Prime Minister Shri Narendra Modi inaugurates RBI’s newly established Data Centre and Cybersecurity Training Institute in Bhubaneswar, Odisha

1. At a Glance

• The Reserve Bank of India (RBI) has opened a Data Centre and a Cybersecurity Training Institute in Bhubaneswar, Odisha. The Prime Minister inaugurated them [1].
• The project adds to RBI's computing infrastructure. It also provides research and capacity building in central banking, technology and cybersecurity [2].
• UPSC relevance: It touches cyber security of critical financial infrastructure (GS-III), financial inclusion (GS-III), and regional development in Eastern India.
• The PM's framing: the last decade was about "banking the unbanked". The next decade is about making banking "more efficient and reliable" [1].

2. Why in the News

• 25 Oct 2026: PM Narendra Modi inaugurated RBI's new Data Centre and Cybersecurity Training Institute in Bhubaneswar [1].
• He said modern warfare targets economies through changing cyber threats. A rising economic power must protect its financial system from "cyber looters and cyber terrorists" [1].
• He called for replacing outdated training tools with modern infrastructure and skilled human resources. This is the institute's stated role [1].

3. Background & Evolution

• 2 Jun 2016: RBI issued the Cyber Security Framework in Banks (RBI/2015-16/418) to all Scheduled Commercial Banks except RRBs. It cited a sharp rise in the number, frequency and impact of cyber incidents [3].
• 22 Mar 2023: RBI Governor Shaktikanta Das laid the foundation stone for a "Greenfield Data Centre" and an "Enterprise Computing & Cybersecurity Training Institute" in Bhubaneswar [2].
• The campus covers 18.55 acres [2].
• Its stated aim is a "future ready RBI", serving the needs of RBI and the financial sector [2].

• The Chief Secretary of Odisha, senior bankers and RBI officials attended [2].

• 25 Oct 2026: The PM inaugurated both facilities [1].

• Related earlier steps:
• CSIRT-Fin handles financial-sector cyber incidents under the guidance of CERT-In [5].
• RBI requires payment system operators to have their systems audited every year by CERT-In-empanelled auditors [5].

4. Core Static Facts

What the 2016 framework requires [3]:

• A Board-approved cyber security policy, kept separate from the IT/IS security policy.
• A Security Operations Centre (SOC) for continuous, real-time monitoring.
• A Cyber Crisis Management Plan (CCMP) covering detection, response, recovery and containment.
• Prompt reporting of all unusual cyber incidents to RBI, including unsuccessful attempts, using the Annex-3 format. Banks are encouraged to report to IB-CART too.
• Indicators of cyber preparedness, checked through independent audit.
• Review of the IT architecture by the Board's IT Sub-Committee.

Financial-inclusion figures the PM cited [1]:

• Jan Dhan accounts: ~60 crore.
• Mudra Yojana: 13 crore first-time entrepreneurs.
• SHGs: 10 crore rural women received bank assistance.
• Atal Pension Yojana: 9 crore subscribers, including 38 lakh in Odisha.
• PMSBY: ₹20 yearly premium for ₹2 lakh accident cover.
• PMJJBY: life cover for under ₹450 a year.
• Insurance claims paid out: over ₹25,000 crore.
• Ayushman Arogya Mandirs: ~1.75 lakh.

5. Multi-Dimensional Analysis

Scientific / Technological

• The data centre adds robust computing systems to make banking more efficient and reliable [1].
• The institute builds skilled people to defend the financial sector against cyber threats [1][2].
• It sits alongside rules that already require SOCs, crisis plans and incident reporting at banks [3].

Geopolitical / Strategic (internal security)

• The PM described cyber threats as part of modern warfare aimed at economies [1].
• Sector-specific incident response: CSIRT-Fin works under CERT-In [5].
• Cooperation with private firms: CERT-In has partnered with Mastercard on financial-sector cyber security, covering incident response, capacity building and threat intelligence [4].

Economic

• Digital banking now gives 24-hour banking services [1].
• The PM said Direct Benefit Transfers have no leakages and the full amount reaches the beneficiary's account. He credited Jan Dhan accounts for this [1].
• People without collateral can now get formal credit through Mudra, PM SVANidhi and PM Vishwakarma [1].

