Financial servicesIndia

RBI CTRRAF 2026 - Urban Co-operative Banks

Make cyber compliance manageable for your UCB team

Give technology and compliance owners a clear record of required work, supporting evidence and pending follow-ups.

Full title
Reserve Bank of India (Urban Co-operative Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026
Issued by
Reserve Bank of India, Department of Supervision
Issued and in force
31 July 2026, with immediate effect
Applies to
Primary (urban) co-operative banks, placed in one of four levels by their digital depth and payment system connectivity
Nature
Binding regulatory Directions issued under the Banking Regulation Act, 1949, reviewed through RBI supervision and the bank’s own IS audit
Structure
Seven chapters. Level I baseline in Chapter III, with Chapters IV to VI added cumulatively for Levels II to IV

Overview

What the Directions require

The Directions set out how an urban co-operative bank must govern technology, protect its systems, respond to cyber incidents and prove that its controls work. They were issued by the Reserve Bank of India’s Department of Supervision on 31 July 2026, took effect immediately and replace the earlier cybersecurity framework instructions for UCBs, with a saving clause for actions already taken under them.

The defining feature is the graded approach. Every UCB complies with a Level I baseline. A bank that offers internet or mobile banking, is a member of payment systems, runs its own ATM switch or SWIFT interface, or hosts a data centre for other banks moves up the levels, and each level adds a further chapter of controls. A commercial-bank checklist does not fit a UCB unchanged.

Even at Level I the Directions are specific. They require a Board-approved cybersecurity policy distinct from the IT policy, two-factor authentication with a dynamic second factor for the Core Banking Solution, offline backups, controls over third-party ATM switch providers, an IS audit cell and reporting of cyber incidents to RBI on DAKSH within six hours of detection. Governance structures such as a designated CISO, an Information Security Committee and a Cyber Security Operations Centre are required at Level IV.

For most UCBs the hard part is running it with a small team: confirming the level, giving every requirement an owner, keeping evidence current between inspections and showing the Board where the bank stands.

Who it applies to

The Directions apply to urban co-operative banks, meaning primary co-operative banks under Section 5(ccv) read with Section 56 of the Banking Regulation Act, 1949. Each bank self-assesses its level, and the chapters that apply build on each other:

  • Level I: every UCB, whatever its digital offering. Chapters II and III apply.
  • Level II: a sub-member of the Centralised Payment Systems that also offers internet banking (view or transaction), a mobile banking app, or is a direct member of CTS, IMPS or UPI. Chapters II to IV apply.
  • Level III: a direct member of the Centralised Payment Systems, or a UCB with its own ATM switch or a SWIFT interface. Chapters II to V apply.
  • Level IV: a direct or sub-member of the Centralised Payment Systems that has both its own ATM switch and a SWIFT interface, or hosts a data centre or provides software support to other banks, directly or through wholly owned subsidiaries. Chapters II to VI apply.
  • Centralised Payment Systems include RTGS, NEFT and any other system RBI designates.
  • A UCB may adopt higher-level controls if its Board so decides on its own risk assessment, and a bank that already has a dedicated CISO or a Chapter VI governance framework may keep it as good practice.

Other regulated entities have their own Directions. See Commercial Banks, Small Finance Banks, Payments Banks, NBFCs, Credit Information Companies and All India Financial Institutions. Incident notification to CERT-IN also applies; see CERT-IN Guidelines.

Structure

How the Directions are organised

Seven chapters and 183 paragraphs. Chapter III is the baseline for every UCB. Chapters IV, V and VI add controls for Levels II, III and IV in turn.

Chapter I

Preliminary

Short title and commencement, applicability with the four levels, and definitions, most adapted from the FSB Cyber Lexicon.

Chapter II

Role of the Board

Applies to all levels.

Board-approved policies
The Board approves the strategies and policies for the technology and cybersecurity frameworks.
Committees of the Board
A Level IV UCB may consider an IT Strategy Committee of at least two directors, one of them a professional director. For Level IV banks, the Audit Committee of the Board reviews critical IS audit issues and monitors closure of security review and VA/PT findings.
Chapter III

Level I baseline: governance and assets

Sections A to X apply to every UCB. Grouped here by theme.

