What IFSCA has mandated
The International Financial Services Centres Authority (IFSCA) has made cyber security certification compulsory for the people who carry cyber responsibility inside regulated entities in India's International Financial Services Centres (IFSCs). Circular No. IFSCA-CSD/MSC/4/2026-DCS, dated 27 October 2026, prescribes certification on Cyber Security and Cyber Resilience for designated officers and other specified employees of regulated entities (REs) in IFSCs.
The certifications are run by the National Institute of Securities Markets (NISM) in collaboration with IFSCA. There are two: the Basic certification, NISM-IFSCA-02A, whose examination goes live on 18 November 2026, and the Advanced certification, NISM-IFSCA-02B, whose examination goes live on 30 December 2026. The circular builds on IFSCA's existing cyber security guidelines for regulated entities and for market infrastructure institutions (MIIs), and its stated aim is a common knowledge benchmark on cyber security across the IFSC ecosystem.
💡 In one line: if you are a designated officer of an IFSC regulated entity, or the CISO of an IFSC market infrastructure institution, you must hold both the Basic and the Advanced cyber security certifications — and you must get each one within six months of its exam going live, or within six months of taking up the role, whichever is later.
Who must hold what
The pattern is deliberate: the two roles that own cyber accountability — the designated officer and the MII CISO — must hold both levels, while the wider circle of people who operate systems, handle security or hold privileged access must hold at least the Basic level. Everyone else in the entity is encouraged, not compelled, to certify.
The deadline rule — and what it is not
The circular states its deadline as a rule, not as a calendar date. A person subject to mandatory certification must obtain the applicable certification within six months from the date the relevant examination goes live, or within six months from the date of appointment to the role, whichever is later. The same person must continue to hold a valid certification at all times while in the role.
Two consequences follow. First, someone already in a covered role when an exam goes live counts from the exam's live date; someone appointed afterwards counts from appointment. Second, certification is not a one-time tick-box: letting it lapse while still in the role would breach the requirement to hold valid certification continuously. Regulated entities must also maintain records of their employees' certifications and produce them to IFSCA when sought — so HR and compliance teams need a certification register, not just a training attendance sheet.
Note carefully: the circular itself prescribes no examination fee and no examination format. Those details sit on the NISM course pages, not in the circular, and this article does not import them as circular requirements.
Beyond certification: training duties
Certification is only one half of the circular. It also requires regulated entities to ensure that their boards and senior management have adequate knowledge of cyber risk, and to provide regular, structured, continuous and role-appropriate cyber security training to employees — commensurate with the nature, scale and complexity of the entity and with its cyber risk. In other words, IFSCA is pairing an individual benchmark (the NISM certifications) with an organisational duty (ongoing training and board-level competence).
The circular was issued under Sections 12 and 13 of the International Financial Services Centres Authority Act, 2019, takes immediate effect, and was signed by Praveen Kamat, Chief General Manager and Chief Information Security Officer, in IFSCA's Division of Cyber Security. Course details and registration are available through NISM's IFSCA certification course pages.
What regulated entities should do now
1. Map every covered role. List designated officers, the MII CISO, compliance officers, IT and information-security staff, and anyone with privileged access to critical systems. Those are the mandatory-certification population; everyone else is encouraged.
2. Diary the two live dates against the six-month rule. Basic goes live on 18 November 2026 and Advanced on 30 December 2026. For each person, the deadline is six months from the relevant live date or from appointment, whichever is later — diarise per person, not per entity.
3. Build the certification register now. Because records must be produced to IFSCA on demand, track certification status, validity and renewal for every covered employee, and flag lapses before they become breaches of the continuous-holding requirement.
4. Refresh the training programme. Board and senior-management cyber-risk knowledge and regular role-appropriate employee training are separate obligations in the same circular; a certification drive alone does not discharge them.
Frequently asked questions
Which IFSCA certifications are now mandatory?
NISM-IFSCA-02A (Basic) and NISM-IFSCA-02B (Advanced), developed by NISM in collaboration with IFSCA, for the roles listed in the circular.
When do the examinations go live?
Basic on 18 November 2026 and Advanced on 30 December 2026.
Who must hold both certifications?
Designated officers of regulated entities and CISOs of market infrastructure institutions.
What is the deadline for obtaining certification?
Within six months of the relevant examination going live, or within six months of appointment to the role, whichever is later — and certification must then be held continuously while in the role.
Does the circular prescribe exam fees or format?
No. The circular prescribes no fee or exam format; those details are on the NISM course pages.
What records must regulated entities keep?
Records of employees' certifications, to be produced to IFSCA when sought.
Sources
IFSCA Circular No. IFSCA-CSD/MSC/4/2026-DCS, dated 27 October 2026 — Certification on Cyber Security and Cyber Resilience for Designated Officers and other specified employees of Regulated Entities in IFSCs (official IFSCA circular). NISM IFSCA certification course pages for course and registration details (not part of the circular). This article is general information only and is not legal advice; regulated entities should confirm their position with their compliance advisers.
