IFSCA Mandates New Cyber Security Certifications for Designated Officers and Key Personnel in IFSCs

The International Financial Services Centres Authority (IFSCA) has significantly raised the bar for cyber security and cyber resilience expertise within Regulated Entities (REs) operating in IFSCs. Key personnel, including Designated Officers, CISOs, Compliance Officers, and IT/information security staff, now face mandatory certification requirements to ensure a common knowledge benchmark across the ecosystem.

What Changed: The 30-Second Answer

The IFSCA, via its circular on “Certification on Cyber Security and Cyber Resilience for Designated Officers and other specified employees of Regulated Entities in the IFSCs” issued on October 27, 2026, mandates that specific officers and employees of all Regulated Entities (REs) in IFSCs must obtain new NISM-IFSCA cyber security certifications. This move aims to establish a common knowledge benchmark and bolster cyber resilience, with deadlines tied to the live dates of the certification examinations (November 18, 2026, and December 30, 2026) or appointment dates.

IFSCA Circular 2026: The New Certification Mandate

This latest IFSCA Circular 2026 builds on previous cyber security guidelines issued on March 10, 2025, and subsequently amended on March 10, 2026, which established a principles-based minimum baseline framework for all REs. For Market Infrastructure Institutions (MIIs), additional stringent requirements were introduced on April 20, 2026, acknowledging their systemic importance. The underlying principle has always been clear: Governing Boards and senior management must possess adequate knowledge of cyber security risks, and employees need regular training.

To formalize this, the IFSCA, in collaboration with the National Institute of Securities Markets (NISM), has developed two new certification courses:

‘NISM-IFSCA-02A: Certification Course on Cyber Security and Cyber Resilience in the GIFT IFSC (Basic)’ (Basic Cyber Security Certification), with the examination going live on November 18, 2026.
‘NISM-IFSCA-02B: Certification Course on Cyber Security and Cyber Resilience in the GIFT IFSC (Advanced)’ (Advanced Cyber Security Certification), with the examination going live on December 30, 2026.

This initiative aims to establish a common knowledge benchmark on cyber security and cyber resilience across the IFSC ecosystem. For more context on the IFSCA’s continuous focus on robust frameworks, see our earlier coverage on IFSCA Mandates Algorithmic Trading Approvals and Risk Controls for IFSC Stock Exchanges and Market Participants.

Who Does This IFSCA Circular 2026 Apply To?

The certification requirements are tiered, based on an individual’s role and access within a Regulated Entity (RE) in the IFSC. This applies to all REs, including MIIs, operating within the International Financial Services Centres.

Specifically, the circular mandates certifications for the following personnel:

Designated Officer (for all REs) and CISO (for MIIs): These individuals, as referred to in para 6 of the Guidelines on Cyber Security for all REs and para 7 of Annexure A to the MII Guidelines respectively, must mandatorily obtain both the Basic Cyber Security Certification and the Advanced Cyber Security Certification.
Compliance Officer and Employees with IT/Information Security Responsibilities or Privileged Access: The Compliance Officer of the RE, along with employees responsible for IT operations or information security, or those having privileged access to the critical systems of the RE, must mandatorily obtain the Basic Cyber Security Certification.
Other Employees: All other employees of the RE are encouraged to obtain the Basic Cyber Security Certification. The Compliance Officer and the aforementioned IT/information security employees are also encouraged to pursue the Advanced Cyber Security Certification.

This structured approach ensures that individuals with higher levels of responsibility and access to critical systems possess a more profound understanding of cyber security and cyber resilience. It reflects IFSCA’s recognition that cyber security awareness and capacity building are fundamental components of an effective cyber resilience framework, essential for institutional governance and risk management.

What Are the New Deadlines and Actionables?

Regulated Entities must act swiftly to ensure compliance with these new certification requirements. The deadlines are specific and depend on the live date of the examinations or the appointment date of the personnel:

Certification Timelines: Individuals falling under paragraphs 6(a) and 6(b) of the circular (Designated Officers, CISOs, Compliance Officers, and specified IT/information security employees) must obtain their respective mandatory certifications within six (6) months from the date on which the relevant certification examination goes live, or within six (6) months from the date of their appointment to such role, whichever is later.
Continued Validity: It is critical that these certified persons continue to hold a valid certification at all times while discharging their responsibilities in their designated roles. This implies a need for ongoing professional development and re-certification as necessary, though the circular does not specify re-certification intervals.

The examination for the Basic Cyber Security Certification (NISM-IFSCA-02A) goes live on November 18, 2026. The examination for the Advanced Cyber Security Certification (NISM-IFSCA-02B) goes live on December 30, 2026.