Self-assessment
The bank assesses which level it falls into and complies with that level’s controls.
Cybersecurity policy
Approved by the Board, distinct from the IT or information security policy, with cyber risks rated low, medium, high or very high.
IT architecture
An architecture suited to the bank’s operations and the security of its systems.
Cyber Crisis Management Plan
The bank may refer to CERT-IN or NCIIPC guidance in preparing one, and must be able to detect intrusions promptly.
Board and senior management
The Board carries ultimate responsibility for information and cybersecurity. Senior management implements the policy and provides resources.
Inventory of information assets
An inventory of information assets is maintained.
Protection of customer and payment information
Controls to protect customer and payment data.
Cryptographic and environmental controls
Use of cryptography, and protection of facilities and equipment.
Unauthorised software and secure configuration
Preventing unauthorised software, configuring systems securely and keeping anti-virus in place.
Chapter III

Level I baseline: operations, people and assurance

Network management and security
Management and protection of the bank’s network.
Change and patch management
Changes and patches applied in a controlled way.
User access control
Access managed by need. Two-factor authentication for the Core Banking Solution and applications connecting to it, with a dynamic second factor that is not a static password.
Secure mail and removable media
Protection of mail and messaging systems and controls over removable media.
Awareness
The Board is briefed on basic IT and cyber risk at least once a year. Staff, vendors and other stakeholders are made aware of policies, do’s and don’ts and incident reporting.
Customer education
Educating customers about cyber risks.
Backup and restoration
Periodic backups, with important data also stored offline on a device that can be disconnected.
Vendor and outsourcing risk
Due diligence on providers, contracts with the bank’s right to audit and RBI’s right to inspect, background checks and NDAs. Where the ATM switch runs through a third-party ATM Switch Application Service Provider, a set of baseline contractual controls applies.
Cyber incident response and recovery
Incidents reported to RBI on the DAKSH platform within six hours of detection, and CERT-IN notified proactively. Sharing threat intelligence with IB-CART and cyber insurance are optional.
New applications and IS audit
Controls before deploying new applications. An IS audit cell within the inspection and audit function, an IS audit policy suited to the bank’s size, and audits completed before the statutory audit with reports to the Audit Committee.
Chapter IV

Level II additional requirements

For banks with internet or mobile banking or direct membership of CTS, IMPS or UPI.

IT resource planning
IT operational plans and budgets, performance monitoring and capacity planning.
Official responsible for information security
An official, not necessarily titled CISO, who sets and enforces information security policy and ensures compliance with RBI instructions.
Network, configuration and application security
Further controls on network security, secure configuration, the application security life cycle and change and patch management.
Periodic testing
Web and mobile applications tested before going live and after major changes. Vulnerability assessment of critical applications and DMZ systems at least once every six months and penetration testing at least once a year. Banks on a shared CBS arrangement have it tested through the provider.
Customer authentication and anti-phishing
A robust authentication framework for customers, and measures against phishing.
Data leak prevention, database integrity and audit logs
A data leak prevention strategy, database integrity controls, and audit logs that support forensics, with alerts on any change to log settings.
Incident response and BCP/DR
A documented incident response plan, no single points of failure, and BCP/DR plans tested periodically with effectiveness assessed by an IS auditor.
Chapter V

Level III additional requirements

For direct members of the Centralised Payment Systems, or banks with their own ATM switch or SWIFT interface.

Hardened infrastructure
Further network, secure configuration, application security and user access controls.
Advanced real-time threat defence
Defences against advanced threats.
Audit log monitoring and analysis
Maintenance, monitoring and analysis of audit logs.
Incident response and resilience
BCP/DR that supports rapid, safe recovery within recovery time objectives, and documented procedures with vendors for timely incident notification.
Awareness
Mandatory awareness for new recruits, and web-based quizzes and training every year for lower, middle and upper management. Periodic Board briefings.
Risk-based transaction monitoring
Transaction monitoring across channels as part of fraud risk management.
Chapter VI

Level IV additional requirements

For banks with both an ATM switch and SWIFT, or that host a data centre or provide software to other banks.

