The Reserve Bank of India (Urban Co-operative Banks – Cybersecurity, Technology: Risk,
Resilience and Assurance Framework) Directions, 2026 issued by RBI on July 31, 2026 apply
to all Urban Co-operative Banks (UCBs) and replace the earlier cybersecurity framework. The
Directions introduce a risk-based cybersecurity framework by categorising UCBs into four
levels based on their digital operations, payment system connectivity, and technological
complexity, with higher levels requiring enhanced security measures.
The framework mandates Board-approved cybersecurity policies, IT governance, data
protection, access controls, vulnerability testing, incident reporting, business continuity
measures, and third-party risk management. Advanced-level UCBs are required to
implement stronger controls such as dedicated cybersecurity functions, Cyber Security
Operations Centre (CSOC), real-time monitoring, cyber drills, and enhanced governance
oversight.
The Directions repeal previous cybersecurity guidelines while preserving actions taken
under them and clarify that these requirements are in addition to other applicable laws. RBI retains authority to issue clarifications and provide interpretations for effective
implementation.
