Provides financial services, in India

Directions under section 70B(6) of the Information Technology Act, 2000, No. 20(3)/2022-CERT-In (Indian Computer Emergency Response Team, Ministry of Electronics and Information Technology, 28 April 2022) · Read the law's page

• Connect all your ICT systems' clocks to the Network Time Protocol server of the National Informatics Centre or the National Physical Laboratory, or to an NTP server traceable to one of them, and ensure any other time source you use does not deviate from NPL or NIC.
• Report a listed cyber security incident, including a targeted attack, a data breach, a data leak, unauthorised access to your IT systems, an attack through a malicious or fake mobile app, or an attack on, or malicious or suspicious activity affecting, an AI or machine learning system, to CERT-In within six hours of noticing it or being notified of it, by email, phone, or fax; current reporting formats and channels are published on CERT-In's own website.
• Enable logs of all your ICT systems and retain them securely, within Indian jurisdiction, on a rolling 180-day basis, and provide them to CERT-In together with an incident report or when CERT-In orders or directs you to.
• Designate a Point of Contact to interface with CERT-In, using the format CERT-In publishes, and keep that designation current.
• If your own service is itself a data centre, a virtual private server provider, a cloud service provider, a virtual private network service, or a virtual asset (crypto) service provider, a narrower and heavier duty also applies: register and retain specified customer KYC information and financial-transaction records for five years. That narrower bound-party class is not one this profile's declared activities can identify on their own, so confirm applicability directly against the text if this describes your service.
• This binds a service provider, intermediary, data centre, body corporate, or Government organisation, the Information Technology Act's own general terms for essentially any commercial or professional actor operating a computer resource in India, not a licensed or sector-specific status; a company distributing software or operating a mobile app in India falls within this reach without needing a specific regulatory registration.
• Failing to furnish information CERT-In calls for, or to comply with a direction it issues, including these Directions, is punishable under section 70B(7) of the Information Technology Act with imprisonment for up to one year, a fine of up to one lakh rupees, or both.

Rights of Persons with Disabilities Rules, 2017, rule 15(1)(p) · Read the law's page

• If you are a bank, design your website and apps so that they are accessible by all people including visually impaired people (Banking Sector standards, para 2.1).
• If you are a bank, have information and communication technology related changes, including to ATMs, websites and mobile applications, comply with IS 17802, the Bureau of Indian Standards standard for accessibility of information and communication technology products and services, and follow the Web Content Accessibility Guidelines 2.1; the standards word both as 'should' (para 2.1).
• If you are a bank, ensure before launch that new advanced technology ATMs and self-service kiosks have built-in accessibility features, and integrate audio support for all information in ATMs; the standards word this as 'should' (para 1.2.2(i)).
• If you are a bank, follow specific provisions under IS 17802 when authoring digital documents for customers and employees with disabilities, and provide e-circulars, other electronic documents and bank e-statements in accessible formats (paras 2.3(i) and (ii)).
• If you are a bank, develop accessible communication strategies through hearing enhancement systems, closed captioning, sign language interpretation and relay services, and provide user manuals, information booklets, product demonstrations and letters in accessible format using QR codes (paras 2.2(i) and 2.3(ii)(c)).
• Rule 15(1) is in force. On November 8, 2024 the Supreme Court held that several of the guidelines it prescribes appear to be recommendatory guidelines under the garb of mandatory rules and that rule 15(1) is ultra vires the Act, clarified that progressive compliance with the standards listed in rule 15(1) must continue, and directed that once the Union Government prescribes mandatory rules, the consequences in sections 46 and 89, including fines, be implemented for non-compliance with rule 15 (Rajive Raturi v. Union of India, paras 75 to 77).

SEBI circular SEBI/HO/MIRSD/SECFATF/P/CIR/2025/74 · Read the law's page

• If you are an intermediary registered with SEBI, extend your services enabling digital accessibility to clients, including persons with disabilities, and be guided by SEBI's FAQ on account opening by persons with disabilities (para 3).

SEBI circular SEBI/HO/ITD-1/ITD_VIAP/P/CIR/2025/131, compliance guidelines for circular SEBI/HO/ITD-1/ITD_VIAP/P/CIR/2025/111; circular HO/13/19/13(2)2025-ITD-1_VIAP/I/187/2025; circular HO/53/12/13(2)2026-ITD5-M2IPC/I/24856/2026 · Read the law's page

• If you are a SEBI regulated entity, submit a status of your readiness and compliance to the accessibility requirements for each of your investor facing digital platforms, in the format of the December 8, 2025 circular, by March 31, 2026 (circular of December 8, 2025, para 3(a)).
• Appoint an IAAP certified accessibility professional as auditor, conduct an accessibility audit of your digital platforms, and remediate the findings by January 31, 2027 (circular of October 30, 2026, para 3, extending circular 2025/131, Table A).
• Conduct periodic accessibility audits of your digital platforms, including websites, mobile apps and portals, through certified accessibility professionals (circular of December 8, 2025, para 3(d)).
• Remediate an accessibility issue on your digital platforms that an investor raises as a complaint on SCORES, for the closure of the complaint (circular of December 8, 2025, para 3(c)).
• Give annual compliance with accessibility audits of all your digital platforms and submit the final report of the audit to SEBI by April 30, 2027, and then within 30 days of each financial year (circular 2025/131, Table A).

Reserve Bank of India (Commercial Banks - Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, paras. 15, 149 to 153 and 212 to 216 · Read the law's page

• This binds a commercial bank, meaning a banking company other than a small finance bank, payments bank or local area bank, a corresponding new bank or the State Bank of India (reached by declaring that you are a bank). A foreign bank operating through branches is bound on a comply-or-explain basis for the chapters and paragraphs paragraph 4 of the Directions lists.
• Put in place a Cybersecurity Policy, approved by your Board, that sets out your strategy to combat cyber threats and is distinct and separate from your broader IT and information security policy (paragraph 15).
• Conduct vulnerability assessment and penetration testing periodically for all critical and internet-facing systems: for critical information systems and systems in the demilitarised zone with a customer interface, vulnerability assessment at least once in every six months and penetration testing at least once in 12 months (paragraphs 149 to 151).
• Fix identified vulnerabilities and their associated risks in a time-bound manner, and keep the fixes in place so that known vulnerabilities do not recur (paragraph 153).
• Put in place a framework for establishing and operating a Cyber Security Operations Centre, commensurate with your technology risk profile, scale and complexity of operations (paragraph 212).
• Make your security-monitoring systems collect logs from deployed systems and network activity, correlate them through SIEM tools, keep SIEM dashboards under continuous monitoring and generate alerts for abnormal activity (paragraph 215).

Reserve Bank of India (Commercial Banks - Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, paras. 181 to 183 · Read the law's page

• This binds a commercial bank, meaning a banking company other than a small finance bank, payments bank or local area bank, a corresponding new bank or the State Bank of India (reached by declaring that you are a bank). A foreign bank operating through branches is bound on a comply-or-explain basis for the chapters and paragraphs paragraph 4 of the Directions lists.
• Report cyber incidents to the Reserve Bank within six hours of detection on its DAKSH platform (paragraph 182).
• Notify CERT-In proactively about cyber incidents (paragraph 182); the Directions state no clock for that notice.
• Keep clear communication plans for escalating incidents and reporting them to your Board and Senior Management and to customers, as required (paragraph 183).
• Analyse cyber incidents, including through forensic analysis where necessary, for severity, impact and root cause, and take corrective and preventive measures to mitigate their adverse impact on business operations (paragraph 181).