RBI amends Minimum Capital Requirements for Operational Risk, mandating higher capital buffers for cyber risk exposure in commercial banks.
RBI Amends Operational Risk Capital Norms for Cyber Threats
The Reserve Bank of India, on October 23, 2026, issued the 'Reserve Bank of India (Commercial Banks – Forthcoming Instructions) Second Amendment Directions, 2026', revising Chapter IV on Minimum Capital Requirements for Operational Risk. The amendment introduces a dedicated capital charge for cyber risk, reflecting escalating digital threat landscapes.
The revised framework requires banks to assess and quantify potential losses from cyber incidents using scenario-based modelling and stress testing. A portion of the operational risk capital buffer must now be specifically allocated to cyber resilience. The RBI will review banks’ methodologies annually as part of the Supervisory Review and Evaluation Process (SREP).
Legal advisors must ensure banks’ internal capital adequacy assessment processes (ICAAP) are updated to incorporate the new cyber risk module. Boards and senior management are expected to demonstrate due diligence in risk estimation. Non-compliance may result in higher provisioning requirements or restrictions on digital banking expansions. This signals RBI’s intent to enforce proactive cyber governance at the board level.
