The International Financial Services Centres Authority (IFSCA) has significantly raised the bar for cyber security and cyber resilience in IFSCs. Designated Officers, CISOs, Compliance Officers, and IT/InfoSec personnel must now obtain specific NISM-IFSCA certifications, with strict deadlines tied to exam availability.
What Changed: The 30-Second Answer
The IFSCA, through its circular titled “Certification on Cyber Security and Cyber Resilience for Designated Officers and other specified employees of Regulated Entities in the IFSCs” issued on October 27, 2026, has mandated new NISM-IFSCA cyber security certifications for key personnel within all Regulated Entities (REs) in IFSCs. Designated Officers and CISOs must acquire both Basic and Advanced certifications, while Compliance Officers and employees with critical IT/information security roles need the Basic certification, all within six months of exam live dates or appointment.
Mandatory Cyber Security Certifications for IFSC Regulated Entities
The IFSCA Circular 2026, issued on October 27, 2026, builds upon previous guidelines on cyber security and cyber resilience for Regulated Entities (REs) and Market Infrastructure Institutions (MIIs) in the International Financial Services Centres (IFSCs). Previous circulars, specifically dated March 10, 2025 (amended March 10, 2026) for all REs, and April 20, 2026, for MIIs, established baseline frameworks and additional requirements for these entities. A core tenet of these guidelines was the imperative for Governing Boards and senior management to possess adequate knowledge of cyber security risks and for employees to receive regular training.
To establish a common knowledge benchmark across the IFSC ecosystem, IFSCA has collaborated with the National Institute of Securities Markets (NISM) to develop two new certification courses:
- ‘NISM-IFSCA-02A: Certification Course on Cyber Security and Cyber Resilience in the GIFT IFSC (Basic)’ (Basic Cyber Security Certification), with its examination going live on November 18, 2026.
- ‘NISM-IFSCA-02B: Certification Course on Cyber Security and Cyber Resilience in the GIFT IFSC (Advanced)’ (Advanced Cyber Security Certification), with its examination going live on December 30, 2026.
These certifications are now mandatory for specific roles, aiming to strengthen the cyber security and cyber resilience capabilities of REs. This move underscores the regulator’s commitment to robust cyber governance, complementing other recent efforts like the IFSCA mandate on algorithmic trading approvals and risk controls.
Who Does This IFSCA Circular 2026 Apply To?
This IFSCA circular applies to “All Regulated Entities in the International Financial Services Centres (IFSCs).” The mandatory certification requirements are role-specific:
- Designated Officer (as per para 6 of the Guidelines for all REs) and, for MIIs, the Chief Information Security Officer (CISO) (as per para 7 of Annexure A to the MII Guidelines): These individuals must mandatorily obtain both the Basic Cyber Security Certification and the Advanced Cyber Security Certification.
- Compliance Officer of the RE: This role must mandatorily obtain the Basic Cyber Security Certification. They are also encouraged to obtain the Advanced Cyber Security Certification.
- Employees of the RE responsible for IT operations or information security, or having privileged access to the critical systems of the RE: These employees must mandatorily obtain the Basic Cyber Security Certification. They are also encouraged to obtain the Advanced Cyber Security Certification.
- All other employees of the RE: While not mandatory, all other employees are encouraged to obtain the Basic Cyber Security Certification.
The circular explicitly states that the certifications are designed to ensure “a structured, continuous and role-appropriate approach to cyber security training and awareness encompassing their Governing Boards, senior management and employees.” REs must tailor their initiatives commensurate with their operations’ nature, scale, and complexity, and the cyber risks they face. This aligns with a broader trend of regulatory bodies emphasizing specialized training and certification, as seen in the IFSCA’s previous extensions for capital market intermediaries’ KMPs and employees.
What Are the New Deadlines and Actionables?
For the specified personnel (Designated Officer/CISO, Compliance Officer, and employees in IT operations, information security, or with privileged access to critical systems), the deadlines are clear and immediate:
- Affected individuals must obtain their respective mandatory certifications within six (6) months from the date on which the relevant certification examination goes live.
- Alternatively, if their appointment to such a role occurs after the exam goes live, they must obtain the certification within six (6) months from the date of their appointment, whichever is later.
Specifically:
- For the Basic Cyber Security Certification, the six-month clock starts from November 18, 2026.
