In a key development for regulated entities, the Securities and Exchange Board of India (SEBI) has extended the deadline for implementing Technology Compliance from the original date to August 31, 2025.
The Banking, Financial Services and Insurance (BFSI) sector is navigating legacy technologies, rising risks, and at the same time trying to comply with SEBI rules. In reality, SEBI rules are safeguards against the potential threats and risks. This extension is a great opportunity for regulated entities who are faced with multiple challenges related to technology compliance to comply and make the most of the extended timeline.
Let us look at some examples of cybersecurity incidents in the last few years in the BFSI sector and how the implementation of SEBI guidelines could have avoided them.
The names are not important, but the lessons learnt are. These are all real-life cases.
Mobile App Glitch
In 2024, a technical glitch in a private bank’s mobile app exposed card details
of around 17,000 users—CVV, full numbers and expiry dates.
SEBI guidelines call for robust application security measures including secure development lifecycle, API encryption, user behavior analytics, and real-time monitoring. Proper testing, data masking, and encryption would have safeguarded sensitive data—even with the bug.
Bank’s Server Leak
In the year 2019, an unprotected server exposed mobile numbers, partial account numbers, balances, and transaction details of a million customers of a famous bank.
SEBI requires strong access controls, encryption at rest, and continuous security auditing of all endpoints. Had the bank followed secure configuration standards and performed penetration testing per SEBI’s cyber framework, this misconfiguration would likely have been flagged and remediated before exposure.
Brokerage Data Leak
In 2023, personal data of about 8 million brokerage customers (names, addresses, bank details, contact info) surfaced on hacker forums.
By enforcing vulnerability scanning, timely patching, secure staff training, and insider threat controls, SEBI’s mandates aim to prevent unauthorized access and data exfiltration in fintech and brokerage systems.
Bottom Line
These real-world examples show that many high-profile breaches result from weak endpoint protections, poor configuration, insufficient monitoring, or faulty development practices—all areas addressed in SEBI’s guidelines.
Following these guidelines not only helps avoid regulatory action but also boosts operational resilience and customer trust.
