RBI regulates a wide set of entity types under different statutory heads. A Scheduled Commercial Bank sits under Section 35A of the Banking Regulation Act 1949. An NBFC sits under Section 45L of the RBI Act 1934. A Payment Aggregator sits under the Payment and Settlement Systems Act 2007. A Credit Information Company sits under the Credit Information Companies (Regulation) Act 2005. Each of these statutes gives the Reserve Bank different scope, and each of the ten instruments in the RBI cyber stack is written against the powers under one or more of them.
That statutory shape is why the cyber stack cannot be treated as a single rulebook that applies to everyone. The 31 July 2026 Commercial Banks Cybersecurity Directions apply to commercial banks. Not to Small Finance Banks even though an SFB is also a Section 35A entity, because the Directions expressly exclude SFBs. Not to NBFCs, because NBFCs are Section 45L entities and the 2026 Directions do not touch them. Not to Payment Aggregators, because the PA Directions of September 2025 govern the payments layer and the 2026 Directions leave payment-specific obligations alone. Read the applicability text of every instrument before assuming coverage.
The RE perimeter chart below tells you exactly which set of instruments applies to your entity today. Read this once, print it, and keep it on your desk. When your Board or ITSC asks "which of these applies to us?", you should be able to answer in one sentence per instrument. If you cannot, you are the CISO the next CSITE inspection will remember for the wrong reasons.
The RE perimeter chart
| RE type | 2016 CSF | 2019 UCB CSF | 2017 NBFC IT Fw | 2023 ITGRCA MD | 2023 IT Outs MD | 2026 CB Cyber |
|---|---|---|---|---|---|---|
| SCBs (PSBs, private, foreign; excluding RRBs) | Superseded | — | — | Yes [L2-C1] | Yes | Yes [L2-C2] |
| Small Finance Banks | Continuing baseline | — | — | — | Yes | Excluded |
| Payments Banks | Continuing baseline | — | — | — | Yes | Excluded |
| Local Area Banks | Continuing baseline | — | — | — | Yes | Excluded |
| Regional Rural Banks | Excluded historically | — | — | Excluded | Excluded | Excluded |
| Urban Cooperative Banks | — | Yes at Level I–IV [L2-C3] | — | — | Yes | — |
| Base Layer NBFC (assets < ₹1,000 cr) | — | — | Yes if assets ≥ ₹500 cr [L2-C4] | No | Yes | — |
| Middle / Upper / Top Layer NBFC | — | — | Yes | Yes [L2-C5] | Yes | — |
| All-India Financial Institutions | Baseline reference | — | — | Yes | Yes | — |
| Credit Information Companies | — | — | — | Yes | Yes | — |
| Payment Aggregators | — | — | — | — | Indirect via bank | — |
Read horizontally: pick your row, tick the columns that apply, and you have the compliance perimeter. Read vertically: pick an instrument, and you see every RE type it binds.
Two entity-type edge cases most CISOs get wrong
1. The Regional Rural Bank exception
RRBs are excluded from the 2023 ITGRCA Master Direction on issuance (confirmed by the RBI applicability text of 7 November 2023 [L2-C1]) and remain excluded through August 2026 as no subsequent RBI notification has captured them. RRBs are also excluded from the 31 July 2026 Commercial Banks Cybersecurity Directions, which explicitly cover only SCBs, corresponding new banks and the State Bank of India.
RRBs continue to be governed by RRB-specific Directions issued through 2025 covering Digital Banking Channels Authorisation, Undertaking of Financial Services, Governance, Prudential Norms and Credit / Debit Card Issuance and Conduct. If you advise an RRB, do not treat ITGRCA or the 2026 Directions as applicable; do treat the RRB-specific set as your operative source.
