Cyber resilience is now a financial-stability issue. Discuss with reference to the Financial Sector Cyber Security Strategy and the vulnerabilities of Regional Rural Banks.

At its 30th meeting (23 October 2026), the Financial Stability and Development Council (FSDC) reviewed the sector's cyber resilience alongside global bond-yield and geopolitical risks [1]. That placement matters. A cyber breach is no longer one firm's IT failure. It can now trigger disruption across the whole financial system.

Why cyber risk is a systemic risk

• Interconnectedness: IMF–World Bank FSAP mapping identified over 100 critical services across India's financial and cyber systems [3]. One attack on a shared payment switch or cloud vendor can hit banks, insurers and brokers at once.
• Regulatory silos: RBI, SEBI, IRDAI and PFRDA each supervise their own sector, but attacks cross sector lines. This is why MeitY, MCA and the DG, CERT-In attended the 30th meeting [1].
• Critical infrastructure: the Council discussed Critical Information Infrastructure (CII) protection along with stability risks [1].

Financial Sector Cyber Security Strategy (FSCSS)

• Origin: the 29th FSDC (June 2025) proposed a sector-specific strategy based on FSAP 2024-25 recommendations [2]. An Inter-Ministerial Group was set up in August 2025 to draft it [4].
• Design: regulators and cyber agencies drafted it together, coordinating with DEA, DFS and MeitY [1]. This is a whole-of-government approach.
• Gaps: the Council only "took note" of the FSCSS. The release names no deadline and no enforcing body [1]. It also does not mention the cross-sector crisis simulations the IMF recommended [3].

Vulnerabilities of Regional Rural Banks (RRBs)

• Weakest-link problem: RRBs have small IT budgets and few specialist staff, yet they use the same national payment rails as large banks.
• Customer profile: their rural customers often have low digital literacy, which leaves them more exposed to phishing and fraud.
• Apex attention: the 30th meeting specifically reviewed RRB cybersecurity preparedness [1], which shows this gap is now seen as a systemic risk.

Way forward

• Adopt the FSCSS on a fixed timeline, with a nodal agency accountable for it.
• Run regular cross-sector cyber drills and stress tests that include RRBs [3].
• Set up shared security-operations support for RRBs, led by their sponsor banks.

Cyber resilience is now as central to financial stability as capital and liquidity. The FSCSS should become a time-bound, tested framework that reaches RRBs first. That would secure India's expanding digital finance and support SDG 9's goal of resilient infrastructure.