Social

• Banks were nationalised in the 1960s and 1970s, yet more than half the population stayed outside the banking system until 2014 [1].
• SHGs of 10 crore rural women have received bank credit [1].
• Low-premium insurance (PMSBY, PMJJBY) has reached the poor and the middle class [1].
• RuPay cards were presented as symbols of self-respect and self-reliance [1].

Regional / Administrative

• Eastern India was presented as a growth engine for Viksit Bharat [1].
• Odisha's "mines to microchips" plan pairs its mineral industries with semiconductors, electronics, data centres and advanced computing [1].
• The governance model he described rests on balanced regional growth and last-mile delivery [1].

Ethical / Governance

• The PM described a "Pro-People, Pro-Active Good Governance" model with the motto "Nagrik Devo Bhava" [1].
• Accountability in cyber risk: banks must record their risk trade-off decisions in writing, and their Boards and top management must receive cyber awareness training [3].

6. Recent Developments (last 12–18 months)

• 25 Oct 2026: The PM inaugurated RBI's Data Centre and Cybersecurity Training Institute in Bhubaneswar [1].
• My searches found no other dated whitelisted-source developments in this window. The CERT-In–Mastercard partnership [4] appears to date from mid-2024, which is outside the window, and I only saw it as a search summary.

7. Prelims Hooks

• The RBI Data Centre and Cybersecurity Training Institute is in Bhubaneswar, Odisha [1].
• The foundation stone was laid on 22 Mar 2023 by RBI Governor Shaktikanta Das [2].
• The PM inaugurated it on 25 Oct 2026 [1].
• The campus covers 18.55 acres [2].
• The 2023 name was "Enterprise Computing & Cybersecurity Training Institute" [2].
• The data centre is described as a "Greenfield" data centre [2].
• RBI's Cyber Security Framework in Banks is dated 2 Jun 2016. It excludes Regional Rural Banks [3].
• The 2016 framework requires a Board-approved cyber security policy separate from the IT/IS policy [3].
• The 2016 framework requires banks to set up a Security Operations Centre (SOC) [3].
• Banks must report even unsuccessful cyber attempts to RBI, in the Annex-3 format [3].
• CSIRT-Fin works under the umbrella of CERT-In [5].
• Payment system operators must have a yearly audit by CERT-In-empanelled auditors [5].
• PMSBY: ₹20 yearly premium, ₹2 lakh accident cover [1].
• Atal Pension Yojana: ~9 crore subscribers [1].
• "From mines to microchips" is the PM's slogan for Odisha's industrial shift [1].

8. Most Frauds Trick the Customer, Not the Computer

• Digital payment fraud has grown much faster than the systems built to stop it
• Reported frauds rose from 2.6 lakh in 2021 to 28 lakh in 2025. That is more than ten times as many cases [6].
• The money lost rose from ₹551 crore to ₹22,931 crore in the same period. That is about 40 times as much [6].

• Over the past ten years, the number of digital transactions grew 38 times. So fraud is not just growing because payments are growing. It is growing faster [6].

• The main danger is the person being fooled, not the bank's computer being broken into

• RBI says most frauds are APP frauds (Authorised Push Payment: the victim is tricked into sending the money and approving it with their own PIN or OTP) [6].
• Account take-over frauds, where a criminal gets into someone's account, are now "negligible" [6].

• The tricks are social: fake call centres, deepfake (AI-made fake voice or video) impersonation, and threats [6].

• So the new facilities guard one door, but the fraud comes in through another

• A data centre and a training institute make RBI's own systems and staff stronger [2].
• But the bank's systems work exactly as designed in an APP fraud. The OTP is correct and the customer approves the payment. No firewall stops it.

• This means the PM's goal of "reliable" banking [1] depends on protecting the customer as much as protecting the server.

• The newest bank users are the easiest to target

• RBI notes that senior citizens and other vulnerable groups suffer most [6].

• The first-time account holders the PM counted (Jan Dhan, SHGs, APY) [1] are often new to digital tools. Financial inclusion without fraud protection hands criminals new victims.

• Instant payments leave no time to get the money back

• UPI, IMPS, NEFT and RTGS settle almost at once, so there is little chance to stop or recover a payment [6].
• Fraudsters move the money quickly through mule accounts (bank accounts rented or borrowed to pass stolen money along) [6].

9. Banks Hand Their Cyber Defence to Outside Vendors

• Almost every major lender depends on outside firms for security
• In an RBI survey of major banks and NBFCs, 93% said they rely partly or heavily on outside vendors for security work [7].
• This includes the SOC (Security Operations Centre: the team that watches systems around the clock), cloud security and incident response [7].