Cyber Security Operations Centre
A CSOC for continuous surveillance, with logs integrated into a SIEM, malware detection and forensic tools, and staffing that considers round-the-clock monitoring.
Cyber drills, metrics and forensics
Participation in cyber drills run by CERT-IN and IDRBT, key performance and risk indicators, and network forensics and DDoS mitigation support on standby.
IT strategy and cybersecurity function
A Board-approved IT strategy and policy, and a separate cybersecurity function staffed and equipped for the bank’s operations.
IT Strategy and IT Steering Committees
An optional Board-level ITSC with at least two technically competent members and one with at least five years of IT experience. An IT Steering Committee with IT, HR, legal and business representatives that reports periodically to the ITSC or Board.
CISO
A sufficiently senior CISO reporting directly to the top risk executive, or the MD and CEO where there is none. Must not report to the CIO or CTO, must not hold business targets, and presents a quarterly cyber preparedness review to the ITSC or Board.
Information Security Committee and Audit Committee
A committee including the MD and CEO or a designee and two senior officials, with the CISO as member secretary, meeting at least quarterly. The Audit Committee ensures security and VA/PT findings are closed on time.
Chapter VII

Repeal and other provisions

Earlier instructions on the cybersecurity framework for UCBs are repealed, with a saving clause. Other laws continue to apply, and RBI’s interpretations are final.

Implementation roadmap

How to implement it, step by step

A practical sequence for a UCB putting the Directions into operation and keeping them there.

  1. 1

    Self-assess the level

    Record the bank’s payment system memberships, digital channels, ATM switch and SWIFT arrangements and any hosting for other banks, and fix its level. Have the Board note the result and decide whether to adopt any higher-level controls voluntarily.

    OutputsLevel assessmentBoard note
  2. 2

    Put Board-level governance in place

    Have the Board approve the cybersecurity policy, kept distinct from the IT policy, and the technology framework. At Level II and above, name the official responsible for information security. At Level IV, designate the CISO and set up the Information Security Committee.

    OutputsApproved policiesNamed owners
  3. 3

    Assess gaps chapter by chapter

    Map current practice against Chapter III and each further chapter that applies. Record every gap with an owner, a target date and a risk rating on the bank’s scale.

    OutputsGap registerOwners and dates
  4. 4

    Close the Level I baseline first

    Prioritise two-factor authentication for CBS, offline backups, access control, patching and the vendor controls, including those for any ATM Switch Application Service Provider.

    OutputsRemediation planVendor contract updates
  5. 5

    Build the recurring testing

    From Level II, schedule six-monthly vulnerability assessments and annual penetration tests of critical applications and DMZ systems, testing of applications before go-live, and periodic BCP/DR tests.

    OutputsTesting calendarFindings tracker
  6. 6

    Rehearse incident reporting

    Agree how incidents are detected and logged, and rehearse the six-hour report to RBI on DAKSH and the notification to CERT-IN. At Level IV, connect this to the CSOC and cyber drills.

    OutputsIncident procedureDrill records
  7. 7

    Set up IS audit and reporting

    Constitute the IS audit cell, adopt an IS audit policy and plan audits to finish before the statutory audit. Brief the Board at least annually and track audit findings to closure.

    OutputsIS audit policyBoard briefing record
  8. 8

    Re-check the level as services change

    A new mobile app, UPI membership or ATM switch can move the bank up a level. Review the level whenever digital services change and keep evidence current for supervisory review.

    OutputsLevel review logEvidence library

Audit and evidence guide

What auditors look for, and the evidence to keep

Compliance is reviewed through RBI’s supervision of the bank and through its own IS audit, which reports to the Audit Committee of the Board. Reviewers start from the bank’s level and then look for proof that each applicable requirement operates.

What reviewers look for

  • The self-assessment of the level, and whether it matches the bank’s actual payment system and digital profile
  • A Board-approved cybersecurity policy distinct from the IT policy
  • Two-factor authentication with a dynamic second factor for CBS and connected applications
  • Offline backups and evidence that restoration works
  • Vendor contracts with audit and inspection rights, and ATM switch provider controls where relevant
  • Incident records showing detection time and reporting on DAKSH within six hours, and to CERT-IN
  • VA/PT reports for critical applications and DMZ systems, and tracking of findings to closure (Level II and above)
  • The IS audit cell, IS audit policy and timing of audits relative to the statutory audit
  • At Level IV: CSOC operation, CISO reporting line and quarterly Information Security Committee minutes

