CRITICAL INFRASTRUCTURE DESIGNATION OF BANKS IN INDIA

Detailed Legal Explanation, Statutory Framework, RBI Regulations, Judicial Precedents and Legal Implications

1. Introduction

The designation of banks as Critical Infrastructure or Critical Information Infrastructure (CII) is an important aspect of India's national security, financial stability, cybersecurity and banking regulatory framework.

Banks do not merely operate as commercial enterprises. They perform essential economic functions such as accepting public deposits, extending credit, processing payments, facilitating government transactions and supporting the functioning of the financial system.

Consequently, a major disruption of banking infrastructure can have consequences extending far beyond the financial losses suffered by an individual bank.

For example, a serious cyberattack affecting a major bank's core banking system, payment infrastructure or interbank settlement operations may disrupt:

Access to public deposits and banking services.

ATM, internet banking, mobile banking and electronic payments.

Interbank fund transfers and settlement systems.

Government payments and public welfare transfers.

Financial markets, business operations and economic activity.

Public confidence in the banking system.

The legal rationale for designating banking infrastructure as critical is therefore that certain banking systems are indispensable to the continuity of essential financial and economic functions and may require enhanced statutory protection.

However, an important distinction must be made at the outset:

In India, the designation of a bank as systemically important, the identification of banking infrastructure as critical, and the formal declaration of a computer system as a protected system are three distinct legal concepts.

They may overlap, but they do not automatically produce identical legal consequences.

This distinction is essential when examining the Information Technology Act, 2000, the Banking Regulation Act, 1949, RBI directions and relevant judicial decisions.

2. Meaning of Critical Infrastructure and Critical Information Infrastructure

2.1 Critical infrastructure

Critical infrastructure refers broadly to the physical and digital systems, networks, institutions and services whose disruption or destruction may seriously impair national security, public safety, economic stability or essential public services.

Examples include banking and financial services, electricity supply, telecommunications, transport networks, healthcare systems and government infrastructure.

The expression critical infrastructure is broader than the specific statutory expression critical information infrastructure under Indian law.

2.2 Critical Information Infrastructure under Section 70A of the Information Technology Act, 2000

Section 70A of the Information Technology Act, 2000 provides the principal statutory framework relevant to identifying and protecting Critical Information Infrastructure.

The explanation to Section 70A defines Critical Information Infrastructure as:

“the computer resource, the incapacitation or destruction of which, shall have debilitating impact on national security, economy, public health or safety.”

This definition has several important legal elements.

First: The subject of protection must be a computer resource, which may include relevant computer systems, networks and associated digital resources as understood under the Act.

Second: The incapacitation or destruction of that computer resource must be capable of causing a debilitating impact.

Third: The relevant impact must concern national security, the economy, public health or safety.

Fourth: The definition is based on the potential consequences of the resource's failure, not simply on the ownership, commercial size or reputation of the institution operating it.

Therefore, an important banking computer resource may qualify as Critical Information Infrastructure even though the bank itself is not separately designated as a systemically important bank.

Likewise, a bank's systemic importance does not mean that every computer, application, branch system or digital asset belonging to that bank is automatically a protected system under Section 70.

2.3 Difference between critical infrastructure and protected systems

The critical legal proposition is:

A banking computer resource may satisfy the definition of Critical Information Infrastructure without automatically becoming a notified protected system under Section 70.

3. Constitutional foundation of critical banking infrastructure protection

Although the Constitution of India does not expressly use the expression critical banking infrastructure, several constitutional provisions support legislative and regulatory measures for safeguarding the banking system.

Article 246 read with the Seventh Schedule

Entry 45 of List I (Union List) concerns banking. Parliament therefore possesses legislative competence concerning banking matters.

Entry 46 concerns bills of exchange, cheques, promissory notes and other like instruments, while Entry 38 addresses the Reserve Bank of India.

These entries establish the constitutional foundation for central regulation of banking institutions and important banking-related systems.

Article 19(1)(g)

Article 19(1)(g) guarantees citizens the right to practise a profession or carry on an occupation, trade or business.

