SEBI Built a Task Force for AI-Driven Attacks: Reopening the Crime and Cyber File at a Listed Issuer

On 6 September 2026, News On AIR reported that SEBI had set up a dedicated task force to tackle AI-driven cyber threats. A task force is not a circular. It does not by itself change a single obligation on a listed issuer or a registered intermediary. What it does signal is the sequence the Indian securities regulator normally follows: a body is constituted, it consults, and the output arrives later as consultation papers, framework amendments, or supervisory expectations that show up in inspection questionnaires long before they show up in a gazette.

That sequence is exactly why the placement conversation should start now rather than at the next renewal. SEBI already regulates the cyber posture of its regulated entities through its cybersecurity and cyber resilience framework, and it already regulates what a listed issuer must tell the market through the Listing Obligations and Disclosure Requirements Regulations, 2015. An AI-driven attack does not sit neatly inside either. A cloned voice instructing a treasury payment is a fraud loss. The same event at a listed issuer is also a potential material event, a potential internal financial controls finding for the auditor, and a potential board governance question. Insurance sits across all three, and the policies that respond were mostly written for a world where the attacker had to forge a document rather than a face.

The practical question for a risk manager at a listed company is narrow and answerable: if the AI-enabled version of this attack succeeds tomorrow, which policy pays, which one funds the response, and what does the company have to say to the exchanges while the coverage position is still unresolved.

The task force was not constituted in a vacuum. Business Standard reported on 26 August 2026 that India tops the Asia-Pacific region in mobile threat detections, and that the attacks have turned more targeted. Volume leadership is uncomfortable on its own. The shift from broad campaigns to targeted ones matters more for a listed issuer, because targeting implies reconnaissance: the attacker knows who signs, who approves, when the quarter closes, and which subsidiary has the weakest verification step.

The Indian Express reported on 31 August 2026 that regulators were intensifying oversight as AI presents growing dangers to critical financial infrastructure. Read alongside reported increases in the value of fraud at Indian banks and NBFCs, the direction is consistent. Supervisors are treating AI-enabled deception as a systemic financial exposure rather than an enterprise IT hygiene problem.

Three features of the mobile-first, targeted pattern change how the exposure should be underwritten:

• Approval increasingly happens on a phone. A payment release confirmed over a messaging app, a video call joined from a personal handset, or an OTP approved on a compromised device sits outside most corporate endpoint controls.
• Synthetic audio and video lower the effort required to manufacture authority. The attacker no longer needs a compromised mailbox to look credible, which weakens the assumption that every fraud begins with a network intrusion.
• Targeting compresses the decision window. A well-researched instruction arrives at the exact moment when urgency is plausible, which is when documented callback procedures are most likely to be skipped.

The coverage boundary in AI-enabled impersonation losses is well established and still frequently misread. A commercial crime policy is the natural home for a funds-transfer loss, but older Indian wordings respond to employee dishonesty, forgery, and direct fraudulent entry into the insured's banking systems. A payment that an employee authorised voluntarily, on the strength of a convincing but fake instruction, is often outside that grant unless a social engineering fraud or fraudulent impersonation extension has been bought.

Those extensions carry their own conditions, and the conditions are where AI-enabled attacks bite. Typical requirements include that the fraudulent instruction purport to come from a named category of person, that the insured perform a documented out-of-band callback to a pre-registered number, and that the loss be discovered and notified within a defined window. Sub-limits are frequently a fraction of the main crime limit. A listed issuer with a crime programme running into tens of crores may find the social engineering response capped far below the size of a single treasury payment.

The standalone cyber insurance policy usually answers a different question. It funds forensics, legal advice, breach counsel, restoration, and in negotiated forms business interruption, where the event involved mailbox compromise, credential theft, privileged access abuse, or cloud platform intrusion. Reimbursement of the transferred funds themselves normally requires a dedicated funds-transfer fraud or cybercrime insuring clause. Our earlier analysis of deepfake payment fraud and the crime versus cyber boundary sets out the wording traps in detail.

The reopening exercise is therefore not a limits exercise. It is a policy wording exercise. The three questions to put in writing to the underwriter are whether the social engineering extension responds when the impersonation was synthetic rather than written, whether the callback condition can be satisfied when the approval channel is a mobile messaging app, and whether a vendor bank-detail change induced by a synthetic instruction is covered or excluded.

