SBOM for banks and financial services: SEBI CSCRF, RBI and CERT-In

Financial institutions run large estates of vendor, in-house and SaaS software under close supervision. This guide explains where SBOM expectations come from in Indian financial services and how to meet them in practice.

Why financial services are in scope

Banks, brokers, depositories, asset managers and payment firms depend on core banking platforms, trading systems, payment switches and SaaS services from a small number of vendors. A vulnerability in one widely used component can affect many institutions at once. Regulators have responded by asking for component-level transparency.

SEBI CSCRF

SEBI's Cybersecurity and Cyber Resilience Framework for regulated entities was issued by circular on 20 August 2024 ^[1]. SEBI's June 2025 FAQs clarify the SBOM requirement ^[2]:

• "SBOM shall be obtained for all the software/applications required for core and critical business operations", including applications in data centres and SaaS.
• The requirement applies "irrespective of in-house or third-party" development.
• Where an SBOM cannot be obtained, for example for legacy or proprietary software, "the Board/Partners/Proprietor of the organization shall approve the same with proper limitation, rationale, and risk management approach".

FOSSA's analysis summarises the expected SBOM content as including licence information, supplier name, top-level and transitive components with relationships, encryption used, cryptographic hash, update frequency, known unknowns, access control and accommodation of errors, and notes that SEBI does not mandate a particular format ^[3]. Banks that are also SEBI-registered intermediaries, for example as depository participants, should check how CSCRF applies to those activities.

RBI

RBI's Information Technology Governance, Risk, Controls and Assurance Practices Directions, 2023 (issued 7 November 2023, effective 1 April 2024) do not use the term SBOM. They do require regulated entities to obtain source code for critical applications from vendors, or put an escrow arrangement in place, and to obtain a certificate or written confirmation from the developer or vendor that the application is free of known vulnerabilities, malware and covert channels ^[4]. A current SBOM, correlated with vulnerability data, is a practical way to test and evidence such confirmations. KPMG's December 2025 review reports that RBI has advised regulated entities to adopt CERT-In's SBOM guidelines ^[5].

CERT-In and card payments

CERT-In's Version 2.0 guidelines give the most detailed Indian field list (21 SBOM fields) and recommend VEX and CSAF advisories from suppliers ^[6]. For card environments, PCI DSS v4.0 requirement 6.3.2 requires an inventory of bespoke and custom software and its third-party components, mandatory from 31 March 2025 ^[7].

What this means in practice

Cryptography and beyond

Financial institutions rely heavily on cryptography for payments, authentication and data protection. The SBOM identifies cryptographic libraries, but migration planning needs a CBOM of algorithms, keys, protocols and certificates. Hardware security modules and network appliances fall under the HBOM.

How IntelliXBOM helps

IntelliXBOM ingests vendor and in-house SBOMs in CycloneDX and SPDX, validates them against CERT-In and internal field policies, and correlates components with vulnerabilities, known-exploited lists, licences, end-of-life data and business services. It records VEX decisions and exceptions, maps inventory to framework controls, and produces timestamped evidence, self-hosted or air-gapped.

This article summarises public guidance for information only and is not legal advice; refer to the current official documents before acting.