Where the rules sit
- Activity regulations. The Capital Market Intermediaries Regulations, 2025 require adequate internal procedures and controls 'including any activities which have been outsourced' (regulation 22(2)), and the Code of Conduct in Schedule II requires an internal policy for outsourcing activities from outside the IFSC, complied with at all times (clause 18). The Fund Management Regulations, 2025 contain the same internal-controls wording (regulation 123(2)). Check the regulations and circulars for your own activity before outsourcing anything.
- Cyber security guidelines. IFSCA's guidelines of 10 March 2025 require a collaborative security approach with vendors, a six-monthly review of critical service providers, escalation channels for vendor non-compliance, and state that the ultimate responsibility for third-party cyber risk rests with the regulated entity.
- Data protection. From 13 May 2027 a data fiduciary's contract with each data processor must provide for reasonable security safeguards (Rule 6(1)(f)), and the fiduciary must ensure that processing logs are kept for at least one year (Rule 8(3)).
- CERT-In. Logs of all ICT systems must be kept for a rolling 180 days within Indian jurisdiction.
Core functions stay in the IFSC
IFSCA's enforcement orders show where the line is drawn in practice. In an order published in October 2026, a stockbroker had let its parent run algorithm strategy, trade execution and trade monitoring, with a trader working outside GIFT City through remote-access software, and had no separate outsourcing policy. IFSCA imposed a penalty and directed compliance with the outsourcing and manpower requirements of the 2025 Regulations. Other orders have turned on key personnel based outside the IFSC and on trades placed from IP addresses outside GIFT IFSC. See IFSCA enforcement orders and substance.
Back-office technology, hosting and administration can usually be bought in, including from the group. Decision-making, execution and compliance functions that the registration depends on should be performed by the entity's own people in GIFT City. Group arrangements should be documented as such. See group services agreements.
Points of practice for each arrangement
- Due diligence before signing. Assess the provider's security programme and its fit with your own framework. The MII guidelines (20 April 2026) make this explicit and are a useful benchmark for other entities.
- Audit and information rights. The contract should give the entity, its auditors and IFSCA access to information, records and premises needed to show compliance. The algorithmic trading guidelines of 16 October 2026 require exactly this where third parties design, test or operate trading algorithms.
- Sub-contracting. Require written consent before critical functions are sub-contracted. MIIs must include this prohibition in their contracts.
- Incident co-operation. Oblige the provider to notify incidents quickly enough for the entity to meet IFSCA's six-hour reporting window, and to preserve logs and forensic data.
- Concentration. Identify reliance on a single provider for several critical services, and the controls that address it.
- Exit. Agree a tested exit plan: data return in usable form, transition assistance and deletion certificates.
Cloud services
The MII guidelines require a cloud security policy covering data, application, compute, network, identity and physical layers, and personnel who understand each cloud platform in use. They describe the shared responsibility model: the provider secures the physical data centre and infrastructure, and the entity sets and operates the security controls. The frontier-AI advisory of 4 June 2026 adds that where source code, configurations, logs or regulated data are sent to an external AI model, the use must be authorised, sensitive data must not reach unapproved services, and the model provider's data-handling and retention terms must be adequate.
Data location
We have not found a general IFSCA rule requiring all data of IFSC entities to be stored in India. Location duties arise from specific sources:
- CERT-In logs must be maintained within Indian jurisdiction.
- Under the DPDP framework, the Central Government may restrict transfers of personal data to notified countries (section 16(1) of the Act), and may require a significant data fiduciary to keep specified personal data in India (Rule 13(4)). Section 16(2) preserves any sectoral law that imposes stricter transfer restrictions.
- Records must be producible to IFSCA on inspection wherever they are hosted. IFSCA's inspection powers extend to books, records and systems.
Whatever the hosting location, map where each category of data sits, who can reach it, and how quickly it can be produced to IFSCA, CERT-In or the Data Protection Board.