INDUSTRY FACT FILE · NBFCS & LENDING

Cybersecurity FAQs for NBFCs and Lenders

Forty frequently asked questions and answers in five categories, written for Boards, CXOs, CISOs, risk, compliance and technology teams in NBFCs.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: RBI's 2026 Directions, audit and compliance 3.  Category 3: Lending platforms, apps and partner security 4.  Category 4: SOC, fraud, incident response and forensics 5.  Category 5: Third parties, cloud, privacy and emerging technology

Audience: Board members, MD & CEO, CISO, Chief Risk Officer

Q1. Why is cybersecurity now a Board-level issue for NBFCs?

RBI's 2026 NBFC cybersecurity Directions require the Board of every NBFC to approve technology and cybersecurity strategies and policies and review them at least annually. Larger NBFCs must also run an IT Strategy Committee, and Middle Layer NBFCs and above must appoint a CISO who reports cyber risk at least quarterly. Cyber failures now affect regulatory standing, funding and partnerships.

Q2. What are the biggest cyber risks for NBFCs?

The highest-consequence risks are synthetic identity and document fraud, partner and agent collusion, fake lending apps, lending app and API data exposure, ransomware, insider misuse by field agents, third-party and LSP compromise, data leakage and slow detection. Their priority depends on the NBFC's products, channels and layer.

Q3. How do cybersecurity obligations differ by NBFC layer?

RBI's 2026 Directions apply Chapters I and II to all NBFCs. Base Layer NBFCs below ₹500 crore and Core Investment Companies follow Chapter III (baseline controls); Base Layer NBFCs of ₹500 crore and above follow Chapter IV (IT governance and annual IS audit); Middle, Upper and Top Layer NBFCs follow Chapter V, which includes CISO, VA/PT and DR drill requirements.

Q4. What should an NBFC's IT Strategy Committee look like?

For Base Layer NBFCs of ₹500 crore and above, the ITSC is chaired by an independent director, includes the CIO/CTO and meets at least once every six months. For Middle Layer and above, it has at least three directors, is chaired by an independent director with at least seven years of substantial IT experience, and meets at least quarterly.

Q5. Where should the CISO sit?

For Middle Layer NBFCs and above, the 2026 Directions expect the CISO—preferably at General Manager level—to have no direct reporting line to the Head of IT and no business targets, to report to the executive overseeing risk, and to present cyber risk reviews to the Board, Risk Management Committee or ITSC at least quarterly.

Q6. Why do bank partners and investors ask about our security?

Banks funding or co-lending with NBFCs, rating agencies and investors treat cyber risk as credit and operational risk. Independent audit reports, VAPT evidence and certifications such as ISO 27001 help NBFCs pass due diligence and protect funding lines.

Q7. How much should an NBFC spend on cybersecurity?

There is no regulatory percentage. Spending should follow risk and layer: meet the mandatory controls for the applicable chapter, close critical exposures in lending apps and partner integrations, then strengthen monitoring, response and governance. Managed services help smaller NBFCs gain capabilities such as 24x7 monitoring without building them in-house.

Q8. How can Codec Networks help an NBFC?

Codec Networks provides layer applicability assessments, IS audits, lending platform and API security testing, managed SOC, fraud forensics, partner and LSP assurance, privacy programmes and Board advisory, aligned to RBI's 2026 Directions and related lending rules.

Audience: Compliance heads, CISOs, internal audit, Principal Officers

Q9. What are RBI's 2026 NBFC cybersecurity Directions?

They are the Non-Banking Financial Companies – Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 (RBI/DoS/2026-27/461), issued on 31 July 2026. They apply to all NBFCs registered under the RBI Act, the Factoring Regulation Act or the NHB Act, took effect immediately and repealed earlier IT framework and IT governance instructions for NBFCs.

Q10. How quickly must cyber incidents be reported?

Cyber incidents must be reported on RBI's DAKSH platform within six hours of detection; housing finance companies report to the National Housing Bank instead. CERT-In must be notified proactively, and CERT-In's Directions separately require specified incidents to be reported within six hours.

