Reserve Bank of India (Credit Information Companies – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026

The record

What it says

• Binds Credit Information Companies as defined under clause (e) of section 2 of the Credit Information Companies (Regulation) Act, 2005.
• Issued on 31 July 2026 as one of seven parallel Directions, and in force from issue.
• Carries the same eight chapters and the same thirty-one-section baseline as the commercial banks, small finance banks, payments banks and AIFI instruments — customer authentication, anti-phishing, customer education and transaction monitoring included.
• Repeals its predecessors through the same covering circular as the other six.

What accounts of this instrument get wrong

Read the instrument

The link below goes to the issuing regulator’s own copy. Where a regulator serves its text through a PDF viewer or a query-string URL, it points at the document rather than at a landing page that may not render it.

• RBI/DoS/2026-27/470 — RBI’s own copy

Instruments that change what this one requires

Not a reading list. Each of these alters the obligation on this page — the amendment that moved a date, the sibling that binds the entity class this one excludes, or the separate track it is routinely merged with.

• Non-Banking Financial Companies RBI/DoS/2026-27/461 — All NBFCs, through three alternative chapters split at ₹500 crore, and Core Investment Companies.
• Commercial Banks RBI/DoS/2026-27/410 — Banking companies other than Small Finance Banks, Payments Banks and Local Area Banks.
• All India Financial Institutions RBI/DoS/2026-27/456 — Five institutions by name — EXIM Bank, NABARD, SIDBI, NHB and NaBFID.

This record is one entry in the Indian cyber regulation register, which publishes the same fields for every instrument as an open dataset. Indicative, and not legal advice: whether an instrument reaches your organisation turns on your licences and registrations, and is a determination for your legal team.