RBI’s 2026 cybersecurity Directions for urban co-operative banks: the four levels, and what each one asks
RBI’s 2026 Directions sort urban co-operative banks into four levels. See how to find your level, what each level adds, and the evidence a supervisor will want.
Key takeaways
- Every UCB meets Chapters II and III. Higher levels add Chapters IV, V and VI in turn.
- The bank assesses its own level, so the reasoning needs to be recorded and revisited when services change.
- Incident reporting to RBI on DAKSH within six hours of detection applies at every level.
- A bank passes review on evidence that the controls ran, not on the existence of a policy.
On 31 July 2026 the Reserve Bank of India issued the Urban Co-operative Banks Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026. They came into force with immediate effect. They apply to urban co-operative banks (UCBs), meaning primary co-operative banks under section 5(ccv) read with section 56 of the Banking Regulation Act, 1949, and they repeal the earlier cybersecurity framework instructions for UCBs.
The central idea is a graded approach. Every UCB meets a baseline, and a bank with more digital services or a deeper connection to the payment systems meets more. The Directions call these Levels I to IV.
Which level is my UCB?
Level I applies to every UCB, whatever its digital offering. The levels are based on digital depth and interconnectedness with the payment systems, and each one adds a chapter to the ones below it.
| Level | Chapters that apply | Who it covers |
|---|---|---|
| Level I | II and III | All UCBs |
| Level II | II, III and IV | A sub-member of the Centralised Payment Systems (CPS) that also offers internet banking, a mobile banking app, or is a direct member of CTS, IMPS or UPI |
| Level III | II, III, IV and V | A direct CPS member, or a UCB with its own ATM Switch or a SWIFT interface |
| Level IV | II to VI | A direct or sub-member of CPS that has its own ATM Switch and a SWIFT interface, or that hosts a data centre or provides software support to other banks |
Seven questions in the UCB level finder give a first reading. The bank assesses its own level (paragraph 10). The Board may also adopt measures stronger than its level requires. The Directions describe no step in which RBI assigns the level, so the self-assessment is the document a supervisor will ask to see first.
Watch for. A level assessed once and never revisited is a common gap. A new mobile app, UPI membership, ATM Switch or SWIFT interface can move the bank up a level. Re-run the assessment whenever a digital service changes.
What does the Board have to do?
Chapter II applies at every level. The Board approves the technology and cybersecurity strategies and policies (paragraph 7).
At Level I, the Board or Administrator approves a Cybersecurity Policy that is separate from the IT policy, with cyber risks rated low, medium, high or very high (paragraphs 11 and 12). The Board is ultimately responsible for information and cybersecurity (paragraph 17), and the bank may update its Board on basic IT and cyber risk at least once a year (paragraph 59).
At Level IV the governance structure grows:
- A Board-level IT Strategy Committee, which the bank may consider forming, with at least two directors, one of them a professional director
- A CISO who reports directly to the top executive overseeing risk management, or to the MD and CEO if there is none, has no reporting line to the CIO or CTO, and holds no business targets. The CISO presents a separate cybersecurity review to the IT Strategy Committee or Board every quarter (paragraph 175)
- An Information Security Committee with the MD and CEO or a designee, two senior officials and the CISO as member secretary, meeting at least quarterly (paragraph 177)
- An Audit Committee of the Board that reviews critical IS audit issues and monitors security and VA-PT findings until they are closed (paragraphs 9 and 179)
What does each level ask for?
Level I is where most of the specific controls sit. Each higher level adds to it.