Recurring obligations and timelines

Board briefing on basic IT and cyber riskAt least once a year
Report cyber incidents to RBI on DAKSHWithin 6 hours of detection
VA of critical applications and DMZ systems (Level II+)At least every 6 months
PT of the same systems (Level II+)At least once a year
Security testing of web and mobile apps (Level II+)Before go-live, major change
Management awareness quiz and training (Level III+)Every year
CISO cyber preparedness review to ITSC or Board (Level IV)Quarterly
Information Security Committee meetings (Level IV)At least quarterly
IS audit completionBefore the statutory audit
BCP/DR plan testingAt periodic intervals

Evidence to keep, by area

Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.

Applicability

  • Level self-assessment
  • Payment system membership records
  • Board decision on voluntary higher controls

Governance

  • Board-approved cybersecurity policy
  • Board briefing records
  • Information security official or CISO appointment

Baseline controls

  • Asset inventory
  • CBS two-factor configuration
  • Patch and change records
  • Access reviews

Backup and resilience

  • Backup logs and offline copies
  • Restoration tests
  • BCP/DR test reports

Vendors

  • Due diligence records
  • Contracts with audit and inspection clauses
  • ATM switch ASP control confirmations

Incidents

  • Incident register with detection times
  • DAKSH and CERT-IN submissions
  • Lessons learnt

Testing and audit

  • VA/PT reports and closure tracker
  • IS audit policy
  • IS audit reports and Audit Committee review

Areas that often need attention

  • Level assessed once and not revisited after a new mobile app or UPI membership
  • Cybersecurity policy merged into the IT policy
  • CBS second factor that is static or tied to the payment terminal
  • Backups kept only online, with no restoration test on record
  • Vendor and ATM switch provider contracts without audit or inspection rights
  • Incident detection times not recorded, so six-hour reporting cannot be shown
  • VA/PT findings with no tracked closure
  • IS audit finishing after the statutory audit

How Netra helps

Where each part of the work lives in Netra

Netra loads the UCB Direction as requirements, tasks and policies, scoped to the chapters that apply to the bank’s level. A small team then works from one record.

Only the chapters that apply to the bank’s level

Compliance Centre

Status for each chapter and requirement is derived from completed tasks and evidence, never typed in, so every figure traces back to the work.

Every requirement owned and tracked

Task Engine

Requirements arrive as tasks with owners and due dates. Recurring tasks cover six-monthly VA, annual PT, Board briefings and quarterly committee work so that evidence stays current.

Board-approved cybersecurity and IT policies

Policy Hub

A policy library generated at onboarding, with a policy score that rises as the work behind each policy is done.

Cyber risk rated and treated

Risk Manager

A risk register with inherent and residual heatmaps, with risks reduced as the linked tasks are completed.

Vendors and ATM switch providers

Third-Party Risk

Find vendors from what Accounts and Purchase pay, assess them through a vendor portal and record each decision with a rating.

IS audit and supervisory reviews

Audit Centre

Run internal and regulatory audits end to end, with findings and corrective actions, using evidence held in a tamper-evident vault.

Reporting to the Board

Dashboard & Reports

A live Posture Score and a one-click board report for the Direction.

Support from a service partner

Partner Portal

An MSSP, vCISO or audit firm can work on the bank’s programme alongside its other clients from one login, while the bank keeps its own responsibilities.

Netra organises the work, evidence and reviews. It does not decide the bank’s level, is not a SIEM or a CSOC, is not a reporting channel to RBI or CERT-IN, and does not by itself establish compliance. The bank remains responsible for implementation and regulatory interpretation.

Common questions

More questions about Netra

Related frameworks

View all frameworks
Financial services

RBI CTRRAF 2026 - Commercial Banks

Connect bank-wide cyber governance with reviewable evidence

Financial services

RBI CTRRAF 2026 - Non-Banking Financial Companies

Build an NBFC compliance programme around your actual scope

Security

CERT-IN Guidelines

Keep incident-readiness and record-keeping work organised

See RBI CTRRAF 2026 - Urban Co-operative Banks in Netra

See how Netra connects your framework requirements with tasks, evidence and audit follow-up.