A mid-sized payments company completes its Series B funding round and starts onboarding banking partners across three countries within the same quarter. The US partner asks for evidence of GLBA safeguards and NYDFS Part 500 alignment. The UK partner asks about FCA operational resilience testing. The Indian partner asks for proof of RBI-aligned VAPT and CERT-In empanelment. Each requirement is legitimate, none of them overlap cleanly, and the compliance team realizes the security programme built for one market does not automatically satisfy the next.
This is the reality behind cybersecurity requirements for financial services companies operating across more than one jurisdiction. The FBI’s Internet Crime Complaint Center recorded $20.877 billion in total cybercrime losses in 2025, a 26% increase over the previous year, according to the FBI’s 2025 Internet Crime Report. Business email compromise, the fraud category most directly targeting financial institutions through wire transfer manipulation, accounted for over $3 billion of that figure on its own. Regulators worldwide have responded by tightening cybersecurity compliance in financial sector oversight, and the requirements now differ meaningfully by region even as the underlying threat is the same everywhere.
This guide walks through the core financial cybersecurity regulations across the US, UK, EU, and India, the operational requirements that show up across nearly every framework, and how institutions operating globally can build one security programme that satisfies all of them.
Talk to Qualysec about mapping your cybersecurity programme against global financial regulations!
Why Financial Services Face a Different Compliance Bar
Each sector will have its own unique security expectations depending upon its use case. However, there are two additional aspects unique to the financial services sector:
The systemic risk argument. A large-scale outage or cyber incident at a key bank would inevitably impact the rest of the payments system, which is why regulators treat financial-sector resilience as a matter of national economic stability rather than a single company’s problem.
The target-attractiveness argument. Financial systems facilitate the movement of real money around the world, making them inherently more enticing targets for would-be criminals than most other industries that hold valuable but less immediately convertible data.
These two factors explain why banking cyber security standards tend to go further than general data protection law. A retailer that gets breached loses customer trust and faces a cleanup cost. A bank that gets breached can trigger a wire transfer that cannot be reversed, which is why regulators write cybersecurity requirements for financial services companies with far more operational specificity than they apply to most other industries.
Core Financial Cybersecurity Regulations by Region
U.S. Financial Services Regulations
| Regulation | Regulator | Core Requirement |
| Gramm-Leach-Bliley Act (GLBA) | FTC / federal banking agencies | Safeguards Rule requiring a written information security programme |
| NYDFS Part 500 | New York Department of Financial Services | Board-level cybersecurity governance, named CISO, annual certification |
| Sarbanes-Oxley Act (SOX) | SEC | Internal controls over financial reporting, including IT general controls |
| PCI DSS v4.0 | Payment Card Industry Security Standards Council | Cardholder data protection for any entity processing card payments |
| Bank Secrecy Act (BSA) | OCC / FinCEN | Transaction monitoring and anti-money laundering controls |
Several jurisdictions (most notably the NYDFS) define detailed security requirements covering everything from appointment of a named Chief Information Security Officer through to mandatory penetration testing and an annual declaration of regulatory compliance from senior management. As a rule-of-thumb, if you meet all the criteria under the New York DFS (“Part 500”) regime, chances are good that you’ll also be compliant with the majority of similar obligations under other jurisdictional regimes such as GLBA and various state equivalents.
United Kingdom and European Union
| Regulation | Regulator | Core Requirement |
| Digital Operational Resilience Act (DORA) | European Supervisory Authorities | ICT risk management, third-party oversight, resilience testing |
| PSD2 | National competent authorities | Strong customer authentication for payment transactions |
| NIS2 Directive | National cybersecurity authorities | Incident reporting and supply chain security for essential entities |
| FCA Operational Resilience Rules | Financial Conduct Authority | Impact tolerances for important business services |
As the most consequential addition to financial sector cybersecurity regulations within the EU over the last few years, DORA becomes fully applicable in January 2025. In contrast with many of its predecessors, DORA covers not just traditional banks, but also a wider array of financial cybersecurity regulations ranging from insurers to investment firms to even crypto-asset service providers, while also extending beyond traditional banks to cover the critical ICT third-party suppliers required to run modern banking operations.
India
| Regulation | Regulator | Core Requirement |
| RBI Master Directions on IT Governance (2024) | Reserve Bank of India | Board-approved IT policy, CISO reporting outside IT, mandatory VAPT |
| SEBI CSCRF | Securities and Exchange Board of India | Tiered cybersecurity and resilience framework across 19 regulated entity categories |
| CERT-In Directions | Indian Computer Emergency Response Team | Incident reporting within 6 hours of detection |
| DPDP Act, 2023 | Data Protection Board of India | Security safeguards for personal data, breach notification |
India’s regulatory model layers RBI, SEBI, and DPDP requirements on top of each other, with SEBI clarifying that entities already meeting RBI-aligned cybersecurity norms do not need to duplicate controls for overlapping infrastructure. This alignment reduces redundancy but still requires institutions to map which regulator’s requirements apply to which system, particularly where shared infrastructure serves both banking and securities market functions simultaneously.
Operational Requirements That Appear Across Every Framework
Despite regional differences, security compliance for financial institutions converges on a common technical baseline almost everywhere. Institutions building a global security programme should treat this shared baseline as their foundation, then layer regional specifics on top of it. One element common to nearly every cybersecurity framework is board-level governance. Most frameworks now require oversight to sit directly with the board or with a senior officer who reports into the organization’s highest ranks.
- Board-level governance. Nearly every framework now requires cybersecurity oversight to sit with the board or a designated senior officer, not solely with IT.
- Regular penetration testing and VAPT. NYDFS Part 500, RBI’s Master Directions, and DORA’s resilience testing requirements all mandate periodic, independent security testing rather than one-time assessments.