Q11. What testing frequencies apply?

For Middle Layer NBFCs and above, VA must be performed at least once every six months and PT at least once every 12 months for critical systems and DMZ systems with customer interfaces, including cloud-hosted systems. Non-critical systems follow a risk-based approach.

Q12. When is an IS audit required?

Base Layer NBFCs with assets of ₹500 crore and above must conduct an IS audit at least once a year, preferably before the statutory audit, as part of the internal audit system. For Middle Layer and above, the Audit Committee of the Board oversees IS audit and reviews the IS Audit Policy annually, with risk-based planning.

Q13. What are the DR and BCP expectations?

Middle Layer NBFCs and above must run DR drills for critical systems at least half-yearly, operating from DR for at least a full working day, and test BCP at least annually and after significant changes. Smaller NBFCs must maintain BCP and data backups with periodic restoration testing.

Q14. How do the Digital Lending Directions affect security?

The RBI (Digital Lending) Directions, 2025 keep regulated lenders responsible for their LSPs and digital lending apps, require DLAs to be reported on RBI's CIMS portal, and restrict how borrower data is collected, stored and shared. This creates demand for app and API testing, LSP assessments and privacy reviews.

Q15. What do the fraud risk directions require?

RBI's Master Directions on Fraud Risk Management in NBFCs (July 2024) require a Board-approved fraud risk policy; Upper and Middle Layer NBFCs must operate an early warning signal framework with red-flagging of accounts, supported by data analytics, and follow natural-justice principles before classifying fraud.

Q16. Can Codec Networks perform independent audits for NBFCs?

Yes. Codec Networks is CERT-In empanelled for information security auditing services and performs IS audits, VA/PT by independent experts and applicability assessments. Independence and scope are confirmed in each proposal.

Audience: CTOs, digital lending heads, application security and partnerships teams

Q17. What should lending app security testing cover?

It should cover authentication and session handling, device binding, data storage on the device, communication security, tampering and repackaging resistance, consent and permissions, and backend API security—including object-level authorisation and data minimisation. OWASP MASVS and the API Security Top 10 are useful baselines.

Q18. Why are lending APIs a major risk?

Lending APIs connect apps, LSPs, bureaus, Account Aggregators, e-sign providers and bank partners. A single authorisation flaw can expose many borrowers' KYC documents and bank statements. APIs should be inventoried, minimised and tested in each significant release.

Q19. How should we assess lending service providers?

Go beyond questionnaires: review the LSP's application and data handling, test integrations, verify data-retention and deletion practices, confirm incident-notification obligations and include audit rights in contracts. The lender remains responsible for LSP conduct under the Digital Lending Directions.

Q20. How do we protect against fake lending apps?

Monitor app stores, websites and social media for impersonation, use anti-phishing and takedown services, publish the list of genuine apps and partners, and educate borrowers. Complaint analytics can reveal impersonation early.

Q21. What security controls matter in co-lending?

Co-lending relies on accurate, timely data exchange with bank partners. Use authenticated APIs or secure file transfer with MFA and allow-listing, sign or hash loan files, reconcile data regularly and test the integration end to end.

Q22. How should field and collection apps be secured?

Encrypt data on devices, minimise what is stored offline, enforce device management with remote wipe, restrict exports, log agent access and monitor for unusual activity. Field apps should be security-tested like customer apps.

Q23. Do we need secure software development practices?

Yes. Middle Layer NBFCs and above must manage application security throughout the lifecycle and obtain source code or escrow for critical applications. Threat modelling, secure coding, code review and SAST/DAST in CI/CD reduce defects reaching production.

Q24. Should we use Account Aggregator data, and what are the risks?

AA-based consented data improves underwriting, but consent flows, encryption, key management and API security must be tested, and data received must be used and retained only for the consented purpose.

Audience: SOC managers, fraud control, collections and incident response teams

Q25. Do NBFCs need a Security Operations Centre?

