Research
Indian BFSI organisations in 2026 face four overlapping regulatory frameworks that all require multi-factor authentication.
This playbook maps all four frameworks to specific technical controls, provides a deployment sequence that closes regulatory exposure in priority order, and includes the seven-element evidence package CERT-In auditors will request.
Three regulators. Four frameworks. Two deadlines already in force. One now effective. One thirteen months away.
All pointing at the same control gap. All requiring - in different languages but with identical operational meaning - that your organisation knows, with evidence, who accessed what system, when, and from where.
This compliance reference document is built for CISOs, IT heads, and compliance officers at Indian banks, NBFCs, insurance companies, and payment system providers. It is not a product brochure. The regulatory analysis is vendor-neutral. The technology section declares its scope as Cisco Duo specifically, with a link to a multi-vendor comparison for organisations that want one.
The Regulatory Landscape - detailed treatment of all four frameworks with specific requirements, effective dates, and what RBI/CERT-In/SEBI examiners will ask for. Includes the RBI IT Governance Master Direction treatment that most compliance content misses entirely.
The Control Gaps - composite illustrations drawn from BFSI deployment experience, framed against DSCI's finding that 73% of Indian organisations are unaware of whether they have ever been attacked (DSCI India Cyber Threat Report 2025). The authentication coverage gap, the SMS OTP dependency, the vendor access gap, and the compliance documentation gap.
The MFA Implementation Framework - a regulatory-to-technical requirements map covering all four frameworks; a factor selection matrix by user population (retail customers, branch employees, back-office staff, privileged administrators, vendors); and a six-phase deployment sequence with weeks, actions, and compliance outcomes per phase.
The Architecture Case - Cisco Duo's RADIUS-based integration architecture for legacy BFSI systems; Mumbai data centre residency confirmation; Verified Push and FIDO2 for privileged accounts; and the audit trail that RBI and CERT-In examiners ask for.
The Compliance Calendar - a single table showing all four frameworks, their MFA obligations, current status, and consequence of non-compliance.
Eight Frequently Asked Questions - structured as regulatory requirements questions, not vendor questions, covering NBFCs, data localisation, log retention, SMS OTP sufficiency, DPDPA scope, break-glass procedures, deployment timelines, and MFA mandate status under DPDPA.
The deployment sequence in this playbook is structured to close regulatory exposure in order of urgency, not in order of operational convenience. If your organisation is approaching this with limited time before an examination or audit, the sequence is: credential audit first, privileged access second, VPN and remote access third. The customer-facing payment authentication review is a parallel workstream with a longer timeline - six to eight months for banks on proprietary platforms - and should not block the internal controls deployment.
The evidence package section is designed to be used from Day 1, not assembled the week before an audit. Every phase of the deployment generates a document that becomes part of the audit evidence package. Read that section before you begin, not after.
SEBI CSCRF - compliance window already closed. SEBI's Cybersecurity and Cyber Resilience Framework mandated MFA for privileged access to all trading systems, risk management systems, and back-office infrastructure. Compliance deadlines for registered market participants - brokers, depository participants, asset management companies, portfolio managers, KYC registration agencies, and market infrastructure institutions - ran from January to April 2025. Organisations that have not deployed MFA for privileged access are already outside the compliance window. The first post-deadline examination cycle is underway.
CERT-In CISG-2025-02 - in force since 25 July 2025. CERT-In's Comprehensive Cyber Security Audit Policy Guidelines (CISG-2025-02) make annual cybersecurity audits mandatory for all Indian organisations - public and private. The guidelines explicitly require MFA for all remote access connections, 180-day log retention stored in India, and named individual accounts for all critical system access. Organisations in BFSI are additionally subject to audit frequency requirements from their sectoral regulators.
RBI Authentication Mechanisms Directions 2025 - effective 1 April 2026. The Reserve Bank of India's Authentication Mechanisms for Digital Payment Transactions Directions, 2025, issued on 25 September 2025, mandate two-factor authentication for all digital payment transactions. At least one factor must be dynamic for non-card-present transactions. The factor independence principle requires that the reliability of one factor must not affect the other. Risk-based authentication is required for higher-value and anomalous transactions.
DPDPA 2023 - full enforcement deadline 13 May 2027 India's Digital Personal Data Protection Act 2023 does not mandate MFA by name but requires data fiduciaries to implement "reasonable security safeguards" for personal data. Every credible legal interpretation of "reasonable safeguards" in 2026 includes MFA for systems storing, processing, or transmitting personal data. The penalty for failure to implement security safeguards is up to ₹250 crore per instance (DPDPA 2023, Schedule 1 Item 4). Unlike RBI penalties, DPDPA penalties are triggered by breach events, not examination cycles.
This playbook is written by Proactive Data Systems, a Cisco Preferred Security Partner with 35 years of enterprise infrastructure deployment across Indian BFSI organisations. The regulatory analysis reflects frameworks as understood in March 2026. The technology section focuses specifically on Cisco Duo, declared at the opening of that section.
The playbook does not contain:
Legal advice. The regulatory analysis describes what frameworks require operationally. It does not constitute legal counsel and should not substitute for independent legal advice on specific compliance obligations.
A vendor-neutral MFA comparison. A multi-vendor comparison of MFA platforms for Indian enterprises - covering Cisco Duo, Microsoft Entra ID, Okta, ManageEngine, and miniOrange - is available separately here.
Specific client case studies. The deployment scenarios are composite illustrations drawn from deployment experience, not descriptions of named clients.
Proactive Data Systems Pvt Ltd is a Cisco Preferred Security Partner holding Preferred designation across Security, Networking, Collaboration, Cloud and AI, and Services - one of a very small number of partners in India to hold this designation across all five portfolios. Proactive has been deploying security and IT infrastructure across India since 1991.
Delhi · Mumbai · Pune · Bengaluru · Hyderabad · Indore
Quick answers to common questions about this resource.
Fill the form and get instant access to this research. We will also send a copy to your inbox.
We respect your inbox. We only send what's worth reading!
Enjoy your Research. We have also sent a link to your inbox.
We'll get back to you shortly.