2. The NBFC layer split
The Scale-Based Regulation Framework of 22 October 2021 [L2-C6] puts every NBFC in one of four layers. Base Layer NBFCs sit under the 2017 IT Framework only (and only if asset size is ₹500 crore or above; below that, the 2017 IT Framework asks for proportionate controls but does not apply in full). Middle Layer, Upper Layer and Top Layer NBFCs sit under both the 2017 IT Framework AND the 2023 ITGRCA Master Direction.
The trap: some Middle Layer NBFCs read only the 2023 ITGRCA MD and skip the 2017 IT Framework. That is wrong. Both apply. Where they say the same thing, no problem. Where the 2017 IT Framework asks for something the 2023 ITGRCA does not repeat, you still owe it.
3. The Payment Aggregator that is also a bank-owned subsidiary
Several bank groups run their PA arm as a wholly-owned subsidiary of the bank. The perimeter here is deceptive. The subsidiary itself is bound by the 15 September 2025 Payment Aggregators Directions and the 2018 Payment Data Storage Direction directly. But because the subsidiary is a bank-owned entity, obligations under the 2023 IT Outsourcing MD flow to the parent bank whenever the PA activity is treated as an outsourced function from the bank's perspective. Whether it is treated that way turns on the exact intra-group service agreement. If the agreement is drafted loosely, both parent and subsidiary carry parallel obligations and both get inspected by CSITE. If the agreement is drafted tightly with the PA as an independent RE, the subsidiary carries its PA obligations directly and the parent's exposure is limited to the parent-level ITGRCA obligations on subsidiary oversight. Get your legal team to review the intra-group agreement before the next inspection cycle.
Worked example: a Middle Layer NBFC with an AA (Account Aggregator) affiliate
Take a Middle Layer NBFC (assets of ₹8,000 crore) that also runs an Account Aggregator affiliate through a common promoter. The NBFC parent is covered by the 2017 NBFC IT Framework, the 2023 ITGRCA MD (Middle Layer is in scope), the 2023 IT Outsourcing MD, the 2024 Fraud Risk Management MD /49 (NBFC-specific), and the CERT-In Directions 2022. The AA affiliate is a separate RE under the RBI-issued NBFC Account Aggregator Master Direction 2016 with its own IT and cyber controls. The two are not the same entity; they are separately supervised. But because they share a promoter, the parent's ITSC often ends up thinking about the AA's controls too. Practical rule: each RE reports separately to CSITE. Do not merge the compliance registers. Do maintain a group-level view for the promoter, but keep the entity-level registers untouched by that view.
Practical CISO test
Take a sheet of paper. Write your entity type at the top. List the six columns from the chart. Tick every column that applies. Cross-reference against your current compliance register. Any column ticked in the chart but missing from your register is an exposure to fix in the current quarter. Any column missing from the chart but present in your register is either over-compliance or reflects an obligation the chart does not capture (bring it to the ITSC for reconciliation).
Then extend the test. For every ticked column, write one sentence naming the operative provision you cited most recently. If you cannot name a provision you cited in the last quarter for a ticked column, either the obligation is not being operationalised or your team is doing it silently. Both are bad. The good sign is when you can point to a specific ITSC minute or IS Audit item or vendor-contract clause that references the provision. Nothing else counts as evidence of live compliance.
Perimeter misreadings to avoid
Three recurring perimeter misreadings show up in inspection findings.
- Assuming the 2026 Directions apply to your entity because you are a bank. Not every bank is a commercial bank. SFBs, PBs, LABs and RRBs are separately categorised and are outside the 2026 Directions. Confirm your entity's classification under the Banking Regulation Act 1949 before assuming coverage.
- Assuming the 2023 ITGRCA MD supersedes the 2017 NBFC IT Framework for a Middle Layer NBFC. It does not. Both apply. Reconcile the two provisions where they overlap; comply with both separately where they do not.
- Assuming a Payment Aggregator does not have direct RBI cyber obligations. It does. The PA Directions of September 2025 impose a full set of controls directly on the PA. Do not read PA obligations as "flowing through" the acquirer bank; the PA is a separately supervised entity from that date forward.