IFSCA circular IFSCA-CSD/MSC/4/2026-DCS · 27 Oct 2026
Official title
Certification on Cyber Security and Cyber Resilience for Designated Officers and other specified employees of Regulated Entities in the IFSCs
Summary
Check the official recordRegulated Entities in the International Financial Services Centres must ensure specific employees obtain cyber security certifications from the National Institute of Securities Markets. Designated Officers and Chief Information Security Officers must complete both Basic and Advanced certifications. Compliance Officers and employees with IT operations, information security, or privileged system access must complete the Basic certification. All other employees are encouraged to obtain the Basic certification. Affected personnel must complete the required certifications within six months of the examination launch date or their appointment date, whichever is later. Regulated Entities must maintain records of these certifications for inspection by the International Financial Services Centres Authority.
What you must do
Key dates
Who is affected
[Image omitted. See the official document.]
CIRCULAR
IFSCA-CSD/MSC/4/2026-DCS
October 27, 2026
To,
All Regulated Entities in the International Financial Services Centres (IFSCs)
Dear Madam/Sir,
Sub: Certification on Cyber Security and Cyber Resilience for Designated Officers and other specified employees of Regulated Entities in the IFSCs
IFSCA, vide circular dated March 10, 2025, issued the Guidelines on Cyber Security and Cyber Resilience for Regulated Entities in IFSCs, subsequently amended vide circular IFSCA-CSD/MSC/1/2026-DCS dated March 10, 2026. The circular established a principles-based minimum baseline framework for cyber security and cyber resilience applicable to all Regulated Entities (REs) in IFSC.
Further, recognizing the critical role of Market Infrastructure Institutions (MIIs) in ensuring the orderly functioning, integrity and resilience of financial markets, IFSCA, vide circular IFSCA-CSD/MSC/2/2026-DCS dated April 20, 2026, issued the Guidelines on Cyber Security and Cyber Resilience for Market Infrastructure Institutions (MIIs) in IFSC, prescribing additional requirements commensurate with their systemic importance and operational criticality.
The Guidelines applicable to all REs, inter alia, require the REs to ensure that their Governing Boards and senior management possess adequate knowledge, expertise and understanding of cyber security risks to effectively discharge their responsibilities relating to cyber risk governance, oversight and management. The Guidelines further mandate regular cyber security training for employees to strengthen organizational awareness, preparedness and resilience against evolving cyber threats. In addition, the Guidelines applicable to MIIs specifically require such institutions to ensure that all personnel have the requisite level of cyber security and information security awareness, supported by appropriate training.
Cyber Security awareness and capacity building are fundamental components of an effective cyber resilience framework and constitute an essential element of institutional governance and risk management. Accordingly, REs shall adopt a structured, continuous and role-appropriate approach to cyber security training and awareness encompassing their Governing Boards, senior management and employees. Such initiatives shall be commensurate with the nature, scale and complexity of their operations and the cyber risks to which they are exposed.
With a view to establishing a common knowledge benchmark on cyber security and cyber resilience across the IFSC ecosystem, the National Institute of Securities Markets (NISM), in collaboration with IFSCA, has developed the following certification courses:
i) 'NISM-IFSCA-02A: Certification Course on Cyber Security and Cyber Resilience in the GIFT IFSC (Basic)', the certification examination for which goes live on November 18, 2026 (hereinafter referred to as the 'Basic Cyber Security Certification')
ii) 'NISM-IFSCA-02B: Certification Course on Cyber Security and Cyber Resilience in the GIFT IFSC (Advanced)', the certification examination for which goes live on December 30, 2026 (hereinafter referred to as the 'Advanced Cyber Security Certification')
a) The Designated Officer of the RE, as referred to in para 6 of the Guidelines on Cyber Security for all REs, and in the case of MIIs, the Chief Information Security Officer (CISO) appointed in terms of para 7 of Annexure A to the Guidelines on Cyber Security for MIIs, shall mandatorily obtain both the Basic Cyber Security Certification and the Advanced Cyber Security Certification
b) The Compliance Officer of the RE and the employees of the RE responsible for IT operations or information security, or having privileged access to the critical systems of the RE, shall mandatorily obtain the Basic Cyber Security Certification
c) All other employees of the RE are encouraged to obtain the Basic Cyber Security Certification. The Compliance Officer and the employees referred to in para 6(b) above are also encouraged to obtain the Advanced Cyber Security Certification.
| Personnel of the RE | Basic (02A) | Advanced (02B) | | :--- | :--- | :--- | | Designated Officer (para 6 of the Guidelines for all REs); for MIIs, the CISO appointed under para 7 of Annexure A to the MII Guidelines | Mandatory | Mandatory | | Compliance Officer | Mandatory | Encouraged | | Employees responsible for IT operations or information security, or having privileged access to critical systems | Mandatory | Encouraged | | All other employees | Encouraged | Encouraged |
The persons referred to in para 6(a) and para 6(b) above shall obtain the respective certification within six (6) months from the date on which the respective certification examination goes live, or within six (6) months from the date of their appointment to such role, whichever is later. Such persons shall continue to hold a valid certification at all times while discharging their responsibilities in such role.
The REs shall maintain records of the certifications obtained by the persons referred to in para 6(a) and para 6(b) above and shall make the same available to IFSCA as and when sought.
The details of the courses and the link for registration may be found at https://www.nism.ac.in/nism-ifsca-certification-course.
This Circular is issued in exercise of the powers conferred by Sections 12 and 13 of the International Financial Services Centres Authority Act, 2019, to develop and regulate the financial services market in the International Financial Services Centre.
This Circular shall come into force with immediate effect. A copy of this circular is available on the website at www.ifsca.gov.in.
Yours Faithfully,
Praveen Kamat
Chief General Manager and CISO
Division of Cyber Security
Email: praveen.kamat@ifsca.gov.in
Tel: +91- 079 – 61809820
