IFSCA imposes certification requirements to enhance cyber security

IFSCA has issued circular IFSCA-CSD/MSC/4/2026-DCS dated 27 October 2026, in order to further strengthen IFSCA's existing cyber security framework, which can be found in the Guidelines on Cyber Security and Cyber Resilience for all Regulated Entities issued on 10 March 2025, and amended on 10 March 2026 (‘RE Guidelines’), and the separate, stricter guidelines for Market Infrastructure Institutions (‘MII’) issued on 20 April 2026​ (‘MII Guidelines’). These guidelines require boards and senior management to have adequate cyber risk knowledge and mandated regular employee training​. IFSCA’s latest circular converts that general training obligation into a specific, mandatory certification requirement.

Working with the National Institute of Securities Markets (NISM), IFSCA has introduced two certification courses to set a common knowledge benchmark across the IFSC ecosystem​:

1. NISM-IFSCA-02A (Basic): Certification Course on Cyber Security and Cyber Resilience in the GIFT IFSC (Basic), with the examination going live on 18 November 2026.

2. NISM-IFSCA-02B (Advanced): the Advanced version, with the examination going live on 30 December 2026.

The following individuals are required to be certified:

Deadlines. Persons in the mandatory categories must obtain the relevant certification within six months from the date the examination goes live, or within six months of their appointment to the role, whichever is later​. For existing Designated Officers and CISOs the effective deadline is 18 May 2027 for the Basic certification and by 30 June 2027 for the Advanced certification. They must hold a valid certification at all times while performing the role.

Record keeping. All regulated entities must maintain records of the certifications obtained by personnel in the mandatory categories and produce them to IFSCA on demand​.

Practical takeaway. All regulated entities in GIFT IFSC should immediately identify personnel in the mandatory categories, enrol them for the examinations, diarise the six-month deadlines, and put a process in place for tracking certification validity and maintaining records in case of any inspection by IFSCA.

Comparison with SEBI. The Securities and Exchange Board of India’s (‘SEBI’) primary cybersecurity regulation is the Cybersecurity and Cyber Resilience Framework (CSCRF), issued through circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 dated 20 August 2024, as further amended on various dates, notably December 2024 and March/April/June 2025. So far, SEBI has not prescribed any exam or certification that Designated Officers, CISOs, Compliance Officers, IT/security staff, or employees with privileged access must pass. SEBI has addressed competency through organisational training programmes, CISO seniority/reporting rules, IT Committee expertise, entity-level certifications (notably ISO 27001 for MIIs and Qualified REs), and audit/VAPT by CERT-In empanelled auditors.

[The first author is a Partner while others are Associates in Corporate and M&A practice at Lakshmikumaran & Sridharan Attorneys]

---

[1] Under the RE Guidelines every Regulated Entity should designate a Chief Information Security Officer or any other senior employee to assess, identify cyber risks and respond to them.