- Third-party and vendor risk management. DORA’s ICT third-party oversight, RBI’s outsourcing guidelines, and NYDFS’s third-party service provider policy all treat vendor risk as the institution’s own risk.
- Incident response and reporting timelines. CERT-In’s 6-hour window, NYDFS’s 72-hour notification requirement, and DORA’s incident classification rules all demand a tested, rehearsed response process, not an improvised one.
- Encryption and access controls. Data at rest and in transit, privileged access management, and network segmentation are baseline expectations across every regulation listed above.
Common Compliance Gaps Institutions Run Into
- Treating one region’s compliance as a template for another. Your programme was designed specifically to meet NYDFS Part 500, which addresses many elements covered by DORA’s technical baseline but omits the specifics on third-party oversight and resilience testing.
- Outsourcing risk without outsourcing accountability. Regulators consistently place accountability at the institution level rather than the vendor, even when the vendor caused the incident.
- Incident response plans that were written but never rehearsed. A documented plan that has not been tested against the actual notification deadline tends to fail exactly when it matters most.
- Penetration testing treated as a compliance checkbox. Most frameworks now specify testing scope, frequency, and independence requirements that a superficial annual scan cannot satisfy.
How Qualysec Helps With Financial Sector Cybersecurity Compliance
Financial institutions operating across multiple regulatory regions do not need five separate security programmes. They need one strong programme mapped correctly to each region’s specific requirements.
Multi-Framework Gap Assessment
Qualysec assesses an institution’s existing security controls against the specific requirements of NYDFS Part 500, RBI’s Master Directions, DORA, and other applicable frameworks simultaneously, identifying where one strong control satisfies multiple regulators and where a region-specific gap remains.
Independent Penetration Testing Built for Regulatory Evidence
Qualysec’s VAPT engagements are structured to produce evidence that satisfies the independence, scope, and reporting expectations of NYDFS, RBI, SEBI CSCRF, and CERT-In simultaneously, avoiding the need for separate testing engagements per regulator.
Incident Response Readiness Across Jurisdictions
Different regulators require notification within different windows, from CERT-In’s 6 hours to NYDFS’s 72 hours. Qualysec builds and tests incident response procedures calibrated to the fastest applicable deadline, so institutions are never caught deciding how to respond after an incident has already started.
Schedule a global cybersecurity compliance assessment with Qualysec!
Conclusion
Cybersecurity requirements for financial services companies are converging on the same underlying principles: board accountability, tested incident response, independent security testing, and vendor oversight, even as the specific rules differ by region. The institutions that struggle are the ones treating each regulator’s requirements as a separate project instead of building one security programme strong enough to satisfy all of them at once. With DORA fully in force, RBI’s Master Directions tightening annually, and NYDFS setting the pace in the US, the cost of fragmented compliance is no longer just regulatory risk. It shows up directly in the $20.877 billion figure the FBI recorded in 2025, much of it flowing through the exact wire transfer and account access controls these frameworks were built to strengthen.
Contact Qualysec to build a unified cybersecurity compliance programme across every market you operate in!
Frequently Asked Questions
What are the key cybersecurity requirements for financial services companies?
In addition to these specific regionally mandated items, all frameworks emphasize certain key areas. These include board-level cybersecurity governance, having a named senior security officer, performing independent penetration testing regularly, having documented and tested incident response procedures, managing risks relating to vendors and third parties, and encrypting sensitive data both at rest and during transit. Region-specific rules include New York’s DFS Part 500, which was enacted by the state as a rule of general applicability for financial services companies in the US. In the EU, the Digital Operational Resilience Act (DORA) requires financial entities to manage ICT risk, oversee critical third-party providers, and undergo regular resilience testing. In India, the Reserve Bank of India’s (RBI) Master Directions have recently been updated to tighten IT governance requirements for banks and NBFCs.
Does DORA apply to financial institutions outside the European Union?
DORA applies to financial entities operating within the EU and to the critical ICT third-party providers those entities rely on, regardless of where that third party is headquartered. A US or India-based technology vendor supplying critical services to an EU bank falls within DORA’s oversight even without an EU office, which makes DORA relevant well beyond the EU’s own financial institutions.
How does India’s RBI cybersecurity framework differ from PCI DSS?
The RBI’s Master Directions establish guidance on IT governance and cybersecurity across all banks and NBFCs operating in India, including key considerations related to board-level accountability, incident reporting, and outsourcing risks. In contrast, the PCI DSS focuses narrowly on how entities should protect cardholder data when processing card payments – no matter who they are (any entity) or where in the world they operate from. An Indian bank typically needs to satisfy both simultaneously, since RBI governs the institution broadly while PCI DSS governs the card payment function specifically.
What happens if a financial institution fails a cybersecurity compliance audit?
The consequences vary from one regulator to another, though they usually consist of a combination of these elements.
- Mandatory Remediation Timelines – NYDFS can seek enforcement action against those involved with the institution (and possibly even individual officers who signed the false compliance certification).
- Increased Supervisory Scrutiny – In many instances, such as those under the RBI or SEBI, regulators may decide to limit certain business activities until any deficiencies have been addressed.
- Financial Penalties – There are often associated financial penalties for failing to comply with regulatory requirements.
- Escalating Consequences – With each failure, there tends to be an escalation in the potential consequences, which could involve things like license or registration risk if things get too bad.
How often should financial institutions conduct penetration testing?
Most frameworks now specify testing frequency rather than leaving it open-ended. NYDFS Part 500 requires penetration testing at least annually alongside continuous vulnerability assessments. RBI’s Master Directions expect regular VAPT as part of ongoing IT governance. DORA requires resilience testing on a risk-based schedule, with more frequent testing for critical systems. Institutions operating across regions should test against the shortest applicable interval rather than the longest.