However, Article 19(6) permits reasonable restrictions in the interests of the general public.

Banking is a heavily regulated activity because it involves public funds, financial stability and economic interests.

Accordingly, cybersecurity and operational-resilience requirements imposed through valid laws and regulatory directions may constitute legitimate regulatory measures, subject to constitutional requirements.

Article 21

Article 21 protects life and personal liberty.

While Article 21 does not independently establish a general right to have every banking system designated as critical infrastructure, significant interruptions to essential financial services may have implications for individuals' rights and welfare.

Banking cybersecurity regulation must also respect informational privacy and the constitutional principles governing access to personal data.

Article 14

Article 14 guarantees equality before the law and equal protection of the laws.

Any governmental classification of particular systems or institutions for heightened statutory protection must comply with applicable constitutional principles and must not be arbitrary.

The fact that a bank is large or influential does not exempt the relevant governmental or regulatory action from judicial scrutiny.

4. Statutory framework for designating banking infrastructure as critical

The most important legislation is the Information Technology Act, 2000, supported by banking and payment-system legislation.

4.1 Section 70: Protected systems

Section 70 authorises the appropriate Government to declare, by notification in the Official Gazette, a computer resource that directly or indirectly affects the facility of Critical Information Infrastructure to be a protected system.

This is the principal statutory mechanism for conferring the special legal status of a protected system.

The consequences include restrictions on access to the notified system.

Section 70 also provides criminal penalties for securing access or attempting to secure access to a protected system in contravention of the provision.

The offence may attract imprisonment for a term extending to ten years and a fine.

Legal consequences for banks

Where relevant banking infrastructure has been validly notified as a protected system:

The notified system obtains a special statutory protection.

Access becomes subject to the authorisation framework under Section 70.

Unauthorised access or attempted access may attract Section 70's criminal provisions.

Applicable security practices and procedures for protected systems must be followed.

The concerned institution remains subject to other applicable banking, cybersecurity and data-protection obligations.

Important: A Reserve Bank of India circular, an internal bank policy or a general assertion that banking is an essential service is not, by itself, a substitute for the Official Gazette notification required for a Section 70 protected-system declaration.

4.2 Section 70A: National nodal agency

Section 70A empowers the Central Government to designate a national nodal agency in respect of Critical Information Infrastructure protection.

The National Critical Information Infrastructure Protection Centre (NCIIPC) performs this national role.

Its work includes coordination relating to critical information infrastructure protection, cybersecurity preparedness, threat information and risk reduction.

The NCIIPC framework includes the banking, financial services and insurance sector, reflecting the national importance of financial-sector digital infrastructure.

However, the identification of banking and financial services as a critical sector should not be confused with the formal statutory designation of every bank or every banking system as protected.

4.3 Section 70B: CERT-In

Section 70B establishes the legal framework for the Indian Computer Emergency Response Team (CERT-In), which performs specified national functions relating to cybersecurity incidents.

Banks and other covered entities may have incident-reporting, cooperation, recordkeeping and cybersecurity obligations under applicable CERT-In directions.

CERT-In and NCIIPC serve related but distinct functions.

NCIIPC focuses on Critical Information Infrastructure protection.

CERT-In performs broader national cybersecurity incident-response functions.

Both may be relevant to a serious cyber incident involving banking infrastructure.

4.4 Information Technology (Information Security Practices and Procedures for Protected System) Rules, 2018

These rules prescribe requirements concerning protected systems, including information security practices, organisational accountability and measures relating to such systems.

For banking infrastructure that is formally brought within the protected-system framework, these rules are particularly important.

A bank cannot assume that ordinary commercial cybersecurity standards alone satisfy every obligation applicable to a notified protected system.

4.5 NCIIPC Rules, 2013

The Information Technology (National Critical Information Infrastructure Protection Centre and Manner of Performing Functions and Duties) Rules, 2013, provide the institutional framework for the NCIIPC's functions.

These rules are relevant to matters such as identifying Critical Information Infrastructure, coordinating protection measures and providing relevant security guidance.

