RBI’s ₹169-Crore Data Centre: What It Means for Banking Cybersecurity, Digital Payments and Operational Resilience

On 25 October 2026, Prime Minister Narendra Modi inaugurated the Reserve Bank of India’s (RBI) new Data Centre and Cybersecurity Training Institute at Jatni, near Bhubaneswar, Odisha.

Developed at a reported cost of ₹169 crore, the facility is designed to strengthen the security, reliability and operational resilience of India’s digital financial infrastructure.

However, the significance of this development extends beyond establishing another data centre. The RBI has prioritised geographical diversification, sovereign control over critical computing infrastructure, fault-tolerant technology and specialised cybersecurity training.

For banks, NBFCs and other financial institutions, the initiative highlights an increasingly important reality: financial stability depends not only on capital adequacy and liquidity management, but also on the resilience of the technology systems supporting financial transactions.

RBI’s New Odisha Data Centre: Key Features at a Glance

Particulars	Details
Location	Info Valley-II, Jatni, near Bhubaneswar, Odisha
Inauguration	25 October 2026
Reported project cost	₹169 crore
Campus area	18.55 acres
Data centre standard	Uptime Institute Tier IV
Infrastructure	Four independent data centre units within the new complex
Key systems	RTGS, NEFT and other RBI applications, including e-Kuber
Strategic objective	Digital sovereignty, geographical diversification and operational resilience
Training institute	Cybersecurity, AI, quantum technology, big data analytics and blockchain

The initiative combines two critical aspects of banking resilience: secure technology infrastructure and a skilled workforce capable of managing emerging risks.

1. Why Did RBI Choose Bhubaneswar, Odisha, for Its New Data Centre?

One of the primary reasons for selecting Bhubaneswar was to reduce the geographical concentration of the RBI’s critical technology infrastructure.

According to RBI Governor Sanjay Malhotra, the central bank’s three existing data centres are located in Maharashtra. The Odisha facility provides geographical separation and is situated in a different seismic zone.

How geographical diversification reduces banking operational risk

Geographical concentration can create common-cause risks when multiple critical facilities are exposed to the same regional event.

These risks may include:

Natural disasters: Earthquakes, flooding or severe weather affecting regional infrastructure.
Power and telecommunications failures: Disruptions involving common electricity or network providers.
Physical security incidents: Events that prevent access to critical facilities.
Concentration risk: Multiple essential banking applications depending on infrastructure located within a limited geographical area.

Locating facilities in different regions helps reduce exposure to a single regional incident. However, geographical separation must be supported by independent connectivity, sufficient processing capacity and tested recovery arrangements.

DBS Bank and Citibank Data Centre Outage, Singapore, 2023

On 14 October 2023, DBS Bank and Citibank experienced major disruptions to their digital banking and payment services in Singapore.

What happened?

A technical issue involving the cooling system at an Equinix data centre caused temperatures to rise beyond the optimal operating range, affecting systems used by both banks.

According to information presented to Singapore’s Parliament:

Approximately 2.5 million payment and ATM transactions could not be completed during the disruption.
Up to 810,000 attempts to access the banks’ digital banking platforms failed.
Although both banks activated disaster recovery procedures, technical issues complicated recovery at their backup data centres.

DBS encountered a network misconfiguration, while Citibank experienced connectivity issues affecting recovery.

The incident demonstrated how a problem originating within shared third-party infrastructure could disrupt multiple financial institutions.

2. What Is Tier IV Data Centre Certification, and Why Does It Matter for Banking Resilience?

The RBI’s new Odisha data centre has received Tier IV accreditation from the Uptime Institute, the highest level within its data centre tier classification system.

Tier IV infrastructure is designed for fault tolerance, meaning that an individual equipment failure or interruption to a distribution path should not disrupt operations.

Understanding data centre resilience standards

Standard	Main characteristic
Tier I	Basic infrastructure capacity
Tier II	Redundant capacity components
Tier III	Concurrently maintainable infrastructure
Tier IV	Fault-tolerant infrastructure

For critical financial services, Tier IV design is particularly relevant because interruptions affecting computing infrastructure may disrupt payment processing, customer access, regulatory operations and financial settlements.

However, Tier IV certification does not guarantee that all banking applications will remain continuously available.

Even highly resilient data centres remain exposed to:

Cyberattacks and ransomware.
Application or software failures.
Incorrect system configurations.
Data corruption.
Human error during technology changes.
Failures involving external systems and service providers.

The distinction is important: infrastructure resilience reduces exposure to certain types of failures, while operational resilience requires the entire banking service to remain within acceptable disruption limits.

