IFSC regulated entities: key staff must get NISM cyber security certificates
TaxByKK · Compliance News · taxbykk.com27 Oct 2026
In short
IFSCA has made cyber security certification mandatory for key people in regulated entities in the GIFT IFSC. Designated Officers (and CISOs of market infrastructure institutions) must hold both the Basic and Advanced NISM-IFSCA certificates. Compliance Officers and staff who run IT or information security, or have privileged access to critical systems, must hold the Basic one. The exams go live on 18 November and 30 December 2026.
- Authority
- International Financial Services Centres Authority (IFSCA), Division of Cyber Security
- Circular
- IFSCA-CSD/MSC/4/2026-DCS dated 27 October 2026
- Type
- Circular
- Effective from
- 27 October 2026 (immediate); exams go live 18 November 2026 (Basic) and 30 December 2026 (Advanced)
- Law
- IFSCA Act, 2019, sections 12 and 13
- Courses
- NISM-IFSCA-02A (Basic) and NISM-IFSCA-02B (Advanced), Certification Course on Cyber Security and Cyber Resilience in the GIFT IFSC
What changed
| Item | Before | Now |
|---|---|---|
| Designated Officer (and CISO of an MII) | No certification required | Mandatory: Basic (02A) and Advanced (02B) |
| Compliance Officer | No certification required | Mandatory: Basic (02A); Advanced encouraged |
| Staff in IT operations or information security, or with privileged access to critical systems | No certification required | Mandatory: Basic (02A); Advanced encouraged |
| All other employees | No certification required | Basic and Advanced encouraged |
The mandatory certificates must be obtained within six months of the exam going live, or within six months of appointment to the role, whichever is later, and must stay valid while the person holds the role. Regulated entities must keep records of these certifications and give them to IFSCA on request. The circular builds on IFSCA's cyber security guidelines for all regulated entities (10 March 2025, amended 10 March 2026) and for market infrastructure institutions (20 April 2026).
Who it applies to
- Every regulated entity in the GIFT IFSC: banks, capital market intermediaries, insurers, fund managers and others
- Designated Officers and CISOs of IFSC market infrastructure institutions
- Compliance Officers and IT and information security teams of IFSC entities
- CAs, company secretaries and advisers who support IFSC entities
What to do
- List the Designated Officer, Compliance Officer and the staff with privileged access to critical systems.
- Register them for NISM-IFSCA-02A (live 18 November 2026) and, for the Designated Officer, 02B (live 30 December 2026).
- Complete the mandatory certificates within six months of the exam going live, or of a new appointment if that is later.
- Keep a record of every certificate to show IFSCA on request.
Reference
IFSCA circular IFSCA-CSD/MSC/4/2026-DCS, 27 October 2026, Certification on Cyber Security and Cyber Resilience for Designated Officers and other specified employees of Regulated Entities in the IFSCs; course details at nism.ac.in/nism-ifsca-certification-course.
Read the official PDF: IFSCA circularWritten by TaxByKK from the official notification. Check the official text before you act on it.
Frequently asked questions
Who must hold both the Basic and Advanced IFSCA cyber security certificates?
The Designated Officer of a regulated entity in the IFSC and, for a market infrastructure institution, its CISO.
Who must hold the Basic certificate?
The Compliance Officer and employees responsible for IT operations or information security, or with privileged access to the entity's critical systems.
By when must the certificates be obtained?
Within six months of the exam going live (18 November 2026 for Basic, 30 December 2026 for Advanced), or within six months of appointment to the role, whichever is later.
Does the certificate have to be kept valid?
Yes. The person must hold a valid certificate at all times while in the role, and the entity must keep records for IFSCA.