INTERNATIONAL FINANCIAL SERVICES CENTRES AUTHORITY NOTIFICATION Gandhinagar, the 29th September, 2025 F. No. IFSCA/GN/2025/010.-In exercise of the powers conferred by sub-section (1) of section 28 read with sub-section (1) of section 12 and sub-section (1) of section 13 of the International Financial Services Centres Authority Act, 2019 (50 of 2019) and section 34 B read with sub-section (1) and clauses (b) to (f) of sub-section (2) of section 38 of the Payments and Settlement Syste... ... ...

Cyber Regulations Advisory Committee is constituted under section 88 of the Information Technology Act, 2000, replacing the earlier committee constitution while preserving prior acts and omissions. Its membership combines ministers, senior government officials, rotating State and technical representatives, law-enforcement, certifying-authority, industry, internet-service-provider and trade-body representation. Non-official members may receive travelling and dearness allowances under Central Government rules, and persons may be co-opted for specified meetings.

INTERNATIONAL FINANCIAL SERVICES CENTRES AUTHORITY NOTIFICATION Gandhinagar, the 13th October, 2025 F. No. IFSCA/GN/2025/011.-In exercise of the powers conferred by sub-section (1) of Section 28 read with sub-section (1) of Section 12 and sub-section (1) of Section 13 of the International Financial Services Centres Authority Act, 2019 (50 of 2019), read with Section 30, Section 11A and Section 28C of the Securities and Exchange Board of India Act, 1992 (15 of 1992), the Internationa... ... ...

TechFin and Ancillary Service Providers must obtain registration before operating in an IFSC and may provide only permitted support and technology services that facilitate specified financial services. Applicants must meet prescribed legal-form, jurisdictional and fit-and-proper requirements, complete the application process, and report material changes. Providers must appoint required officers, serve eligible Intermediaries or Service Recipients, operate principally in Specified Foreign Currency, maintain records and submit required reports. The Authority may seek information, inspect operations, relax requirements on recorded reasons, and take action for contraventions after written submissions.

National Critical Information Infrastructure Protection Centre is designated as the national nodal agency for Critical Information Infrastructure Protection under the Information Technology Act, 2000. The designation assigns national-level nodal responsibility for the protection of critical information infrastructure to that Centre.

Regional Forensic Science Laboratory, Northern Range, Dharamshala, District Kangra, Himachal Pradesh, is notified as an Examiner of Electronic Evidence within India. Its authorised scope includes computer media forensics, excluding floppy disk drives, and mobile device forensics.

Section 270A distinguishes under-reporting from misreporting of income and subjects misreporting to specific statutory contingencies. A notice commencing penalty proceedings must identify the exact charge and the relevant misreporting limb, enabling the assessee to respond effectively. Where notices refer only to under-reporting and omit both the misreporting charge and the applicable statutory limb, a penalty imposed for misreporting is unsustainable.

Core Banking Solution and Unified Payments Interface Switch computer resources, including associated dependencies, are declared protected systems as Critical Information Infrastructure. Punjab & Sind Bank may specify in writing authorised persons for access, including designated employees, managed-service-provider personnel or third-party vendors on a need-based basis, and consultants, regulators, government officials, auditors or stakeholders on a case-by-case basis.

Computer resources supporting Tamilnad Mercantile Bank Limited's Core Banking Solution and Unified Payments Interface Switch, including associated dependencies, are declared protected systems as Critical Information Infrastructure. The bank may authorise access by written order for designated employees, need-based managed-service-provider personnel or third-party vendors, and consultants, regulators, government officials, auditors or stakeholders on a case-by-case basis.

Public consultation governs the making and amendment of regulations and specified subsidiary instructions that impose requirements or explain the meaning, scope or intent of provisions. Consultation papers must disclose the regulatory problem, objectives, enabling basis, draft measures and comment process. Comments are ordinarily invited for at least 21 calendar days, subject to recorded exceptions by the Chairperson. Comment summaries and responses must generally be published before notification or issuance, while substantive changes may require written reasons or fresh consultation. Regulations are ordinarily reviewed every five years, and specified urgent, procedural, coordinated, market-integrity, national-security and international-obligation matters are excluded.