They support the national framework but do not eliminate the need to distinguish identification of CII from a specific Section 70 notification.

5. Reserve Bank of India's regulatory role

The Reserve Bank of India (RBI) is the principal regulator of banks in India.

Its authority is derived from legislation including the Reserve Bank of India Act, 1934, the Banking Regulation Act, 1949, and the Payment and Settlement Systems Act, 2007.

5.1 Banking Regulation Act, 1949

Section 35A empowers the RBI to issue directions to banking companies in specified circumstances, including public interest, banking policy, protection of depositors' interests and securing proper management.

Section 36 contains additional regulatory powers in specified circumstances.

These statutory powers are relevant to the imposition of requirements concerning cybersecurity, risk management, internal controls and banking-system resilience.

5.2 RBI cybersecurity framework

The RBI has issued cybersecurity and information-security requirements for banks, including its circular of June 2, 2016, concerning the Cyber Security Framework in Banks.

The framework addresses matters such as:

Board-approved cybersecurity policies.

Continuous surveillance and cyber-threat monitoring.

Protection of critical banking information assets.

Cyber-crisis management.

Incident reporting.

Security assessments and testing.

Operational preparedness and business continuity.

Applicability must be assessed by reference to the bank's category and the RBI directions in force.

The RBI's regulatory identification of important banking systems can support criticality assessments, but it is distinct from a Section 70 Gazette notification.

5.3 Payment and Settlement Systems Act, 2007

This legislation gives the RBI statutory authority concerning payment systems.

Payment infrastructure can be systemically significant because disruption may interfere with transactions across multiple banks and other financial institutions.

Systems associated with electronic fund transfers, clearing and settlement can therefore be relevant to Critical Information Infrastructure assessments.

This does not mean that every payment application or participant is automatically notified as a protected system.

6. Designation of banks as Domestic Systemically Important Banks (D-SIBs)

A particularly important concept is the RBI's identification of Domestic Systemically Important Banks, commonly referred to as D-SIBs.

A systemically important bank is one whose distress or failure could cause significant disruption to the wider financial system and the economy.

This is sometimes explained using the expression Too Big to Fail, although systemic importance depends on more than institutional size.

6.1 Criteria for systemic importance

The RBI's D-SIB framework considers factors including:

Size of the bank.

Interconnectedness with the financial system.

Substitutability or financial-institution infrastructure significance.

Complexity of operations.

The RBI uses a methodology for assessing systemic importance and imposes additional regulatory requirements, including additional Common Equity Tier 1 capital requirements, for designated institutions.

6.2 Examples of D-SIBs

The RBI's published D-SIB lists have identified:

State Bank of India

ICICI Bank

HDFC Bank

These are established examples from RBI classifications, not a representation that I have verified the latest October 2026 list.

6.3 Is a D-SIB automatically designated as Critical Information Infrastructure?

No.

A D-SIB designation addresses systemic financial risk and imposes additional prudential requirements.

A CII identification or protected-system notification concerns the security and resilience of computer resources whose disruption may cause the specified debilitating impact.

Thus, a bank can be systemically important without every one of its IT resources being designated as a protected system.

Equally, a computer resource operated by a bank that is not a D-SIB may still warrant CII protection because of the resource's function and consequences of failure.

7. Important Supreme Court case laws relating to banking infrastructure, banking regulation and national economic security

An important qualification is necessary before examining the judgments.

The following judgments establish principles concerning RBI regulatory powers, financial stability, proportionality, banking operations, economic regulation and privacy. They are not all direct decisions on the designation of a bank's computer systems as Critical Information Infrastructure under Sections 70 or 70A.

They are relevant legal authorities for analysing the validity and scope of protective measures.

Case 1: Reserve Bank of India v. Peerless General Finance and Investment Co. Ltd.

Supreme Court of India | (1987) 1 SCC 424

Facts

The dispute concerned regulatory control over schemes operated by a financial company involving the mobilisation of public savings.