This includes applications, networks, data, personnel, outsourced services and recovery procedures.

3. How Will RBI’s Odisha Data Centre Protect RTGS, NEFT, UPI and e-Kuber?

The RBI’s new facility will support mission-critical payment and settlement systems that form an essential part of India’s financial infrastructure.

Critical banking and payment systems supported by RBI infrastructure

Real Time Gross Settlement (RTGS)

RTGS enables high-value fund transfers to be settled individually in real time. The availability of this system is essential for banks and institutions managing time-sensitive financial obligations.

National Electronic Funds Transfer (NEFT)

NEFT facilitates electronic fund transfers between participating financial institutions. Reliable processing is important for individuals, businesses and banks using the system for regular payments.

Unified Payments Interface (UPI) settlement

UPI is operated by the National Payments Corporation of India (NPCI). However, the final settlement of UPI transactions involves RBI-operated settlement infrastructure.

The new data centre will strengthen the wider RBI computing environment supporting these functions.

e-Kuber

The RBI’s e-Kuber platform supports central banking operations involving the Central Government, state governments and banks.

Why payment-system resilience matters for financial stability

An extended disruption affecting critical payment infrastructure can have consequences beyond temporary inconvenience to individual customers.

Potential implications include:

Delays in interbank fund transfers and settlement.
Difficulties in managing intraday liquidity.
Interruptions to government and business payments.
Operational backlogs and reconciliation challenges.
Increased customer complaints and reputational risk.

For banks, the ability to process and settle transactions reliably is closely connected to liquidity management, operational risk and confidence in financial services.

4. Why Is RBI Prioritising Sovereign Data Centres Instead of Third-Party Cloud Infrastructure?

A notable feature of the RBI’s new data centre strategy is the emphasis on technological sovereignty.

RBI Governor Sanjay Malhotra stated that the central bank operates its own critical data centre infrastructure rather than depending on third-party cloud service providers.

This approach provides the RBI with greater direct control over the infrastructure supporting its most critical applications.

What does data sovereignty mean for banks?

Data sovereignty concerns the legal jurisdiction, ownership, control and governance arrangements under which data is stored, processed and accessed.

For financial institutions, important considerations include:

Data location and jurisdiction: Where sensitive financial information is processed and stored.
Access control: Who can access critical systems and customer information.
Vendor dependency: The extent to which operations depend on external technology providers.
Operational independence: Whether essential services can continue following the failure of an external provider.
Audit and regulatory access: Whether the institution can demonstrate effective control and provide required supervisory access.

Importantly, the RBI’s decision to maintain sovereign infrastructure for its own critical operations does not mean that every bank must avoid third-party cloud services.

Cloud infrastructure and outsourcing can deliver considerable operational benefits when supported by appropriate security, contractual, governance and business continuity arrangements.

The underlying question is whether financial institutions retain sufficient oversight and control over their critical technology dependencies.

5. Why Has RBI Established a Cybersecurity Training Institute in Bhubaneswar?

Alongside its data centre, the RBI has established a dedicated Cybersecurity Training Institute to strengthen professional capabilities across the financial sector.

Approximately two-thirds of the 18.55-acre campus has been allocated to the training institute, according to the RBI Governor.

The institute will serve RBI employees as well as personnel from commercial banks and other financial-sector organisations.

Its intended areas of learning and research include cybersecurity, enterprise computing, artificial intelligence, quantum technology, big data analytics and blockchain.

Why cybersecurity training is becoming essential for banking professionals

Technology risks have expanded beyond the responsibilities of traditional IT departments.

For example, a cyber incident affecting payment systems may require coordinated decisions by:

CISOs and cybersecurity teams: To investigate, contain and remediate security threats.
IT risk managers: To assess technology vulnerabilities and the effectiveness of controls.
Operational risk managers: To evaluate business disruption, financial exposure and risk appetite.
Business continuity teams: To activate and validate recovery arrangements.
Internal auditors: To independently assess control design and operating effectiveness.
Senior management and Board committees: To oversee material exposures, escalation and remediation.

The growing adoption of AI further increases the need for specialised competencies in model oversight, data security, access governance and emerging technology risk assessment.

RMAI’s Commitment to Strengthening IT Risk Management and Technology Governance

The Risk Management Association of India (RMAI) has been actively promoting professional education, risk awareness and capacity building across the banking, financial services and insurance sectors.

