TL;DR
The RBI's Non-Banking Financial Companies (Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, issued on 31 July 2026 and in force from that date, require an NBFC to appoint a Chief Information Security Officer and place that person structurally rather than leaving it to the organisation chart. For NBFCs in the Middle Layer and above, the CISO is a senior executive preferably of General Manager rank, reports directly to the executive director or equivalent overseeing risk management, must have no direct reporting relationship with the Head of the IT function, and may not be given business targets.
That reporting line is the whole design. A CISO inside engineering is assessing their own organisation's work. A CISO inside risk is independent of it, and the directions are explicit about which they intend.
These Directions replaced the earlier IT Framework and IT Governance instructions for NBFCs, repealed by a companion circular of the same date. If a job specification or a governance pack still cites the November 2023 Master Directions on IT Governance, Risk, Controls and Assurance Practices as the NBFC authority, it is out of date.
Key points
- Applies to every NBFC. Which chapter binds you depends on layer and asset size, and the obligations differ sharply between them.
- The CISO reports into risk, not into technology, and cannot be given business targets. Expect candidates to confirm this before engaging.
- Cybersecurity risks, arrangements and preparedness go before the board or its risk or IT committee quarterly.
- The scarce profile is a CISO who has operated under RBI supervision, not a strong security engineer with a new title.
What the directions require
The Directions are drafted as alternatives rather than as a ladder, so exactly one chapter binds a given NBFC. Establishing which one applies to you is the first thing to settle, because it determines whether you are hiring a governance-grade CISO or a security lead.
| Chapter | Who it binds |
|---|---|
| Chapter III | Base Layer NBFCs below ₹500 crore in assets, and Core Investment Companies |
| Chapter IV | Base Layer NBFCs at ₹500 crore in assets and above |
| Chapter V | Top, Upper and Middle Layer NBFCs, excluding Core Investment Companies |
The requirements below are the Chapter V obligations, which is where most scaling fintech lenders and every Middle Layer entity sits.
| Requirement | Consequence for hiring |
|---|---|
| A senior level executive, preferably of General Manager rank or equivalent | Rules out a promising security engineer with a new title. This is a seniority floor, not a preference |
| Reports directly to the executive director or equivalent overseeing risk management | Fixes the reporting line. A CISO under the CTO does not satisfy the intent |
| No direct reporting relationship with the Head of the IT function | Stated explicitly rather than by implication, so a dotted line into engineering is a problem |
| Shall not be given any business targets | Protects independence, and changes how the role is incentivised and assessed |
| Office adequately staffed with technical expertise | The hire is a function, not an individual. Budget for the team in the same conversation |
| Cybersecurity risks, arrangements and preparedness reviewed quarterly by the board, its risk management committee or the IT strategy committee | Creates a standing board cycle the CISO owns and presents |
Every NBFC is now in scope of something, which is the substantive change from the previous framework. Core Investment Companies and Base Layer NBFCs, previously outside it, are covered by Chapters III and IV. The obligations there are lighter than the Chapter V set above, so confirm your own chapter before writing a specification against this table.
The bank-side instrument is parallel, not ahead
Commercial banks received their own instrument on the same day, the Reserve Bank of India (Commercial Banks: Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, which excludes Small Finance Banks, Payments Banks and Local Area Banks. The two frameworks were issued together, so the long-standing gap between the bank standard and the NBFC standard has largely closed.
That matters for a search in two ways. A CISO moving from a commercial bank no longer arrives expecting materially weaker governance on the NBFC side, which removes an objection that used to cost offers. And the incident reporting, resilience and recovery expectations now sit close enough across the two that bank-trained candidates convert more readily than they did under the previous framework.
The structural requirements matter more than they first appear. A board committee that must include technically competent directors meeting quarterly is a meaningful governance commitment, and it changes the job: the CISO is explaining risk to directors four times a year, not writing policy in isolation.
What the role owns in a fintech
The regulation sets the floor. The job above it is shaped by what fintechs actually are: fast-moving technology companies holding other people's money under supervision.
Security of the money path. Everything in how UPI payments work and the ledger beneath it is an attack surface with direct financial consequence. This is different from protecting data: a breach of a payments flow is theft, immediately.
Regulated engineering obligations. PCI-DSS where cards are handled, data residency requirements on payment data, tokenisation, retention rules. These are architectural constraints rather than security policies, which is why the CISO has to be able to argue with engineers on their own terms. Covered in regulated engineering.
Third-party and outsourcing risk. FinTechs run on partners: sponsor banks, KYC vendors, cloud, scoring providers. The regulated entity remains accountable for all of it, and the CISO owns the technical half of that accountability.
Incident response and reporting. Not only containing an incident but reporting it within the windows the regulator sets, with the evidence the regulator expects.