The RBI exercised statutory regulatory powers, and issues arose regarding the interpretation and application of the regulatory framework.

Issues

The central questions included the interpretation of regulatory provisions governing financial activities and the extent to which regulators could act to protect depositors and the broader public interest.

Supreme Court's observations

The Supreme Court emphasised that statutory interpretation must take account of the text and its context, scheme and legislative purpose.

The judgment recognised the significance of regulatory oversight in financial activities involving public funds.

Principle established

Financial regulation should be interpreted within its statutory context and with regard to the legislative purpose of protecting the public and maintaining proper regulation.

Relevance to critical infrastructure designation

This judgment supports the proposition that protective banking regulation must be interpreted in light of its statutory objectives.

If a banking system performs functions essential to financial stability, requirements intended to preserve its security and continuity may serve an important public purpose.

Limitation: The case did not concern Section 70 or Section 70A of the IT Act.

Case 2: Peerless General Finance and Investment Co. Ltd. v. Reserve Bank of India

Supreme Court of India | (1992) 2 SCC 343

Facts

This litigation concerned RBI regulatory directions affecting the operations of a financial company.

The company challenged aspects of the regulatory framework and the restrictions imposed on its business.

Legal issue

Whether the RBI's regulatory measures were within its statutory authority and whether the courts should interfere with such economic regulation.

Judgment

The Supreme Court recognised the importance of the RBI's expertise and the public-interest considerations underlying financial regulation.

The decision is often cited for the principle that courts should exercise appropriate restraint when reviewing expert economic and financial regulatory determinations.

Legal principle

Courts ordinarily afford weight to expert financial regulators' decisions, provided those decisions remain within the law and constitutional limits.

Application to critical banking infrastructure

If an RBI direction requires a bank to implement heightened cybersecurity protection for critical operations, this judgment provides support for judicial recognition of the RBI's specialist regulatory expertise.

Nevertheless, regulatory expertise cannot replace a statutory power that the law assigns to another authority.

In particular, RBI expertise alone cannot convert a banking system into a protected system under Section 70 without the requisite notification.

Case 3: Reserve Bank of India v. Jayantilal N. Mistry

Supreme Court of India | (2016) 3 SCC 525

Facts

The case arose from applications seeking banking-related information from the RBI under the Right to Information Act, 2005.

Questions arose concerning the RBI's relationship with regulated banks and the disclosure of information obtained through its regulatory and supervisory functions.

Issues

Whether the RBI could withhold certain banking information on grounds including fiduciary relationships, confidentiality and claimed economic interests.

Judgment

The Supreme Court emphasised the RBI's responsibility to act in the public interest and rejected a general proposition that its supervisory relationship with banks justified withholding all such information.

The Court gave considerable importance to transparency and public accountability.

Legal principle

The RBI's regulatory authority exists to serve statutory and public-interest purposes, not merely to protect the commercial interests of banks.

Relevance to critical infrastructure designation

The judgment is important because a critical-infrastructure designation may create competing considerations:

National security and protection of sensitive banking systems.

Public accountability and transparency.

Depositor interests.

Disclosure of vulnerabilities and supervisory information.

A critical-infrastructure label does not itself establish an unrestricted exemption from transparency requirements.

Any claimed exemption must be justified under the applicable statutory framework.

Important qualification: This judgment is not authority that sensitive technical details of protected banking systems must always be publicly disclosed. The applicable information-disclosure exemptions and security laws must be considered separately.

Case 4: Internet and Mobile Association of India v. Reserve Bank of India

Supreme Court of India | (2020) 10 SCC 274

Facts

In April 2018, the RBI issued a circular restricting entities regulated by it from providing certain banking services to persons dealing in virtual currencies.

The restrictions affected businesses operating in the virtual-currency ecosystem.

The circular was challenged before the Supreme Court.

Legal issues

The Court considered:

The scope of the RBI's regulatory powers.

Whether risks to banking and payment systems fell within the RBI's regulatory jurisdiction.

Whether the impugned restrictions satisfied the applicable proportionality analysis.