Immediate Actions for REs:

Identify Covered Personnel: All REs must immediately identify their Designated Officers, CISOs (for MIIs), Compliance Officers, and employees responsible for IT operations, information security, or those with privileged access to critical systems.
Enroll for Certifications: Ensure timely enrollment for the Basic and Advanced Cyber Security Certifications through the NISM platform (details available at https://www.nism.ac.in/nism-ifsca-certification-course).
Track Compliance: Maintain meticulous records of the certifications obtained by all mandatory personnel. These records must be made available to IFSCA upon request.
Ongoing Training: Beyond mandatory certifications, REs are still required to adopt a structured, continuous, and role-appropriate approach to cyber security training and awareness for all employees, commensurate with their operations and cyber risks.

This directive reinforces IFSCA’s commitment to robust cyber resilience, following similar regulatory pushes for enhanced expertise, such as the extensions for certification deadlines for various intermediaries, as seen in IFSCA Extends Certification Deadline for Capital Market Intermediaries’ KMPs and Employees, Issued September 30, 2026.

What This Circular Does NOT Cover

While the circular introduces clear mandates for cyber security certifications, it remains silent on several practical aspects that practitioners might seek clarification on:

Re-certification Frequency: The circular states that certified persons must “continue to hold a valid certification at all times.” However, it does not specify the validity period of the certifications or the frequency with which re-certification would be required. This could imply that once obtained, the certification is considered valid indefinitely unless NISM or IFSCA issues further guidance on renewal.
Exemptions or Equivalency: There is no mention of potential exemptions for individuals who already hold equivalent, globally recognized cyber security certifications (e.g., CISSP, CISM). The language suggests that the NISM-IFSCA certifications are mandatory regardless of existing qualifications.
Penalties for Non-Compliance: The circular outlines mandatory requirements and deadlines but does not explicitly detail the penalties or consequences for REs or individuals who fail to comply within the stipulated timeframe. Practitioners should assume that non-compliance would fall under the broader regulatory enforcement powers of the IFSCA.
Cost Reimbursement: The circular does not address whether REs are expected to bear the cost of these certifications for their employees or if employees are responsible for these expenses themselves.

Practitioners should monitor future IFSCA communications for potential clarifications on these points, especially regarding re-certification and equivalency. The immediate focus, however, must be on meeting the initial certification deadlines as specified.

The Algoy Perspective

The IFSCA’s move to mandate specific NISM-IFSCA certifications for key personnel is a welcome, albeit stringent, step towards strengthening cyber resilience in the IFSC. While the intent is clear—to establish a common knowledge benchmark—the real implementation challenge lies in the sheer volume and pace of compliance. Many REs, particularly smaller entities or those with lean compliance teams, will struggle to get their designated officers, CISOs, Compliance Officers, and IT/information security staff certified within the six-month window, especially if these individuals are already juggling multiple critical roles. The “whichever is later” clause for new appointments provides some flexibility, but for existing staff, the clock is ticking from November 18, 2026, and December 30, 2026. This isn’t just about passing an exam; it’s about allocating study time, managing operational demands, and potentially dealing with a surge in demand for NISM’s examination slots. Firms must proactively plan and budget for these certifications, treating them as non-negotiable operational imperatives rather than mere training recommendations. Failure to do so risks not only regulatory censure but also leaves entities vulnerable in an increasingly complex cyber threat landscape.

Frequently Asked Questions

What are the two new cyber security certification courses introduced by IFSCA?

The IFSCA, in collaboration with NISM, has introduced two certification courses: ‘NISM-IFSCA-02A: Certification Course on Cyber Security and Cyber Resilience in the GIFT IFSC (Basic)’ and ‘NISM-IFSCA-02B: Certification Course on Cyber Security and Cyber Resilience in the GIFT IFSC (Advanced)’. The basic examination goes live on November 18, 2026, while the advanced examination commences on December 30, 2026.

Which personnel are mandatorily required to obtain both the Basic and Advanced Cyber Security Certifications?

The Designated Officer of the RE, as referred to in para 6 of the Guidelines for all REs, and in the case of MIIs, the Chief Information Security Officer (CISO) appointed under para 7 of Annexure A to the MII Guidelines, are mandatorily required to obtain both the Basic and Advanced Cyber Security Certifications.

What is the deadline for obtaining the mandatory certifications?

Personnel required to obtain mandatory certifications (Designated Officer, CISO, Compliance Officer, and specified IT/information security employees) must do so within six (6) months from the date the respective certification examination goes live, or within six (6) months from the date of their appointment to such role, whichever is later. For example, the Basic Certification must be obtained within six months of November 18, 2026, if appointed before that date.

Are REs required to maintain records of these certifications?

Yes, Regulated Entities (REs) must maintain records of the certifications obtained by the personnel referred to in paragraphs 6(a) and 6(b) of the circular. These records must be made available to IFSCA as and when sought, demonstrating compliance with the new requirements.

Sources and Further Reading

Track every new RBI, SEBI and IFSCA circular and ask questions in plain English on RegChat — Algoy’s free regulatory chatbot.