As India's financial system becomes digital, cyber resilience becomes a matter of national security. Discuss the institutional framework for cyber security in India's banking sector and suggest reforms.

The Prime Minister opened RBI's Data Centre and Cybersecurity Training Institute at Bhubaneswar in October 2026. He warned that modern warfare targets economies through cyber attacks [1]. Banking now runs on digital rails, so a cyber breach can do strategic damage. That makes cyber resilience a national-security concern.

Institutional Framework

• Regulatory layer: RBI's Cyber Security Framework in Banks (2016) requires four things [2]:
• a Board-approved cyber policy
• a Security Operations Centre (SOC)
• a Cyber Crisis Management Plan

• prompt reporting of all incidents to RBI, including failed attempts

• Response layer: CERT-In is the national nodal agency. CSIRT-Fin works under its umbrella for the financial sector [3].

• Audit layer: CERT-In carried out 9,708 security audits in 2024–25. Of these, 7,547 were in banking, financial services and insurance [4].
• Capacity layer: the new Bhubaneswar institute builds skilled cyber manpower to replace outdated training tools [1].

Gaps

• Fraud targets people, not systems: most digital frauds are Authorised Push Payment (APP) frauds. Victims are tricked into approving the payment themselves, so firewalls do not stop them [5].
• Vendor concentration: 93% of surveyed banks and NBFCs depend on outside vendors for SOC and incident-response work. One breach at a shared provider could spread across many lenders [6].
• Uneven coverage: the 2016 framework left out Regional Rural Banks, which serve many first-time account holders [2].
• Instant settlement: UPI and IMPS settle almost at once. Money moved through mule accounts is rarely recovered [5].

Reforms

• Targeted friction: RBI's April 2026 discussion paper proposes a one-hour delay for payments above ₹10,000. Such payments are about 45% of fraud cases but 98.5% of fraud value, so everyday small payments would stay instant [5].
• Checks before payment: roll out the Digital Payment Intelligence Platform, which scores risk before a payment goes through. Extend Mulehunter.AI to all banks to find mule accounts [5].
• Oversight of vendors: identify which vendors serve many banks and test them directly [6].
• Inclusive training: the Bhubaneswar institute should give priority to RRB and co-operative bank staff.
• Customer protection: update the liability rules so that customers tricked into APP fraud are clearly covered.

India already has a layered framework: RBI rules, CERT-In-led response, wide audits and new training capacity. Its weak points are human deception, shared vendors and smaller lenders. Fixing these together would let digital inclusion grow on a base of trust. It would also give India the resilient infrastructure that SDG 9 calls for, and make the financial system part of India's national defence.