Judgment

The Supreme Court recognised the breadth of the RBI's powers and its role in protecting the banking and payment systems.

However, the Court set aside the circular on proportionality grounds, having regard to the particular record and circumstances before it.

Legal principles

Two principles are especially significant:

A. RBI regulatory jurisdiction

The RBI possesses substantial authority to address threats affecting the functioning and stability of regulated banking and payment systems.

B. Proportionality

A regulatory measure must be legally justified and satisfy applicable constitutional standards; the importance of financial stability does not automatically validate every restriction.

Application to critical infrastructure designation

Suppose a regulator imposes substantial restrictions on activities connected with a banking system because of a perceived cybersecurity or systemic risk.

The regulator's authority and public-interest objectives would be relevant, but the measure could still be examined for legal validity and proportionality.

This judgment is therefore particularly useful in considering challenges to restrictive measures justified on critical-infrastructure grounds.

Important: The judgment does not hold that banking systems are automatically Critical Information Infrastructure under the IT Act.

Case 5: ICICI Bank Ltd. v. Official Liquidator of APS Star Industries Ltd.

Supreme Court of India | (2010) 10 SCC 1

Facts

The dispute concerned the transfer or assignment of debts by banks and the legal treatment of those transactions under banking law.

Legal issue

Whether the assignment of debts was a permissible banking activity within the applicable statutory framework.

Judgment

The Supreme Court examined the scope of banking business, banking regulation and permissible activities under the relevant legislation.

It recognised the significance of banking transactions and the regulatory context in which those transactions operate.

Relevance

The case illustrates that banking activities form part of a highly structured statutory and regulatory framework.

When assessing critical banking systems, it is necessary to identify the actual legally regulated function performed by a particular resource, rather than relying solely on the bank's institutional identity.

For example, a system used for settlement or interbank transfers may have a different systemic risk profile from an ordinary internal administrative application.

This is an analytical application of the judgment, not a direct holding on critical infrastructure.

Case 6: Swiss Ribbons Pvt. Ltd. v. Union of India

Supreme Court of India | (2019) 4 SCC 17

Facts

Several provisions of the Insolvency and Bankruptcy Code, 2016, were challenged on constitutional grounds.

The litigation involved questions concerning financial creditors, insolvency mechanisms, creditor classification and economic legislation.

Issues

Whether the statutory framework violated constitutional equality principles and whether its classifications and mechanisms were legally sustainable.

Judgment

The Supreme Court upheld major aspects of the Insolvency and Bankruptcy Code.

It recognised the economic and institutional objectives of the legislation and the importance of appropriate judicial restraint concerning economic policy choices.

Relevant legal principle

Legislative classifications addressing genuine economic and institutional differences may be constitutionally permissible where they satisfy the applicable legal requirements.

Application to critical infrastructure

This case provides a relevant constitutional analogy when considering why certain banking systems may be subjected to more stringent regulation than others.

For example, a nationally significant banking settlement platform could reasonably require stronger security and resilience measures than a noncritical internal application.

However, differences in regulatory treatment must remain connected to lawful statutory objectives and cannot be arbitrary.

The judgment does not itself establish criteria for CII designation.

Case 7: Justice K.S. Puttaswamy (Retd.) v. Union of India

Supreme Court of India | (2017) 10 SCC 1

Facts

A nine-judge Constitution Bench considered whether privacy is protected as a fundamental right under the Constitution.

Judgment

The Supreme Court unanimously recognised privacy as a constitutionally protected fundamental right.

Informational privacy forms an important component of privacy protection.

Relevance to banking infrastructure

Modern banking systems process highly sensitive information, including identity information, customer financial records, account information and transaction histories.

Critical-infrastructure protection may involve enhanced monitoring, threat detection, access controls and security-related information sharing.

These measures must operate within applicable legal requirements governing privacy, data protection and lawful processing.

Legal principle

The importance of national security or financial resilience does not remove the requirement to respect applicable constitutional rights.

