Critics of the new RBI framework warn that while the intentions are noble, the practical implementation could place an unsustainable burden on smaller commercial banks. Cybersecurity is an expensive endeavor, requiring specialized talent and high-end technology that many regional or smaller private banks may struggle to afford. There is a genuine risk that these institutions will be forced to divert funds from customer service or loan expansion just to meet these rigid regulatory requirements.
There is also concern that the 'one-size-fits-all' approach might not be the most efficient way to handle diverse security threats. Smaller banks often have different risk profiles compared to large national institutions, and forcing them to follow the exact same protocols could lead to a 'check-the-box' culture. In this scenario, banks might focus more on meeting the letter of the law to avoid fines rather than actually innovating to stop real-world threats.
Furthermore, some industry experts worry that the rapid pace of implementation could lead to technical glitches. If banks are forced to overhaul their legacy systems too quickly, they might inadvertently introduce new vulnerabilities or cause service disruptions for customers. The complexity of integrating these new security layers with older software is a significant challenge that could lead to unintended downtime.
Finally, there is the question of whether this framework will truly stop sophisticated state-sponsored hackers or organized crime syndicates. Critics argue that cybercriminals are constantly evolving, and a static regulatory framework might be obsolete by the time it is fully implemented. Instead of heavy-handed mandates, some suggest that the RBI should focus on fostering better information sharing between banks and the government to respond to threats in real-time.