Why in news?

As Artificial Intelligence increasingly enables sophisticated fraud, deepfakes and attacks on critical financial infrastructure, India's key financial regulators — the RBI and SEBI — are overhauling cybersecurity frameworks to safeguard the financial ecosystem.

What’s in Today’s Article?

• The Rising Threat Landscape
• SEBI's IT Resilience Index (ITRI)
• Standardised Incident Reporting: The FIRE Format
• RBI's Cybersecurity Framework
• The "Kill Switch" Mechanism
• SEBI's Forthcoming AI Guidelines
• Expert Recommendations

The Rising Threat Landscape

• AI is transforming the nature of financial fraud. Deepfake voices are being used to bypass KYC norms, while more complex scams are infiltrating critical financial institutions.
• Several banks have already faced cybersecurity breaches in 2026.
• Unlike traditional threats built around identifiable vulnerabilities and periodic assessments, AI dramatically increases the speed, scale and sophistication of attacks — from automated vulnerability discovery to autonomous cyberattacks.

SEBI's IT Resilience Index (ITRI)

• SEBI has introduced an IT Resilience Index for Market Infrastructure Institutions (MIIs) — entities like clearing corporations and exchanges that enable trading.
• Key features:
  • Quantifies cyber readiness across nine parameters.
  • Availability and security: 20% weightage each.
  • Integrity, governance, reliability and monitoring, modularity and flexibility, business continuity: 10% weightage each.
  • Scalability and miscellaneous ("others"): 5% weightage each.
  • MIIs must compute ITRI half-yearly, submit comparative analysis within 60 days, and outline corrective action.
  • Framework takes effect from early 2027.
  • Includes an "early warning system" for continuous risk monitoring.

Standardised Incident Reporting: The FIRE Format

• SEBI has aligned its cyber incident reporting portal with a standardised "Format for Incident Reporting Exchange" (FIRE).
• This enables staged reporting — from initial disclosure through intermediate updates to final closure — while accommodating incomplete information at the time of first reporting.

RBI's Cybersecurity Framework

• The RBI released a comprehensive cybersecurity framework for banks and financial institutions, mandating:
  • Board-level ownership of cyber risks.
  • Dedicated committees to monitor IT risks.
  • A strict six-hour window for reporting cyber incidents.
  • A revised fraud compensation mechanism (June 2026) expanding victim eligibility and covering newer digital scams.

The "Kill Switch" Mechanism

• Both regulators are exploring a "kill switch":
  • RBI: Would allow users to halt all financial transactions during fraud
  • SEBI: Evaluating a similar mechanism as part of upcoming AI guidelines

SEBI's Forthcoming AI Guidelines

• SEBI plans to "shortly" issue guidelines for the responsible use of AI and machine learning in markets.
• It already uses AI to flag suspicious trading patterns and has constituted a dedicated team to extend AI-based surveillance to corporate investigations, including scrutiny of quarterly filings.

Expert Recommendations

• Legal experts suggest regulators should focus on:
  • AI-specific threat modelling
  • Continuous (not periodic) testing
  • Third-party and cloud concentration risks
  • Model and data integrity
  • Deepfake-enabled fraud and supply-chain vulnerabilities
  • Clear human accountability where AI influences critical decisions
  • Technology-neutral accountability backed by technology-specific safeguards, rather than an overly prescriptive code

Conclusion

AI has fundamentally altered the financial fraud threat matrix, prompting RBI and SEBI to modernise cybersecurity frameworks through tools like ITRI, FIRE reporting and kill-switch mechanisms.

Sustained regulatory agility, technology-neutral accountability and AI-enabled defensive systems remain critical to securing India's financial infrastructure.