A statutory critical-infrastructure framework should therefore be implemented consistently with lawful purposes, appropriate safeguards and proportionality requirements where they apply.

Case 8: Anuradha Bhasin v. Union of India

Supreme Court of India | (2020) 3 SCC 637

Facts

The case involved restrictions imposed on communications and internet access in Jammu and Kashmir.

Issues

The Court examined the constitutional implications of restrictions affecting internet-based communications and economic activity.

Judgment

The Supreme Court emphasised the importance of legality, necessity, proportionality and procedural safeguards in evaluating restrictions on internet access.

Relevance to critical banking infrastructure

Banks increasingly depend on digital networks.

A governmental direction intended to secure critical banking infrastructure might, in some circumstances, affect digital access or financial services.

Where such a measure restricts constitutional rights, the principles of legality and proportionality may be relevant.

The judgment does not prevent lawful emergency cybersecurity measures, but it reinforces that restrictions must be grounded in valid legal authority.

8. Comparative table of important judicial precedents

Status of these precedents: They are leading Supreme Court decisions relevant to the broader legal analysis. None of the cases listed should be represented as a Supreme Court ruling directly designating an Indian bank's IT infrastructure as a protected system under Section 70.

9. Procedure for designation of critical banking infrastructure

The procedure depends upon whether the matter concerns CII identification, regulatory assessment of criticality or formal protected-system notification.

The following diagram illustrates the broad framework. It is not a claim that the IT Act prescribes this exact sequence as a single statutory application procedure.

Identification of critical banking functions

Core banking, payment settlement, transaction processing and other essential digital operations

Assessment of consequences

Would disruption have a debilitating impact on the economy, national security, public health or safety?

Coordination with competent authorities

Bank, relevant regulators, NCIIPC and concerned governmental authorities, as applicable

Formal Section 70 notification, if made

Appropriate Government declares the specified computer resource a protected system through the Official Gazette

Implementation of applicable security obligations

Protected-system rules, authorised access, cybersecurity governance, incident response and continuing compliance

9.1 Which banking systems could qualify?

The assessment should be based on the actual functions and impact of the system.

These are illustrative candidates, not a verified list of systems formally notified under Section 70.

A bank seeking to establish whether a particular system has legally protected status should obtain the relevant notification and verify that the specified resource falls within its scope.

10. Legal consequences of designation

A. Heightened cybersecurity requirements

A bank operating protected infrastructure may be required to implement security measures beyond those applicable to ordinary information systems.

Such measures can involve access control, security governance, incident management, auditing and protective arrangements under applicable statutory rules.

B. Criminal-law protection

Section 70 provides specific penal consequences for access or attempted access to a protected system in contravention of the section.

Other provisions of the IT Act and applicable criminal legislation may also be relevant to cyber incidents, depending on the facts.

C. Greater regulatory scrutiny

Criticality may be relevant to heightened supervisory attention, operational-resilience requirements and risk-management expectations.

However, the exact obligations arise from applicable statutes, rules, directions and notifications, rather than from criticality as a purely descriptive label.

D. Business continuity and disaster recovery

Banks must consider continuity of essential financial services and recovery from severe operational disruption in accordance with applicable RBI requirements.

E. Potential legal challenges

Governmental designation decisions, enforcement actions and restrictive regulatory measures can be subject to judicial review on legally available grounds, including jurisdiction, statutory compliance, procedural requirements and constitutional validity.

Judicial review of a Section 70 notification must be analysed under that provision and the applicable constitutional principles rather than assuming that every general banking-law precedent directly governs the notification.

11. Can all banks in India be declared critical infrastructure?

The banking sector can be recognised as critical, but this does not mean every bank or every computer resource of every bank automatically obtains the same statutory designation.

Consider three hypothetical institutions.

Bank A — Large systemically important bank

Has extensive deposit, lending and payment operations. Its failure could pose systemic financial risks. It may qualify for D-SIB classification, but its individual systems still require separate legal analysis for CII and protected-system purposes.

