"RBI and SEBI Strengthen Cybersecurity Frameworks Against AI-Driven Financial Threats"
IT Resilience Index (ITRI)
SEBI's nine-parameter index quantifying cyber readiness of Market Infrastructure Institutions, computed half-yearly.
Market Infrastructure Institutions (MIIs)
Entities such as stock exchanges and clearing corporations that form the backbone of securities markets.
India's financial sector cybersecurity architecture has been built in layers over two decades. The Information Technology Act, 2000 provided the foundational legal basis for addressing cyber offences. The National Cyber Security Policy, 2013 and the establishment of CERT-In (Computer Emergency Response Team India) created a national institutional response mechanism. Sector-specific regulators, the Reserve Bank of India (RBI) for banks and payment systems, and the Securities and Exchange Board of India (SEBI) for capital markets, have each issued successive cybersecurity directives, recognising that financial infrastructure falls within the most sensitive category of Critical Information Infrastructure (CII).
The threat environment has changed qualitatively with the spread of AI tools. Traditional cybersecurity frameworks assumed a human attacker using software as a passive instrument. AI changes this fundamentally. Attacks can now be automated, personalised, and executed at machine speed. Deepfake technology allows fraudsters to synthesise voices and faces convincingly enough to bypass Know Your Customer (KYC) verification. Phishing campaigns can be tailored at scale. Autonomous systems can probe for vulnerabilities continuously, without human direction. This shift has compelled both the RBI and SEBI to revisit their frameworks in a coordinated manner.
The RBI's new comprehensive cybersecurity framework for banks and financial institutions mandates three core requirements. First, board-level ownership of cyber risk: cybersecurity is no longer treated as a purely technical matter delegated to IT departments. Second, dedicated internal committees to monitor IT risks on an ongoing basis. Third, a strict six-hour window for reporting cyber incidents to the regulator. This last requirement is significant. It forces institutions to detect, assess, and escalate incidents rapidly, reducing the window during which an attack can cause undetected damage.
The RBI has also proposed a kill switch mechanism. This allows users to freeze all financial transactions from their accounts instantly when they suspect fraud. The central bank also revised its fraud compensation mechanism, expanding the categories of victims eligible for compensation and including newer digital scams within its definition. …
Discuss the potential threats of cyber attack and the security framework to prevent it.
Keeping in view India's internal security, analyse the impact of cross-border cyber attacks. Also discuss defensive measures against these sophisticated attacks.
Discuss how emerging technologies and globalisation contribute to money laundering. Elaborate measures to tackle the problem of money laundering both at national and international levels.
With reference to 'Financial Stability and Development Council', consider the following statements:
1.It is an organ of NITI Aayog.
2.It is headed by the Union Finance Minister.
3.It monitors macroprudential supervision of the economy.
Which of the statements given above is/are correct?
Consider the following statements regarding SEBI's IT Resilience Index (ITRI) for Market Infrastructure Institutions:
1.Availability and Security each carry the highest weightage of 20% among the nine parameters.
2.Scalability and the 'Others' parameter each carry a weightage of 10%.
3.MIIs must compute the ITRI on a quarterly basis and submit the analysis within 30 days.
4.The ITRI framework is set to come into effect from early 2027.
Which of the statements given above is/are correct?
Consider the following pairs regarding SEBI's IT Resilience Index (ITRI) parameters and their respective weightages:
1.Availability — 20%
2.Business Continuity — 10%
3.Scalability — 10%
4.Governance — 5%
How many of the pairs given above are correctly matched?
Consider the following statements regarding the RBI's new comprehensive cybersecurity framework for banks and financial institutions:
1.It mandates board-level ownership of cyber risk, removing sole responsibility from IT departments.
2.Banks must report cyber incidents to the RBI within six hours of detection.
3.The framework proposes a 'kill switch' allowing regulators to suspend a bank's operations during a cyber attack.
4.It expanded the fraud compensation mechanism to include newer digital scams.
Which of the statements given above is/are correct?
With reference to SEBI's FIRE format, consider the following statements:
1.FIRE stands for Format for Incident Reporting Exchange.
2.It requires a single comprehensive report to be filed within 24 hours of a cyber incident.
3.It allows staged reporting to reflect the incident lifecycle from initial reporting to final closure.
Which of the statements given above is/are correct?
Which of the following best explains why AI-driven cyber threats are considered qualitatively different from traditional cyber attacks on financial systems?
Want the full note, Prelims Facts & MCQ answers?
Create a free account — takes less than a minute.
Create free account