Summary: The International Financial Services Centres Authority (IFSCA), through Circular IFSCA-CSD/MSC/4/2026-DCS dated October 27, 2026, has prescribed cyber security and cyber resilience certification requirements for designated officers and specified employees of regulated entities in IFSCs. Developed by the National Institute of Securities Markets in collaboration with IFSCA, the Basic certification examination goes live on November 18, 2026, while the Advanced examination goes live on December 30, 2026. Designated Officers of regulated entities and Chief Information Security Officers of Market Infrastructure Institutions must obtain both certifications. Compliance Officers and employees responsible for IT operations or information security, or having privileged access to critical systems, must obtain the Basic certification and are encouraged to obtain the Advanced certification. The circular’s table also encourages both certifications for all other employees. Persons subject to mandatory certification must obtain the applicable qualification within six months from the respective examination’s launch or within six months from appointment to the relevant role, whichever is later. They must continuously maintain valid certification while performing that role. Regulated entities must retain certification records and provide them to IFSCA when requested. The circular also requires structured, continuous and role-appropriate cyber security training for governing boards, senior management and employees, proportionate to operational complexity and cyber risk exposure. Issued under Sections 12 and 13 of the International Financial Services Centres Authority Act, 2019, the circular takes immediate effect.
International Financial Services Centres Authority
Circular No. IFSCA-CSD/MSC/4/2026-DCS | Dated: October 27, 2026
To,
All Regulated Entities in the International Financial Services Centres (IFSCs)
Dear Madam/Sir,
Sub: Certification on Cyber Security and Cyber Resilience for Designated Officers and other specified employees of Regulated Entities in the IFSCs
1. IFSCA, vide circular dated March 10, 2025, issued the Guidelines on Cyber Security and Cyber Resilience for Regulated Entities in IFSCs, subsequently amended vide circular IFSCA-CSD/MSC/1/2026-DCS dated March 10, 2026. The circular established a principles-based minimum baseline framework for cyber security and cyber resilience applicable to all Regulated Entities (REs) in IFSC.
2. Further, recognizing the critical role of Market Infrastructure Institutions (MIIs) in ensuring the orderly functioning, integrity and resilience of financial markets, IFSCA, vide circular IFSCA-CSD/MSC/2/2026-DCS dated April 20, 2026, issued the Guidelines on Cyber Security and Cyber Resilience for Market Infrastructure Institutions (MIIs) in IFSC, prescribing additional requirements commensurate with their systemic importance and operational criticality.
3. The Guidelines applicable to all REs, inter alia, require the REs to ensure that their Governing Boards and senior management possess adequate knowledge, expertise and understanding of cyber security risks to effectively discharge their responsibilities relating to cyber risk governance, oversight and management. The Guidelines further mandate regular cyber security training for employees to strengthen organizational awareness, preparedness and resilience against evolving cyber threats. In addition, the Guidelines applicable to MIIs specifically require such institutions to ensure that all personnel have the requisite level of cyber security and information security awareness, supported by appropriate training.
4. Cyber Security awareness and capacity building are fundamental components of an effective cyber resilience framework and constitute an essential element of institutional governance and risk management. Accordingly, REs shall adopt a structured, continuous and role-appropriate approach to cyber security training and awareness encompassing their Governing Boards, senior management and employees. Such initiatives shall be commensurate with the nature, scale and complexity of their operations and the cyber risks to which they are exposed.
5. With a view to establishing a common knowledge benchmark on cyber security and cyber resilience across the IFSC ecosystem, the National Institute of Securities Markets (NISM), in collaboration with IFSCA, has developed the following certification courses:
i) ‘NISM-IFSCA-02A: Certification Course on Cyber Security and Cyber Resilience in the GIFT IFSC (Basic)’, the certification examination for which goes live on November 18, 2026 (hereinafter referred to as the ‘Basic Cyber Security Certification’)
ii) ‘NISM-IFSCA-02B: Certification Course on Cyber Security and Cyber Resilience in the GIFT IFSC (Advanced)’, the certification examination for which goes live on December 30, 2026 (hereinafter referred to as the ‘Advanced Cyber Security Certification’)
6. Accordingly, with a view to strengthening the cyber security and cyber resilience capabilities of the REs, IFSCA has decided that:
a) The Designated Officer of the RE, as referred to in para 6 of the Guidelines on Cyber Security for all REs, and in the case of MIIs, the Chief Information Security Officer (CISO) appointed in terms of para 7 of Annexure A to the Guidelines on Cyber Security for MIIs, shall mandatorily obtain both the Basic Cyber Security Certification and the Advanced Cyber Security Certification
b) The Compliance Officer of the RE and the employees of the RE responsible for IT operations or information security, or having privileged access to the critical systems of the RE, shall mandatorily obtain the Basic Cyber Security Certification
c) All other employees of the RE are encouraged to obtain the Basic Cyber Security Certification. The Compliance Officer and the employees referred to in para 6(b) above are also encouraged to obtain the Advanced Cyber Security Certification.
7. The applicable certification requirements are summarised below:
| Personnel of the RE | Basic (02A) |
Advanced (02B) |
|---|---|---|
| Designated Officer (para 6 of the Guidelines for all REs); for MIIs, the CISO appointed under para 7 of Annexure A to the MII Guidelines | Mandatory | Mandatory |
| Compliance Officer | Mandatory | Encouraged |
| Employees responsible for IT operations or information security, or having privileged access to critical systems | Mandatory | Encouraged |
| All other employees | Encouraged | Encouraged |
8. The persons referred to in para 6(a) and para 6(b) above shall obtain the respective certification within six (6) months from the date on which the respective certification examination goes live, or within six (6) months from the date of their appointment to such role, whichever is later. Such persons shall continue to hold a valid certification at all times while discharging their responsibilities in such role.
9. The REs shall maintain records of the certifications obtained by the persons referred to in para 6(a) and para 6(b) above and shall make the same available to IFSCA as and when sought.
10. The details of the courses and the link for registration may be found at https://www.nism.ac.in/nism-ifsca-certification-course.
This Circular is issued in exercise of the powers conferred by Sections 12 and 13 of the International Financial Services Centres Authority Act, 2019, to develop and regulate the financial services market in the International Financial Services Centre.
This Circular shall come into force with immediate effect. A copy of this circular is available on the website at www.ifsca.gov.in.
Yours Faithfully,
Praveen Kamat
Chief General Manager and CISO
Division of Cyber Security
Email: [email protected]
Tel: +91- 079 – 61809820