Identity and fraud boundary. Where security ends and fraud begins is genuinely blurred in fintech. Account takeover is both. Organisations that draw the line badly leave a gap, and the CISO usually owns resolving it with the risk function.
Business continuity. A board-approved and annually reviewed obligation under the directions, and in payments a severe one: an outage is a regulatory and reputational event rather than an inconvenience.
Which backgrounds transfer
| Background | Transfers | Watch for |
|---|---|---|
| CISO at a bank or regulated NBFC | Strongly. Knows supervision and board reporting | May be used to larger teams and slower change than a fintech allows |
| CISO at a large technology company | Partially. Strong technically | Regulatory supervision is a genuinely new discipline, not an extension of compliance |
| Security leadership inside a fintech, stepping up | Often the best value | Needs to be assessed on board communication, which they may never have done |
| Security consulting or audit | Weakly for the seat itself | Knows frameworks, has rarely been accountable during a live incident |
| Infrastructure or platform engineering leadership | Situationally | Can grow into it with support, but not into a scope that includes regulatory reporting from day one |
The hardest thing to find is the combination of genuine technical depth and the ability to hold a room of directors. Many strong security leaders have one. Boards notice quickly which one is missing, because the quarterly committee is where it shows.
How to assess
Ask about an incident they ran. Not a hypothetical. What the first hour looked like, who they called, what they told the regulator and when, what they would do differently. This is the single most diagnostic question for the role.
Test the reporting line. Ask where they think a CISO should report and why. A candidate who is relaxed about reporting into engineering has not thought about the independence problem, which the directions exist to solve.
Probe the argument with engineering. Ask about a time they blocked or delayed a release on security grounds, and how that went. Security leaders who have never created friction have either been ignored or have been agreeing with everything.
Check board fluency directly. Ask them to explain a current technical risk the way they would to a non-technical director. The ability to do this without either patronising or retreating into jargon is rarer than it should be, and it is a quarterly requirement of the job.
The search reality
Demand rose sharply and supply did not. The directions brought a wide set of NBFCs into scope at once, and the pool of CISOs who have operated under RBI supervision in a fintech context is small. Banks are competing for the same people, and generally pay more predictably.
The reporting line is a deal point, not a detail. Strong candidates ask early whether they report into risk or into technology. If the honest answer is technology, expect either a declined process or a candidate who negotiates the structure as a condition of joining. Settle it internally before going to market.
Beware the title-only hire. The most common failure is promoting a capable security engineer into the role without the board exposure or the regulatory experience, then discovering the gap at the first quarterly committee or the first inspection. Where an internal candidate is the right long-term answer, the honest version is to hire or contract senior support around them for the first year.
It pairs with other mandated hires. A fintech crossing into scale typically needs the Chief Risk Officer, the Chief Compliance Officer and the CISO inside roughly the same period, from three different and non-overlapping pools. Sequencing those searches rather than running them simultaneously is usually the difference between filling all three and filling one.
Common questions
Which companies must appoint a CISO under the RBI directions?
Every NBFC, since 31 July 2026. The RBI's NBFC Cybersecurity and Technology Risk Directions, 2026 bind Top, Upper and Middle Layer NBFCs under Chapter V, Base Layer NBFCs at ₹500 crore in assets and above under Chapter IV, and Base Layer NBFCs below that threshold along with Core Investment Companies under Chapter III. Core Investment Companies and the Base Layer were outside the previous framework and are now covered, with lighter obligations than Chapter V. Commercial banks are covered by a parallel instrument issued the same day, which excludes Small Finance Banks, Payments Banks and Local Area Banks. A fintech running a lending NBFC in the Middle Layer or above carries the full Chapter V set, including the General Manager rank preference and the reporting line into risk.
Can the CISO report to the CTO?
The directions place the reporting line with the executive director responsible for risk management, and the reason is independence: a CISO inside technology is assessing the output of their own function. Companies that keep the line inside engineering tend to find the issue raised at inspection, and strong candidates raise it at interview.
Is a CISO different from a Head of Security?
In a regulated entity, yes. A Head of Security may be an operational role inside technology. The CISO under these directions is a governance seat with board committee attendance, regulatory accountability and an independent reporting line, as well as operational ownership of the security operations centre. Hiring a Head of Security and renaming the role does not satisfy the intent.
Can we combine the CISO with the Chief Risk Officer or Chief Compliance Officer?
In practice no, and for different reasons in each case. The CRO framework explicitly prohibits other responsibilities. The CCO framework prohibits dual-hatting where a conflict arises. And the skills barely overlap: credit risk, regulatory compliance and information security are three distinct professions that happen to report into adjacent parts of a board.
What should a fintech do before it is in scope?
Appoint someone accountable for security who can grow into the role, and start the board reporting habit early. The companies that handle the transition well are those where a quarterly security discussion already exists before the directions require a committee. The ones that struggle are those creating the function and the governance at the same time, usually under a deadline.