• Those surveyed ranked dependence on third parties and supply chains as the second most important cyber risk [7].

• When many banks use the same few vendors, one breach can spread to all of them

• RBI warns of concentration risk (too much depending on too few providers) [7].
• A major attack on one vendor could hit many regulated entities at once and threaten financial stability (the ability of the whole system to keep working in a shock) [7].

• The 2016 framework requires each bank to set up a SOC [3]. It does not stop many banks from buying that SOC from the same outside firm.

• Banks may be too confident about their own safety

• 98% of those surveyed rated their own cyber risk as only low to moderate [7].
• The same survey points to old technology and slow patching (installing security fixes) as linked weak points [7].

• A bank that sees its own risk as low while depending on outsiders for defence may not be counting the vendor's weak points as its own.

• Audits are many, but an audit is a snapshot

• CERT-In carried out 9,708 security audits in 2024–25. Of these, 7,547 were in banking, financial services and insurance [8].
• An audit checks a system on one date. It cannot replace trained staff inside the bank who watch for attacks every day. That gap in staff skills is what a training institute is meant to fill [1].

10. Should Payments Be Slowed Down to Stop Fraud?

• The proposal on the table
• In April 2026, RBI floated a one-hour delay for push payments of ₹10,000 or more. The payer could cancel during that hour [6].

• Other options: a trusted person must also approve transfers above ₹50,000 (compulsory for people aged 70+ and persons with disabilities), a ₹25 lakh yearly limit on credits into an account before extra checks, and an on/off kill switch for each payment channel [6].

• The strongest objection: this breaks what made UPI succeed

• Instant, any-time payment is the main selling point of Indian digital payments. The PM himself cited 24-hour banking as a gain [1].
• A delay adds friction for millions of honest users to catch a small number of frauds.

• A "trusted person" rule could make elderly and disabled users depend on someone else for their own money. That person could also misuse that role.

• What the objection gets right

• Friction is a real cost. A rule that makes every payment slower would push people back to cash.

• The trusted-person rule does raise a dignity and autonomy question for the very groups it means to protect.

• Why a narrow delay is still worth it

• The ₹10,000 limit is not random. Payments above it are about 45% of fraud cases but 98.5% of fraud value [6].
• About 92% of the fraud value is in payments above ₹50,000 [6].
• So most everyday payments (tea, groceries, auto fare) stay instant. The delay hits the large transfers where almost all the money is lost.

• The paper also proposes whitelisting (marking known payees as safe), so regular transfers to family need not wait [6].

• Fair conclusion: the debate is not "speed versus safety" for all payments. It is about where to draw the line. RBI's own data supports a line at large transfers to new payees.

11. What RBI, Banks and Government Should Do Next

• RBI: build fraud checks into the payment, not after it
• After a payment, recovery is slow and little money comes back [6].
• The DPIP (Digital Payment Intelligence Platform) would give a risk score before a payment goes through [6]. RBI plans to look at rolling it out in full in 2026–27 [7].

• Mulehunter.AI, built by the Reserve Bank Innovation Hub (RBIH) in 2024, helps banks find mule accounts [6]. Its use should spread to all banks, so stolen money has nowhere to go.

• RBI: update the 2016 customer liability rule for APP fraud

• The 2016 rules limit a customer's loss only for unauthorised transactions [6].
• In an APP fraud the victim technically "authorised" the payment, so these protections often do not apply.

• RBI has said it will bring a compensation system for small-value electronic banking frauds [7]. It should make clear whether tricked customers are covered.

• The new institute: train the banks that cannot afford their own experts

• The 2016 framework did not cover Regional Rural Banks [3]. These are the banks that serve many first-time rural account holders [1].
• Smaller lenders are the most likely to depend fully on outside vendors [7].

• The Bhubaneswar institute's mandate covers the financial sector, not just RBI [2]. Its courses should put RRB and co-operative bank staff first.

• RBI: treat vendors as part of the bank's risk

• Since 93% of lenders depend on outside security firms [7], RBI should know which vendors serve many banks at once and test those vendors directly.

• Banks: give cyber risk a named owner at the top

• In May 2025, the Finance Minister asked banks to name dedicated senior officials for cyber-security matters [9].
• This builds on the 2016 rule that Boards approve the cyber policy and receive awareness training [3]. The test is whether these officials have real authority and staff, not just a title.