- For the Advanced Cyber Security Certification, the six-month clock starts from December 30, 2026.
Practitioners must note that individuals in these roles “shall continue to hold a valid certification at all times while discharging their responsibilities in such role.” This implies an ongoing requirement for valid certification, suggesting potential re-certification needs in the future, though the circular does not elaborate on re-certification frequency. Regulated Entities are also required to “maintain records of the certifications obtained by the persons referred to in para 6 (a) and para 6 (b) above and shall make the same available to IFSCA as and when sought.” This record-keeping requirement is crucial for demonstrating compliance.
What This Circular Does NOT Cover
While prescriptive in its certification requirements, the circular remains silent on several operational aspects. It does not specify the duration of validity for these NISM-IFSCA certifications, nor does it outline any re-certification process or frequency. REs are left to infer how “continue to hold a valid certification at all times” will be interpreted in the long run. There is no mention of specific penalties for non-compliance, though failure to adhere to mandatory regulatory requirements typically carries significant consequences under the broader IFSCA Act, 2019.
The circular also does not detail the content of the certification courses beyond their titles, nor does it provide guidance on how REs should fund these certifications for their employees. While it encourages broader employee participation, it doesn’t offer incentives or mechanisms for ensuring this encouragement translates into widespread uptake. Furthermore, while the circular mentions that it “shall come into force with immediate effect,” this refers to the circular’s issuance, not the immediate enforcement of certification deadlines, which are tied to the exam live dates. The “immediate effect” clause is standard for IFSCA circulars, as seen in the IFSCA’s updated AML/CFT and KYC guidelines, which also came into force immediately.
The Algoy Perspective
This IFSCA Circular 2026 represents a clear hardening of cyber security expectations. While mandating certifications is a direct way to ensure a baseline of knowledge, the real challenge for REs will be integrating this into their existing human resource and training frameworks. The immediate effect of the circular, coupled with the staggered exam launch dates, means compliance officers and HR departments must act quickly to identify all affected personnel, communicate the requirements, and facilitate registration for the NISM-IFSCA exams. The “six months from appointment” clause for new hires also necessitates an update to onboarding processes and job descriptions for these critical roles. Ensuring continuous validity of certifications, especially without explicit re-certification guidelines, introduces an element of ongoing monitoring and proactive engagement with NISM and IFSCA for updates. This isn’t just a training exercise; it’s a fundamental shift in how cyber competence is formally recognized and maintained within the IFSC ecosystem.
Frequently Asked Questions
Which NISM-IFSCA certifications are now mandatory?
The ‘NISM-IFSCA-02A: Certification Course on Cyber Security and Cyber Resilience in the GIFT IFSC (Basic)’ and ‘NISM-IFSCA-02B: Certification Course on Cyber Security and Cyber Resilience in the GIFT IFSC (Advanced)’ are now mandatory for specified personnel. The Basic certification exam goes live on November 18, 2026, and the Advanced on December 30, 2026.
What are the deadlines for obtaining these certifications?
Mandatory certifications must be obtained within six (6) months from the date the respective certification examination goes live, or within six (6) months from the date of appointment to the relevant role, whichever is later. For instance, the Basic certification must be acquired by May 18, 2027 (six months from November 18, 2026).
Which roles require both Basic and Advanced certifications?
The Designated Officer of the RE (as per para 6 of the Guidelines for all REs) and, for Market Infrastructure Institutions (MIIs), the Chief Information Security Officer (CISO) appointed under para 7 of Annexure A to the MII Guidelines, must mandatorily obtain both the Basic and Advanced Cyber Security Certifications.
Are REs required to maintain records of these certifications?
Yes, Regulated Entities (REs) shall maintain records of the certifications obtained by the Designated Officer/CISO, Compliance Officer, and employees responsible for IT operations, information security, or having privileged access to critical systems. These records must be made available to IFSCA as and when sought.
Sources and Further Reading
- Certification on Cyber Security and Cyber Resilience for Designated Officers and other specified employees of Regulated Entities in the IFSCs
- IFSCA Official Website
- Search and track this circular on RegChat, Algoy’s regulatory chatbot
Track every new RBI, SEBI and IFSCA circular and ask questions in plain English on RegChat — Algoy’s free regulatory chatbot.
