Practitioner Intelligence · BFSI

Same regulations. Five operating models. Very different governance.

For a bank, insurer or asset manager running a Global Capability Centre, what you must do first depends on whether the centre is new or established, and whether it runs in-house, through a provider, or as a mix of both. This page shows the difference at a glance, for a centre in India serving a parent regulated anywhere.

6 hrsto report a cyber incident to CERT-In, RBI, SEBI or IRDAI
6parent markets mapped: US, UK, EU, Singapore, Australia and Canada
5operating models, each with a different first priority

← Back to BFSI Intelligence

The BFSI GCC picture

Where BFSI centres are growing, and which work is changing

The context behind the map, from our fortnightly GCC landscape research.

About half

of new BFSI GCC units in India last year went to Hyderabad.

58%

of organisations run a hybrid model, mixing an owned centre with outsourced services.

Shrinking

KYC processing, data entry and transactional reconciliation, as AI document processing absorbs the work.

Growing

Finance plus technology and risk analytics, led by Hyderabad, Mumbai, Gurugram and Kraków.

The main BFSI GCC clusters are Hyderabad, Mumbai, Kraków and Metro Manila. Figures as of September 2026, compiled from Zinnov-Nasscom, ANSR, Taggd, WEF and city reports.

Pick your situation

What is your first priority in each phase?

Choose the model closest to yours. The list changes to show the one-line priority for each phase. Your choice carries over to our other GCC pages.

This is the summary layer. The full map goes down to owners, thresholds and watch-outs for every dimension in every phase. Phases 0 to 7 run in order; the + row applies across all of them if you operate in more than one country.

Terms used on this page

BCP: Business continuity plan: how critical services keep running through a disruption.
BIA: Business impact analysis: which processes matter most, and how long each can be down.
BOT: Build-Operate-Transfer: a partner builds and runs the centre, then hands it to you.
DPA: Data processing agreement: the contract setting how a provider may handle your data.
DPO: Data protection officer.
DSAR: Data subject access request: a person asking to see the data held about them.
KYC: Know your customer: identity and risk checks on clients.
SLA: Service level agreement: the performance a provider commits to.
DPDP: India's Digital Personal Data Protection Act, 2023, and its 2025 Rules.

Incident clocks

When something breaks, who has to tell whom, and how fast?

A serious incident starts several clocks at once. Your centre answers to India's regulators, and your parent answers to its own. These are the deadlines most teams need to have memorised before the first incident, not after it.

Provider or vendorTypical contract terms, managed service or third party

15 minPower event

1 hourCyber incident, true sanctions match

24 hoursData breach

Your GCCEscalates up to the group, typical group policy

2 hoursPriority 1 incident on a Critical function

4 hoursGlobal-scale failure, to the group board

24 hoursData breach, to the group DPO

Parent groupThen regulators

Your GCCReports out to regulators

6 hoursCERT-In, from noticing

6 hoursRBI cyber incidents, from detection

6 + 24 hoursSEBI, email then portal

6 hoursIRDAI, from noticing

72 hoursDPDP detailed breach report (expected May 2027)

India regulatorsWhere your centre sits

Where is your parent regulated?

Parent groupReports to its home regulators

Parent regulatorsHome country

The clock that catches people out: for most regulators, the clock starts when your institution becomes aware, not when your vendor tells you. A slow vendor notification uses up your time, not theirs.

A new kind of vendor: AI agents. In September 2026, Australia's government said an unreleased AI agent from a major developer had been accessing a government Medicare portal since June, and that the government was told only in September. The lesson above applies unchanged. If a provider's AI agent can reach your systems, your contract needs to say how fast they must tell you, because your regulator's clock may already be running. Source: TechCrunch

What's coming

Settlement is moving onto shared ledgers. Your operating rhythm will follow.

Not yet daily reality for most BFSI GCCs, but the direction is clear, and it touches two phases of the map above.

