Cyberattacks and technological failures are now seen as potential triggers of financial crises. Discuss the regulatory measures needed to build operational resilience in Indian banking.

RBI Governor Sanjay Malhotra recently warned that "the next financial crisis may begin with a geopolitical event, a cyberattack, or a technological failure" [1]. Indian banking now runs on digital rails. So operational resilience (the ability to keep critical services running through a disruption) is a financial-stability concern, not just an IT issue.

Why technology failures can become systemic

• Interconnection: the IMF's 2025 FSAP found India's system more diverse but also more interconnected as NBFCs and market finance grow [7]. One outage can therefore spread across institutions.
• Third-party concentration: many banks use the same cloud, data-centre and managed-security vendors. RBI's 2023 outsourcing directions now cover these vendors [4]. One vendor failure can hit many banks at once.
• Trust shocks: a payment freeze can trigger a digital run. This tests the Governor's goal of providing services "even under severe shocks" [1].

Existing framework

• Cyber Security Framework (2016): board-approved cyber policy, Security Operations Centre and Cyber Crisis Management Plan [2].
• IT Governance Directions (2023): board oversight, business continuity and disaster recovery [3].
• Guidance Note on Operational Risk and Resilience (2024): aligned with Basel principles [5].
• CERT-In directions (2022): cyber incidents must be reported within 6 hours [6].

Regulatory measures needed

• From guidance to standards: require banks to map critical services, set tolerances for disruption and test severe-but-plausible scenarios [5].
• Critical third-party oversight: keep concentration registers, audit rights and exit plans [4]. Coordinate with MeitY on systemic tech providers.
• System-wide cyber stress tests: run joint drills with SEBI and IRDAI through the FSDC, because the risk extends beyond banks [7].
• Better data: one common incident-reporting window for RBI and CERT-In [6], shared threat intelligence and SupTech (supervisory technology).
• Proportionality: stricter norms for systemic banks and simpler baselines for small lenders [1][5].
• Accountability: boards own technology risk, and the supervisor sets the minimum standard.

Operational resilience, like capital, is a buffer that has to be built before the shock. RBI can turn its 2024 guidance into tested standards, oversee critical vendors and coordinate other regulators through the FSDC. That would keep Indian banks serving customers in all conditions and protect the trust that Digital India and SDG target 8.10 on financial access depend on.