Recognising the growing importance of cybersecurity, technology governance and emerging risks in the financial sector, the Risk Management Association of India (RMAI) has been actively strengthening professional capabilities through specialised training and certification programmes.
Through its training arm, Smart Online Course, RMAI offers programmes covering:
– IT Risk & Technology Governance in Financial Institutions,
– Cybersecurity & Technology Risk Management,
– Cyber Risk Management,
– Third-Party & Vendor Risk Management,
– AI Model Risk Management.

Fill the Nomination Form Here.

These programmes are designed for banking and financial-sector professionals, including CISOs, IT risk managers, compliance officers, internal auditors and senior management, with an emphasis on practical frameworks, regulatory expectations, real-world case studies and implementation-oriented learning. By integrating cybersecurity, operational resilience, AI governance and technology risk management into its professional development initiatives, RMAI continues to support financial institutions in building the expertise required to strengthen internal controls, manage emerging digital threats and improve institutional resilience.

What Should Banks and NBFCs Review in Their Cybersecurity and IT Risk Frameworks?

The RBI’s initiative provides a useful opportunity for banks and financial institutions to review their own technology risk and operational resilience arrangements.

A practical assessment should consider six priority areas.

1. Critical systems and dependency mapping

Identify applications supporting essential banking and payment services.
Map internal systems, outsourced infrastructure and critical vendor dependencies.
Identify shared infrastructure and potential single points of failure.

2. Data centre and disaster recovery resilience

Assess geographical separation between primary and recovery facilities.
Validate recovery capacity and network independence.
Test disaster recovery arrangements against realistic failure scenarios.
Evaluate actual recovery performance against established RTOs and RPOs.

3. Cybersecurity controls

Review privileged access management and multi-factor authentication.
Assess network segmentation and protection of critical applications.
Validate incident detection, response and containment arrangements.
Test backup integrity and the ability to recover from ransomware or data corruption.

4. Third-party technology risk management

Identify material outsourced technology services.
Evaluate service-provider concentration and subcontracting dependencies.
Review contractual obligations, incident notification arrangements and exit strategies.
Assess whether vendors’ recovery capabilities meet institutional requirements.

5. IT governance and Board oversight

Ensure clear ownership of technology risks.
Review material risk indicators, incidents and unresolved control weaknesses.
Establish escalation responsibilities between technology, risk, compliance and business teams.
Monitor the implementation of remediation measures.

6. Training and professional capability development

Identify competency gaps across cybersecurity, IT risk and operational resilience functions.
Provide role-specific training for technology and non-technology professionals.
Conduct cyber incident simulations and coordinated recovery exercises.
Evaluate learning outcomes through practical assessments rather than attendance alone.

These priorities should be adapted to the institution’s size, complexity, critical services and applicable regulatory requirements.

Frequently Asked Questions: RBI Odisha Data Centre and Cybersecurity Training Institute

Why did RBI establish a new data centre in Odisha?

The RBI established its new data centre near Bhubaneswar to strengthen critical computing capacity, diversify infrastructure geographically and improve the operational resilience of India’s financial systems. Its location provides separation from the central bank’s existing data centres in Maharashtra.

What is the significance of the RBI’s Tier IV data centre?

Tier IV is the highest data centre classification under the Uptime Institute’s tier framework. It indicates fault-tolerant infrastructure designed to withstand individual equipment failures or distribution-path interruptions without affecting operations. It does not eliminate all cybersecurity or application-level risks.

Which banking payment systems will the new RBI data centre support?

The facility will support mission-critical RBI systems, including RTGS and NEFT, alongside other central banking applications. The wider RBI infrastructure also supports e-Kuber and the final settlement of UPI transactions, while NPCI operates the UPI platform.

Does the RBI require all banks to use sovereign data centres instead of cloud providers?

No. The RBI’s decision to operate its own critical data centre infrastructure does not establish a general prohibition on cloud outsourcing by banks. Regulated institutions must assess applicable RBI requirements concerning IT outsourcing, cybersecurity, data protection, third-party oversight and business continuity.

What is the objective of the RBI Cybersecurity Training Institute?

The institute is intended to develop specialised capabilities in cybersecurity, enterprise computing and emerging technologies among RBI personnel and professionals from banks and other financial-sector organisations. Its areas of focus include AI, quantum technology, big data analytics and blockchain.

What is the difference between cybersecurity and operational resilience in banking?

Cybersecurity focuses on protecting information systems and data from unauthorised access, attacks and related threats. Operational resilience encompasses the broader ability to prevent, withstand, respond to and recover from disruptions affecting critical banking services, including those caused by cyber incidents, technology failures or third-party outages.

References

RMA INDIA

See Full Bio