Phase 2, Daily operations

The batch window thins out

In September 2026, UK banks in a seven-bank project made their first payments to each other in tokenised deposits, with remortgage funds released automatically once the property transfer was confirmed. Settlement like this runs around the clock and reconciles as it goes. Cut-offs and end-of-day reconciliation, the rhythm many BFSI teams are built around, start to disappear.

Phase 6, Incidents

No overnight window to recover

When settlement is instant and always on, there is no quiet period to repair a failed batch before customers notice. Continuity plans and incident runbooks written around business hours need rework before the parent's first live flow, not after it.

People

Retrain before the work goes

Reconciliation and KYC processing roles are already shrinking. Centres that move those teams into exception handling, controls and data quality early keep the knowledge. Those that wait lose it along with the roles.

Related field note in our Library: When the batch window is the problem. Source for the UK example: Euronews.

Regulatory signals

What your parent's regulators will ask about next

A short list of changes that affect BFSI GCCs, picked from our research and refreshed every two weeks.

Last updated 25 September 2026

SEBI24 August 2026Its cyber incident reporting portal now follows the Financial Stability Board's FIRE format, so reports can be filed in stages from first alert to closure. The 6-hour email and 24-hour portal deadlines are unchanged.Phase 6, Incidents
FCA and PRAIn force 18 March 2027One UK regime for operational incident reports, plus an annual register of material third-party arrangements. A GCC serving a UK parent should expect to supply data for both. FCA PS26/2Phases 5 and 6
ESMA2027 prioritiesAI and tokenisation become EU supervisory priorities. National supervisors will map how firms use them and check the outcomes for clients. CoinDeskPhase 5, Reviews

Want the full map?

Bring your scenario. We will work through it with you.

The complete 360 view is shared in conversation, mapped to your model, your countries and your providers. A short session usually answers three questions:

Which phase are we actually in, and what have we skipped?
Where are our notification clocks weakest, including our providers' AI tools?
What would we change first?

See how we engage

Next read

Keep going

GCC IntelligenceHow a GCC scalesFour growth stages, where centres stall, and what unblocks the next move. Library, field noteWhen the batch window is the problemHow a 24-hour processing cycle creates the errors operations then spends its days fixing. Library, briefingAI in a regulated back officeMoving GenAI past the pilot into live BFSI operations, with the governance audit will ask about.

Sources

CERT-In Directions under section 70B of the IT Act, April 2022 (6-hour reporting).
RBI Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, 2023.
SEBI Cybersecurity and Cyber Resilience Framework (CSCRF), and SEBI circular of 24 August 2026 on FIRE-aligned reporting.
IRDAI Information and Cyber Security Guidelines, 2023, and later circulars.
FCA PS26/2 and PRA PS7/26, operational incident and third-party reporting, in force 18 March 2027.
Digital Personal Data Protection Rules, 2025, Rule 7 (breach intimation), commencing 18 months after notification on 13 November 2025.
EU GDPR, Article 33, and UK GDPR.
US: OCC, Federal Reserve and FDIC Computer-Security Incident Notification Rule (2021); NYDFS 23 NYCRR Part 500; SEC Form 8-K Item 1.05 (2023).
EU: Digital Operational Resilience Act (DORA), Article 19, and its technical standards on major incident reporting.
Singapore: MAS Notices on Technology Risk Management. Australia: APRA Prudential Standard CPS 234. Canada: OSFI Technology and Cyber Security Incident Reporting.
Zinnov-Nasscom India GCC Landscape 2026; ANSR on operating models; Taggd on GCC skills; WEF Future of Jobs Report 2025.
Provider and group timings are typical contract and policy terms from practitioner experience, not regulatory requirements.

Prepared by Pradeep Sharma · Practitioner Intelligence · BFSI. General practitioner guidance for discussion, not legal or regulatory advice. Regulatory timings as at 25 September 2026. Confirm all deadlines with your counsel and regulator for your own institution and jurisdiction.