Bank B — Smaller bank operating a shared payment platform

Although not systemically important at the institutional level, a platform it operates could potentially have widespread consequences for the payment ecosystem. The platform's criticality must be assessed on its merits.

Bank C — Small bank with ordinary internal systems

Its routine internal applications may not satisfy the statutory consequence threshold for CII. Nevertheless, applicable RBI cybersecurity obligations continue to apply.

The decisive consideration under Section 70A is the potential debilitating impact of the computer resource's disruption, not simply the legal identity of the bank.

12. Important legal questions and answers

Q1. Is every scheduled commercial bank automatically Critical Information Infrastructure?

No. Its individual computer resources must be considered against the relevant statutory definition. Sectoral importance alone does not establish protected-system notification.

Q2. Can the RBI itself declare a banking computer system to be a protected system under Section 70?

Section 70 confers the notification power on the appropriate Government. RBI regulatory directions cannot simply be treated as equivalent to a Section 70 notification.

Q3. Is a government-owned bank automatically a protected system?

No. Government ownership does not dispense with the statutory notification requirement.

Q4. Does D-SIB status establish that the bank is protected under the IT Act?

No. These are distinct legal frameworks.

Q5. Can a protected-system designation be challenged before a court?

A relevant governmental decision may be susceptible to judicial review on available legal and constitutional grounds. The merits depend on the statutory authority, notification, facts and grounds of challenge.

Q6. What is the strongest documentary proof of a protected-system declaration?

The applicable Official Gazette notification under Section 70, including the identity and scope of the notified computer resource.

13. Important legal proposition for court pleadings and legal opinions

The following proposition captures the interaction of the statutory and judicial principles:

Legal proposition

Banking infrastructure performs functions of substantial public and economic importance. Computer resources whose incapacitation or destruction would have a debilitating impact on national security, the economy, public health or safety may fall within the statutory definition of Critical Information Infrastructure under Section 70A of the Information Technology Act, 2000.

However, a banking institution's systemic importance, the RBI's supervisory jurisdiction and the designation of a particular computer resource as a protected system under Section 70 are legally distinct matters.

A claim that a specified banking computer resource has protected-system status must be supported by the applicable statutory notification. Regulatory measures adopted to secure the banking system must remain within the powers conferred by law and comply with applicable constitutional and administrative-law requirements.

This formulation can serve as a starting point for a legal memorandum or pleading, but must be adapted to the particular facts and supporting documents.

14. Primary legal authorities for research

The principal statutory and judicial materials are:

Official research sources include the India Code for central legislation, e-Gazette of India for notifications, Reserve Bank of India for regulatory directions and Supreme Court of India for judgments.

These are primary-source research starting points. I have not conducted a live verification of all Gazette notifications, subsequent regulatory amendments or the current judicial treatment of each precedent as of October 20, 2026.

15. Conclusion

The critical infrastructure designation of banks in India must be understood through three interconnected but distinct legal frameworks:

1. Critical Information Infrastructure under the IT Act: Concerned with computer resources whose incapacitation or destruction would have a debilitating impact on national security, the economy, public health or safety.

2. Protected systems under Section 70: Concerned with formally notified computer resources attracting a specific statutory security and penal framework.

3. Systemically important banks and RBI regulation: Concerned with institutions whose distress or failure could threaten broader financial stability, together with regulatory measures for cybersecurity and operational resilience.

The Supreme Court decisions discussed above support the legitimacy of appropriate financial regulation and recognition of expert regulatory judgment, while confirming that financial and security-related measures remain subject to statutory authority and applicable constitutional constraints.

The most important legal conclusion is that a bank's economic significance cannot, by itself, be treated as conclusive evidence that its IT systems have been formally notified as protected systems under Section 70.

For litigation involving a particular bank, the decisive evidence would include the relevant Gazette notification, the specific computer resources covered, applicable RBI directions and the precise statutory obligation or right in dispute.

A further distinction may matter depending on the purpose of your research: designation of banks as Critical Information Infrastructure under the IT Act is different from treating banking as an essential service under labour or public-service legislation. The latter involves a separate legal framework and different case law.