Middle Layer NBFCs and above must operate a SOC managed by the CISO's office under the 2026 Directions. Many NBFCs use managed or co-managed SOC services to achieve 24x7 coverage without building a full in-house team.

Q26. How can a SOC help detect lending fraud?

A lending-aware SOC correlates security signals with fraud indicators: devices or IP addresses shared across applications, unusual partner activity, bulk data exports, rapid changes to bank details before disbursement and spikes in applications from a single dealer or agent.

Q27. What are early warning signals and red-flagging?

Under RBI's fraud risk directions, Upper and Middle Layer NBFCs must monitor early warning signals in accounts and transactions and red-flag suspicious accounts for investigation. Data analytics and forensic audit help confirm or rule out fraud quickly.

Q28. What should our incident response plan include?

Incident classification, roles and decision authority, escalation, containment and recovery steps, evidence preservation, borrower and partner communication and the workflow to report to RBI (or NHB) and CERT-In within six hours.

Q29. How long must logs be retained?

CERT-In's Directions require logs of ICT systems to be maintained securely for a rolling 180 days within Indian jurisdiction. NBFCs should also align retention with investigation needs and other obligations.

Q30. When should forensic investigators be engaged?

As soon as a material fraud or compromise is suspected. Early forensic work preserves evidence, establishes scope and supports fraud classification, regulatory reporting and recovery action.

Q31. How should NBFCs prepare for ransomware?

Isolate and regularly restore backups, deploy and monitor EDR, tier privileged access, run DR drills (at least half-yearly for Middle Layer and above) and rehearse a ransomware scenario that includes the 6-hour reporting step.

Q32. How do we manage insider and agent risk?

Apply least-privilege access, maker-checker for sensitive changes, monitoring of exports and unusual access, background checks for agents and partners, and periodic insider threat simulations.

Audience: Vendor management, cloud and infrastructure heads, data protection leads, innovation teams

Q33. How should NBFCs manage outsourcing risk?

RBI's Managing Risks in Outsourcing Directions, 2025 require due diligence, contracts, monitoring and audit and access rights. The 2026 Directions add requirements for IT and cyber third-party arrangements, including vendor risk assessments proportionate to materiality for Middle Layer and above.

Q34. Can NBFCs use public cloud for lending platforms?

Yes, within RBI's outsourcing and cybersecurity requirements. The 2026 Directions extend VA/PT requirements to cloud-hosted systems. Configuration, IAM, encryption and shared-responsibility boundaries should be reviewed and monitored continuously.

Q35. When do DPDP obligations apply?

The DPDP Rules, 2025 were notified on 13 November 2025 with phased commencement; most data-fiduciary obligations, including security safeguards and breach intimation, take effect in May 2027.

Q36. What borrower data should NBFCs collect?

Only what is necessary for the stated purpose. The Digital Lending Directions restrict data collection by digital lending apps, and the DPDP framework requires purpose limitation and retention controls. Data minimisation also reduces breach impact.

Q37. What does a personal data breach require under DPDP?

Once the breach provisions commence, a data fiduciary must inform affected individuals and intimate the Data Protection Board without delay, followed by a detailed report within 72 hours unless extended.

Q38. What risks come with AI in lending?

AI in underwriting, collections and customer service introduces model manipulation, bias, data leakage, prompt-injection and unreliable decisions. AI systems should be inventoried, tested and governed under a framework such as ISO/IEC 42001.

Q39. How do deepfakes affect NBFCs?

Synthetic video and voice can defeat weak V-CIP checks and impersonate executives or partners. Liveness detection, independent call-back verification and regular deepfake simulations reduce the risk.

Q40. How can an NBFC start an engagement with Codec Networks?

Start with a scoping discussion on the NBFC's layer, products, channels, partners and audit calendar. Codec Networks will propose a scope, methodology and deliverables—often starting with an applicability assessment against RBI's 2026 Directions or a lending platform security assessment.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal or regulatory advice. Requirements depend on each NBFC's layer, type and activities; confirm obligations against the current official Directions issued by RBI, NHB, CERT-In and MeitY.