Critical financial infrastructure is now a frontline of national security. Discuss with reference to RBI's recent investments in Tier IV data centres and cybersecurity capacity-building.

Payment and settlement systems, governed by the Payment and Settlement Systems Act, 2007, now carry India's economic activity. If they fail, the economy can stall without any armed attack. RBI's new Bhubaneswar campus shows that the state now treats this infrastructure as a security asset.

Why financial infrastructure is a security frontline

• Contagion from weak entry points: in 2018, attackers broke into a cooperative bank's ATM switch and then misused the SWIFT network [4].
• Failures without an enemy: the 2024 CrowdStrike outage was caused by one faulty update, not a cyberattack, yet disruption was widespread [4].
• Concentration risk: when many banks depend on the same vendor, one failure becomes many [4].
• Hybrid threats: payment systems are attractive targets for actors who want to disrupt a country without open conflict.

RBI's recent investments

• Resilient hardware: the Bhubaneswar facility has four data centres hosting mission-critical payment and settlement systems. It is certified Uptime Institute Tier IV and is among the largest such facilities in the BFSI sector worldwide [1]. Earlier, RBI's second greenfield data centre achieved Tier IV design certification [3].
• Geographic spread: placing it in Odisha, away from Mumbai, strengthens disaster recovery [1].
• Capacity-building: the Enterprise Computing and Cybersecurity Training Institute campus at Bhubaneswar [2] aims to build a "safe and responsible cyber culture" [3]. It focuses on quantum computing and AI for the wider financial sector [1], which helps prepare for post-quantum cryptography.

Gaps that remain

• Tier IV covers infrastructure (power, cooling, hardware), not software or people [1]. It cannot stop a faulty update.
• The weakest link lies outside RBI: a hardened central bank does not protect a vulnerable cooperative bank connected to the same payment rails [4].
• Accountability: "Technology may be outsourced, but not the accountability" [4].

Way forward

• Extend the institute's training to cooperative and smaller banks.
• Require staged software deployment, proper testing and fallback arrangements [4].
• Manage third-party dependencies and regularly test recovery and resilience [4]. Coordinate with CERT-In and NCIIPC.

RBI's Tier IV investments and its training push show that it treats financial resilience as part of national security. The next step is to spread that resilience from RBI's own buildings to every bank and vendor in the system. Then digital public infrastructure can stay both trusted and secure, in line with SDG 9 on resilient infrastructure.