres, and those with fewer than 10 employees must adopt their parent entity's framework and meet reporting requirements. Additionally, foreign universities, newly incorporated standalone entities without parent organizations, and Credit Rating Agencies are granted a three-year exemption, provided they certify the implementation of risk-proportionate cybersecurity measures. These entities must submit annual certifications and audit reports to the Authority. The amendments are effective immediately.
What you must do
Key dates
Who is affected
Thresholds
Exceptions
CIRCULAR
IFSCA-CSD0MSC/1/2026-DCS
March 10, 2026
To,
All Regulated Entities in the International Financial Services Centres (IFSCs)
Dear Madam/Sir,
Sub: Amendment to the Circular titled “Guidelines on Cyber Security and Cyber Resilience for Regulated Entities in IFSCs”
Reference is drawn to the circular titled “Guidelines on Cyber Security and Cyber Resilience for Regulated Entities in IFSCs” (hereinafter referred to as the “Cyber Security Circular”), dated March 10, 2025, issued by the Authority.
Following the issuance of the Cyber Security Circular, the Authority has received representations from various Regulated Entities (REs) highlighting the challenges faced in complying with certain provisions of the said Circular.
The Authority considered the representations received from the REs and has decided to amend the Cyber Security Circular as follows:
i) For para 21 of the said Circular, the following para shall be substituted, namely:- “The following categories of REs are exempted from the requirements mentioned in this Circular for a period of three (3) years from the date of its issuance:
a) The RE operating in the form of a branch of a regulated Indian or foreign entity; b) The RE providing services to its group entities only e.g. Global In-House Centre (GIC); and c) The RE having less than 10 employees.”
ii) For para 22 of the said Circular, the following para shall be substituted, namely:- “The REs specified in para 21 shall comply with the following conditions during the exempted period:
a) The RE shall adopt the Cyber Security and Cyber Resilience framework and IS Policy of its parent entity or the holding company of such parent entity; b) The CISO of the parent entity shall act as the Designated Officer for the RE; c) The parent entity or the holding company of such parent entity of the RE, in India or overseas, must be regulated by a regulator/ Government Body in its home jurisdiction; d) The Designated Officer of the RE shall certify that all the necessary systems/processes, in line with these Guidelines, have been put in place, and shall submit the same to the respective supervision Department/ Division of IFSCA within ninety (90) days of the end of each financial year; and e) The RE shall submit the annual cyber security audit report to IFSCA.”
iii) After para 22 of the said Circular, the following para shall be inserted, namely:- “23. The following categories of REs are exempted from the requirements mentioned in this Circular for a period of three (3) years from the date of its issuance:
a) Foreign university set up in the IFSC; b) The RE which has been established as newly incorporated standalone entity within the IFSC and does not have any parent organisation; and c) Credit Rating Agency.
Provided that the Designated Officer of such RE shall, during the exempted period, certify that the RE has implemented adequate cybersecurity measures proportionate to its risk exposure, and shall submit the same to the respective supervision Department/ Division of IFSCA within ninety (90) days of the end of each financial year.”
A copy of this circular is available on the website at www.ifsca.gov.in
Yours Faithfully,
Praveen Kamat General Manager & Chief Information Security Officer Division of Cyber Security praveen.kamat@ifsca.gov.in Tel : +91- 079 - 61809820