| Level | What the Directions add | Evidence a reviewer will want |
|---|---|---|
| I | Asset inventory and data classification. Two-factor authentication for the Core Banking Solution with a dynamic second factor (paragraph 47). Periodic backups with important data stored offline (paragraph 69). Vendor due diligence, with audit rights and RBI inspection rights in contracts (paragraphs 72 and 73). An IS Audit Cell, with reports to the Audit Committee (paragraphs 94 and 100) | Inventory, CBS authentication configuration, backup logs and a restoration test, vendor files and contract clauses, IS audit reports |
| II | An official responsible for information security (paragraph 104). Security testing of web and mobile applications before go-live and after major change (paragraph 115). VA of critical applications and DMZ systems at least every six months, PT at least once a year (paragraph 116). Audit logs that support forensics, with an alert on any change to log settings (paragraphs 126 and 127). A written incident response plan, and BCP/DR plans tested periodically with an IS auditor assessing effectiveness (paragraphs 129 and 133) | Test reports and a findings tracker with closure dates, log configuration, the incident response plan, BCP/DR test reports and the auditor’s assessment |
| III | Systematic management and analysis of audit logs, with logging settings validated periodically (paragraphs 150 and 151). BCP/DR that supports recovery within recovery time objectives (paragraph 152). A documented procedure with third-party vendors so the bank hears of incidents on a timely basis (paragraph 153). Mandatory awareness for new recruits and web-based training every year for lower, middle and upper management (paragraph 156). Risk-based transaction monitoring for a direct CPS member that also has its own ATM Switch or SWIFT interface (paragraph 158) | Log review records, recovery time objectives and test results, vendor notification procedure, training completion records |
| IV | A Cyber Security Operations Centre for continuous surveillance, with staffing that supports 24x7 monitoring (paragraphs 159 and 165). Participation in cyber drills under CERT-In and IDRBT (paragraph 166). The CISO and Information Security Committee described above | CSOC operating records, drill participation, Information Security Committee minutes, CISO reports |
How fast must a cyber incident be reported?
At every level, within six hours of detection, on the DAKSH platform (paragraph 88). The Directions also ask the bank to report incidents in a timely manner and to notify CERT-In proactively (paragraph 87). Sharing threat intelligence with IB-CART and holding cyber insurance are written as options, not duties (paragraphs 89 and 90).
The six hours run from detection, so the record needs a detection time. See our guide to CERT-IN 6-hour incident reporting for how to build the record, and the commercial bank equivalent in RBI’s 2026 Directions for commercial banks.
Tip. Rehearse the report once a year with a made-up incident. Time the path from detection to a submitted report, and keep the timeline as evidence.
What evidence will a supervisor ask for?
The Directions say that records of the architecture review should be kept to enable supervisory assessment (paragraph 14), and they require remote access logs to be enabled and monitored (paragraph 37). Beyond those, expect a reviewer to start from the level and ask for proof that each applicable requirement operated:
- 1The level self-assessment, matched to the bank’s actual payment system and digital profile
- 2The Board-approved Cybersecurity Policy, kept apart from the IT policy
- 3Evidence of two-factor authentication on the CBS, and a backup that has been restored
- 4Vendor contracts with audit and RBI inspection clauses, including any third-party ATM Switch provider
- 5An incident register with detection times and the DAKSH submission
- 6From Level II, VA and PT reports with closure of findings tracked
- 7IS audit reports and the Audit Committee’s review of them
A checklist to start from
Tick what you already have.
Where the work usually gets stuck
In a small team the difficulty is rarely the reading. It is running the requirements on schedule while the same people run the bank. Levels get assessed once. Test findings stay open. Vendor contracts predate the Directions. When a reviewer asks for proof, it sits in email and shared folders.
How this is run as owned work in Netra
Treat each requirement as work with an owner and a due date, and let the evidence build as the work is done. In Netra, the RBI CTRRAF 2026 for Urban Co-operative Banks page describes how the Direction is loaded as requirements, tasks and policies. Evidence is attached once to the task and shown against every requirement it supports, and status is derived from completed work and evidence, not typed in. Recurring obligations such as the six-monthly tests reopen on their own, and the Audit Centre holds the IS audit findings and their corrective actions. The bank still decides its own level and remains responsible for implementation.
This article is a summary for general information. It is not legal advice. Confirm how the Directions apply to your bank with your compliance and legal teams, and read the Directions themselves.
Frequently asked questions
Does every urban co-operative bank have to report incidents within six hours?
Yes. Reporting on the DAKSH platform within six hours of detection sits in the Level I baseline, which applies to every UCB, and the bank is also expected to notify CERT-In proactively.
Who decides which level a UCB falls into?
The bank assesses this itself against its digital depth and its connection to the payment systems. The Directions describe no separate RBI assignment step, so the bank should keep its reasoning on file.
Does a UCB need a CISO?
A CISO with the reporting lines set out in the Directions is a Level IV requirement. From Level II, the bank must identify an official, who need not be titled CISO, to enforce information security policy.
Do vulnerability assessments apply at Level I?
The six-monthly vulnerability assessment and annual penetration test are in the Level II chapter, so they apply from Level II upwards. Level I banks are not covered by that requirement.
Sources
The UCB Directions, loaded as owned work
Requirements, tasks and policies scoped to your level, with status derived from evidence.
See it in Netra
A demo on the frameworks that matter to you.
