India plans stringent digital locks to secure banking data
New Delhi: As cyber threats grow more sophisticated, India is looking to strengthen the digital safeguards protecting sensitive banking information and transactions. The Bureau of Indian Standards (BIS) plans to update the rules for protecting, storing and transferring encryption keys in line with the latest international norms, said two government officials in the know.
To be sure, encryption keys are digital codes that protect sensitive banking data and boost secure transactions.
The government's plan comes against the backdrop of growing concerns over financial data security, including the cybersecurity risks highlighted by Mythos and the suspected exposure of State Bank of India (SBI) customer records on the dark web.
The government seeks to align India's standards with the revised international specification, ISO 20038:2026, which lays down methods for securely packaging cryptographic keys for transfer and storage, the officials said.
According to the Reserve Bank of India's (RBI) Annual Report 2025-26, banks and financial institutions reported 10,114 fraud cases involving ₹48,021 crore in financial year 2026 (FY26). Although the number of reported cases fell by 57.4% from the previous year, the amount involved was up 46.4% from ₹32,803 crore.
“The proposed standards will be adopted after consultations with all stakeholders, including banks and security agencies,” said the first of the two officials cited above.
The cost of adopting the new standards will be borne by financial service providers, including banks and other institutions, the officials said.
“The need for globally aligned encryption standards has grown, as banks increasingly adopt new technologies, including artificial intelligence (AI)," the first official said. "While India's banking system is robust and has adequate security safeguards, the updated standards will help align it with evolving global cybersecurity threats and security practices.”
Pavan Duggal, Supreme Court lawyer and a cyber law expert, said standardization is essential for creating rules for the ecosystem, and India must be an active participant in developing such standards.
“Indian standards must be aligned with evolving global best practices, but they cannot simply copy what is followed in Europe or in the US. India's banking ecosystem has its own realities, including a vibrant online payment system such as UPI," Duggal said. “We need standards that address India's specific requirements, protect our sovereign interests and ensure that our systems remain interoperable with the global AI ecosystem.” Developing new standards is an urgent priority for India and the BIS is "the best vehicle” for this, he said.
Code change
The proposed changes would make it easier for different banking systems to identify, interpret and exchange financial information in a common format. They include assigning unique names to entries in the catalogue and dictionary, revising how business codes are linked to their respective code sets, and introducing new ways to track versions and link different parts of a message.
As per the second official cited above, the move will make financial messages easier to identify, understand and track across different versions. “They (new norms) would also allow messages to carry more details, such as clearer descriptions of information, codes and units, helping organizations interpret the data being exchanged more consistently,” said the official.
The official said the proposed changes will also cover generation of XML schemas, which are sets of rules that define how data is structured and exchanged between different computer systems. These rules help ensure banks and other financial institutions exchange information in a common format, reducing data mismatches and processing errors.
The revised schemas would be allowed to carry additional information, such as full names, definitions, identification schemes, unit codes and version details, the official added. They would also include optional labels to identify draft versions and track minor changes to message definitions. Changes to data types and digital information representation are also in the offing.
The proposal also seeks to align registration-related elements with the revised framework and update the responsibilities of the registration authority and organizations submitting information for registration.
While underscoring the need for the overhaul, experts stressed the need for continuous vigil by institutions.
“While strong encryption standards are essential for protecting sensitive financial information, continuous monitoring plays an equally important role in maintaining the security and reliability of banking services," said Bharat Joshi, co-founder and chief product officer, VuNet Systems, Bengaluru-based AI-driven business observability firm. "I believe enterprises should monitor their key management systems using an observability platform for encryption key lifecycles, identify keys approaching the end of their permitted usage periods, and generate proactive alerts to prevent unexpected service disruptions.”
Observability platforms can provide visibility into unusual key access patterns, failed authentication attempts, and application behaviour that may indicate potential security or operational risks, he added.
Queries sent on Monday to the department of consumer affairs, the BIS and the finance ministry remained unanswered until press time.
Highlighting increased cyberthreats, a PwC survey, Global Digital Trust Insights 2026, showed nearly 25% of Indian businesses had reported losses of at least $1 million from their most damaging cyber breach in the previous three years. The survey, which covered 138 Indian businesses, said 87% expected their cybersecurity budgets to rise over a year.