Cash deposits during the demonetisation period may be assessed as unexplained investment under section 69 where the taxpayer fails to establish their source. Small ATM withdrawals made over an extended period, substantially before the deposits, may reasonably be treated as personal or family expenditure rather than cash retained for a later large deposit. The claimed custody of cash requires substantiation. Section 69 uses discretionary language, but its application is justified when deposits are not explained under an identifiable head of income. On these facts, the deposits were treated as unexplained investment against the taxpayer.

The LRIT system, including its facilities, information, assets, logistics infrastructure and dependencies at LRIT locations, is declared a protected system under the Information Technology Act, 2000. Role-based access is confined to authorised departments, designated LRIT officers and support staff, authorised managed service provider personnel, and authorised third-party vendors and partners. Shipping companies are limited to viewing rights for their own ships.

Exclusive electronic publication of the Gazette of India is instituted under section 8 of the Information Technology Act, 2000. Gazette content is to be published only through the official e-Gazette website. The Department of Publication must maintain records of electronically published notifications for reference. Government printing and sale of hard-copy Gazettes are to cease, and users may download the electronic Gazette free of charge.

Recognised market infrastructure institutions must perform critical operations involving trading facilities, clearing and settlement, dematerialisation, record keeping, core IT infrastructure, business continuity, disaster recovery, and cyber resilience. Their regulatory and compliance functions cover risk management, surveillance, listing, participant registration, admission of issuers and products, inspection, enforcement, arbitration, grievance redressal, member-default arrangements, and investor protection. Other functions include sales, marketing, product development and finance.

Section 144C's amended definition of "eligible assessee" extends draft-assessment and Dispute Resolution Panel protection to non-residents other than companies for assessments made after 1 April 2020. Where a proposed assessment includes a prejudicial variation, the Assessing Officer must issue a draft order and allow the eligible assessee 30 days to accept the proposal or file objections before the Dispute Resolution Panel. Failure to follow this process because of an intervening statutory amendment is a remediable procedural defect and does not abate the assessment proceedings; however, a direct final assessment order issued without the prescribed procedure cannot be sustained.

Recognised market infrastructure institutions must comply with applicable IFSC and securities-market legislation and directions, apply due diligence, and maintain effective risk management, governance, investor-protection and investor-education measures. They must treat applicants and members fairly and transparently, promptly inform the Authority of violations by members, participants or issuers, safeguard system and market integrity, avoid conflicts and unfair competition, assign clear management responsibilities, and monitor participant compliance. They remain responsible for employee conduct and must promote sound business practices.

Regulation 63C requires each recognised market infrastructure institution to appoint a chief information security officer separately and in addition to a chief technology officer. The chief information security officer oversees the institution's cyber security posture and reports directly to the managing director or chief executive officer. The requirement took effect from 1 November 2024.

Recognised market infrastructure institutions that are neither subsidiaries nor joint ventures must appoint a chief legal officer. Subsidiaries and joint ventures may rely on legal assistance from a parent entity, but must appoint the officer if that assistance is not provided. The Authority may require appointment by institutions beyond a specified size and scale of operations. The officer must mitigate legal risk, including by vetting bye-laws, amendments, and legal documents for proposed cross-border arrangements.

Each recognised market infrastructure institution must appoint a Chief Risk Officer to identify and monitor risks associated with its functioning, initiate necessary mitigation measures, and assume overall responsibility for risk management. The Chief Risk Officer must submit a report to the Authority every half-year, combining risk oversight with recurring regulatory reporting.

Computer resources relating to the Core Banking Solution and Unified Payments Interface Switch, including associated dependencies, are declared protected systems under the Information Technology Act, 2000. Jammu & Kashmir Bank Limited may specify authorised users by written order, including designated employees, need-based managed-service-provider personnel or third-party vendors, and consultants, regulators, government officials, auditors or stakeholders on a case-by-case basis. The designation takes effect upon publication in the Official Gazette.