RBI notification RBI/DoS/2026-27/437 · 31 Jul 2026
Official title
Reserve Bank of India (Urban Co-operative Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026
Summary
Check the official recordThe Reserve Bank of India establishes a cybersecurity and technology risk framework for Urban Co-operative Banks (UCBs). The framework categorizes UCBs into four levels based on digital depth and payment system interconnectedness. Each level requires compliance with specific chapters of the directions. UCBs must perform a self-assessment to determine their level and implement baseline cybersecurity controls, including board-approved policies, information asset management, and incident response plans. UCBs must report cyber incidents to the RBI within six hours of detection via the DAKSH platform. The directions mandate the establishment of governance structures, such as Information Technology Strategy Committees and Information Security Committees, depending on the UCB level. These directions take effect immediately and replace previous cybersecurity guidelines for UCBs.
What you must do
Key dates
Who is affected
RBI/DoS/2026-27/437 DoS.CO.CSITEG.31/31.01.015/2026-27 July 31, 2026
In exercise of the powers conferred by Section 27 and Section 35-A read with Section 56 of the Banking Regulation Act, 1949, and all other provisions / laws enabling the Reserve Bank of India (‘RBI’) in this regard, RBI being satisfied that it is necessary and expedient in the public interest so to do, hereby issues Directions hereinafter specified.
These Directions shall be called the Reserve Bank of India (Urban Co-operative Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026.
These Directions shall come into force with immediate effect.
For the purpose of these Directions, ‘urban co-operative banks’ means Primary Co-operative Banks as defined under Section 5(ccv) read with Section 56 of Banking Regulation Act, 1949.
| Level | Criteria | Applicable Chapters |
|---|---|---|
| Level I | Applicable to the UCB irrespective of digital services / products offered by it. | Chapter II and Chapter III |
| Level II | The UCB which is a sub-member of Centralised Payment Systems (CPS) and satisfies at least one of the criteria given below: (1) offers internet banking facility to its customers (either view or transaction based) (2) provides Mobile Banking facility through an application (Smartphone usage) (3) is a direct member of Cheque Truncation System (CTS) / Immediate Payment Service (IMPS) / Unified Payments Interface (UPI) As per Master Directions on Access Criteria for Payment Systems, 2017, the CPS will include Real Time Gross Settlement (RTGS) System and National Electronic Fund Transfer (NEFT) system and any other system as may be decided by RBI from time to time. | Chapter II, Chapter III and Chapter IV |
| Level III | The UCB which satisfies at least one of the criteria given below: (1) direct member of CPS; (2) has its own Automated Teller Machine (ATM) Switch; (3) has Society for Worldwide Interbank Financial Telecommunication (SWIFT) interface. | Chapter II, Chapter III, Chapter IV, and Chapter V |
| Level IV | The UCB which is a direct member / sub-member of CPS and satisfies at least one of the criteria given below: (1) has its own ATM Switch and SWIFT interface; (2) hosts data centre or provides software support to other banks on its own or through its wholly owned subsidiaries. | Chapter II, Chapter III, Chapter IV, Chapter V, and Chapter VI |
(1) ‘Audit Trail’ - A chronological record that reconstructs and examines the sequence of activities surrounding or leading to a specific operation, procedure, or event in a security-relevant transaction from inception to result. (Source: NIST SP 800-53r5 on Security and Privacy Controls for Information Systems and Organizations)
(2) ‘Availability’ - Property of being accessible and usable on demand by an authorised entity.
(3) ‘Confidentiality’ - Property that information is neither made available nor disclosed to unauthorised individuals, entities, processes, or systems.
(4) ‘Cyber’ - Relating to, within, or through the medium of the interconnected information infrastructure of interactions among persons, processes, data, and information systems.
(5) ‘Cyber Event’ - Any observable occurrence in an information system. Cyber events sometimes provide indication that a cyber incident is occurring.
(6) ‘Cyber Incident’ - A cyber event that adversely affects the cybersecurity of an information asset whether resulting from malicious activity or not. (Source: Cyber incident definition is adapted from FSB Cyber Lexicon. By the definition, it includes cybersecurity incidents as well as IT incidents)
(7) ‘Cyber Resilience’ - The ability of an organisation to continue to carry out its mission by anticipating and adapting to cyber threats and other relevant changes in the environment and by withstanding, containing and rapidly recovering from cyber incidents.
(8) ‘Cybersecurity’ - Preservation of confidentiality, integrity, and availability of information and / or information systems through the cyber medium. In addition, other properties, such as authenticity, accountability, non-repudiation, and reliability can also be involved.
(9) ‘Cyber Threat’ - A circumstance with the potential to exploit one or more vulnerabilities that adversely affects cybersecurity.
(10) ‘Cyber-attack’ - Malicious attempt(s) to exploit vulnerabilities through the cyber medium to damage, disrupt or gain unauthorised access to assets.
(11) ‘De-militarised Zone or DMZ’ - A perimeter network segment that is logically between internal and external networks. (Source: NIST SP 800-82 Rev. 2)
(12) ‘Digital Forensics’ - The process used to acquire, preserve, analyse, and report on evidence using scientific methods that are demonstrably reliable, accurate, and repeatable. (Source: adapted from NIST Cloud Computing Forensic Science Challenges)
(13) ‘Distributed Denial of Service (DDoS)’ - A denial of service that is carried out using numerous sources simultaneously.
(14) ‘Framework’ - A structured set of strategies, policies, processes, methods, and best practices that guides organisational activities, enables governance and control, and supports the achievement of defined objectives. (Source: adapted from ISACA glossary and ISO 22340:2024)