12. Anchors for Answers

• Data: Digital payment frauds reported on the National Cyber Crime Reporting Portal rose from 2.6 lakh (₹551 crore) in 2021 to 28 lakh (₹22,931 crore) in 2025 [6]
• Data: Payments above ₹10,000 are about 45% of fraud cases but 98.5% of fraud value [6]
• Data: 93% of major banks and NBFCs surveyed rely on outside vendors for cyber-security functions [7]
• Data: CERT-In conducted 9,708 security audits in 2024–25, of which 7,547 were in the BFSI sector [8]
• Data: CERT-In handled over 29.44 lakh cyber incidents in 2025 [10]
• Report/Committee: RBI Discussion Paper, "Exploring safeguards in digital payments to curb frauds" (Apr 2026) — one-hour lag, trusted person, credit ceiling, kill switch [6]
• Report/Committee: RBI Financial Stability Report, cyber-risk box — third-party dependence and concentration risk [7]
• Law/Case: RBI Cyber Security Framework in Banks, RBI/2015-16/418 (2 Jun 2016) [3]
• Scheme: Digital Payment Intelligence Platform (DPIP) — risk score before a payment is made; Mulehunter.AI (RBIH, 2024) — detects mule accounts [6]
• Scheme: PM Jan Dhan Yojana — about 60 crore accounts, which brought many new and vulnerable users into digital banking [1]

13. Mains Relevance

• GS-III (Security): challenges to internal security through communication networks; basics of cyber security.
• GS-III (Economy): inclusive growth; financial inclusion; banking sector; infrastructure.
• GS-II (Governance): e-governance; welfare schemes for vulnerable sections.

Possible question stems:

1. As India's financial system becomes digital, cyber resilience becomes a matter of national security. Discuss the institutional framework for cyber security in India's banking sector and suggest reforms. (15 marks)
2. Financial inclusion in the last decade was about access. In the next decade it must be about trust and security. Examine this statement. (10 marks)
3. Evaluate the role of specialised capacity-building institutions in closing the cyber-skills gap in India's financial sector. (10 marks)

14. Related Topics to Study Next

• CERT-In and CSIRT-Fin: the national and financial-sector incident-response bodies [5].
• RBI Cyber Security Framework (2016): the baseline rules for SOCs, crisis plans and incident reporting at banks [3].
• PM Jan Dhan Yojana and the JAM trinity: the base for leakage-free DBT [1].
• PMSBY, PMJJBY and APY: the social-security schemes behind the figures quoted [1].
• Mudra, PM SVANidhi and PM Vishwakarma: credit for borrowers without collateral [1].
• India Semiconductor Mission and Odisha's industrial policy: the "mines to microchips" idea [1].
• Data localisation and payment-system security: linked to RBI's audit rules for payment operators [5].

15. NCERT Concepts to Revise

• Financial inclusion (Economy): The PM framed the last decade as 'banking the unbanked'; Jan Dhan, Mudra and insurance figures anchor the note.
• Digital payments (Economy): Much of the note covers rising digital payment fraud and RBI's proposed safeguards like payment delays.
• Financial stability (Economy): Concentration risk from shared cyber vendors could threaten the whole financial system, linking cyber security to stability.
• Financial infrastructure (Economy): Data centre, payment systems and incident-response bodies are the critical financial infrastructure being protected from cyber threats.
• JAM trinity (Polity): Jan Dhan, Aadhaar and mobile underpin leakage-free DBT and bring new, vulnerable users into digital banking.
• Payment system (Economy): Instant settlement via UPI, IMPS and RTGS leaves little time to recover frauded money; RBI audits payment operators.

16. Common Errors / Trap Areas

• Who did what: the Governor (Das) laid the foundation stone in 2023 [2]; the PM inaugurated it in 2026 [1]. Don't swap them.
• The institute's name: the 2023 name includes "Enterprise Computing" [2]. The 2026 release says only "Cybersecurity Training Institute" [1].
• Coverage of the 2016 framework: it applies to Scheduled Commercial Banks but not RRBs [3]. Urban co-operative banks were covered by a separate framework.
• No fixed reporting deadline in hours: the 2016 RBI circular says incidents must be reported "promptly" [3]. Don't mix this up with CERT-In's separate reporting deadlines.
• CSIRT-Fin is not an RBI body. It works under CERT-In [5].