An unlisted company that loses money to a cloned-voice instruction has a claim to file and a control to fix. A listed issuer has both of those plus a market to inform, and the second obligation runs on a faster clock than the first.

Under Regulation 30 of the LODR regulations, a listed entity must assess whether an event is material and, where it is, disclose it to the stock exchanges within the prescribed timeline. A fraud loss, a subsequent insurance claim, and a later denial or partial settlement are each capable of being separate disclosable events depending on quantum and the entity's materiality policy. The interaction with insurance is awkward by design: the company may need to say something to the market at a point when the insurer has done nothing more than acknowledge notification, and quantum is a range rather than a number. Our detailed treatment of when insurance claims and denials become disclosable material events works through the thresholds.

AI-driven attacks sharpen two specific problems inside that framework. First, attribution takes longer. Establishing that an instruction was synthetic rather than genuine can require forensic audio analysis and device imaging, which delays the internal certainty that a materiality assessment needs. Second, the recoverable amount is unusually uncertain early on, because whether the crime extension responds is a wording argument rather than a factual one, and it can stay open for months.

A regulator constituting a task force on a named threat creates a documented expectation. Once the threat is publicly identified by SEBI, a board that has not asked about it has a harder time arguing that the risk was not reasonably foreseeable. That is the mechanism by which supervisory attention converts into directors and officers liability exposure.

The realistic claim shapes for an Indian listed issuer are three. A regulatory investigation into whether disclosure was timely and accurate, with defence costs arising well before any finding. A shareholder action alleging that statements about the control environment were misleading, typically where the annual report described payment controls that the incident showed to be ineffective. A derivative-style challenge to the adequacy of board oversight of an identified risk.

What the board should do is documentable and cheap. Put AI-enabled impersonation on the risk management committee agenda by name rather than folding it into a general cyber update. Record the specific question of whether the crime and cyber programme responds to a synthetic-instruction loss, and record the answer the broker gives. Require that any change to a payment authority matrix is reported to the committee. Minutes that show the question was asked, and the coverage gap accepted with reasons, are a materially better defence position than minutes that show nothing was discussed.

The D&O placement itself deserves a look at the same time. Investigation costs cover for regulatory proceedings, the definition of a securities claim, and the availability of Side A capacity all matter more once the regulator has signalled that it is building supervisory capability in this area.

A reopening is not a full remarketing. It is a targeted set of questions put to the incumbent underwriters, in writing, with the answers filed. The value lies in having the position documented before an incident rather than discovering it during a claim.

Crime programme

1. Does the social engineering extension respond where the impersonation was synthetic audio or video rather than a written instruction, and is that confirmed in the wording or only in correspondence?
2. What is the sub-limit, and how does it compare with the single largest payment the treasury can release in one instruction?
3. What exactly does the out-of-band verification condition require, and does an approval given over a corporate messaging platform satisfy it or breach it?
4. Is a fraudulently induced change to vendor master bank details covered, excluded, or subject to a separate lower sub-limit?
5. What is the discovery and notification window, and does it run from the payment or from discovery?

Cyber programme

1. Is there a funds-transfer fraud or cybercrime insuring clause, and does it require unauthorised system entry as a precondition?
2. Does incident response cover trigger where the only compromise was a personal mobile device used for approvals?
3. Are forensic costs for establishing that media was synthetic recoverable as investigation costs?
4. How does the cyber policy's other insurance clause interact with the crime policy, and which responds first where both could apply?

The answers usually reveal one of two positions. Either the programme has a real gap, in which case the choice is to buy the extension, raise the sub-limit, or accept the exposure with a board minute recording it. Or the programme responds but subject to conditions that current payment practice does not meet, in which case the fix is operational and free.

Insurance conditions and payment controls are the same document read by two different departments. Where they diverge, the insurer wins the argument. The controls worth aligning before the next renewal are the ones that appear as conditions precedent in crime extensions.

Verification must be out-of-band and unalterable. Callbacks go to a number held in a locked vendor master that cannot be edited inside the transaction workflow, by a person who is not the requester. Beneficiary changes get a mandatory cooling period and dual authorisation. First-time payees above a threshold get a delayed release window. None of this stops an attack, but all of it preserves the claim.

Authority signals must stop being audio and video. Treasury staff need explicit written authority to refuse an instruction delivered by voice or video call regardless of who appears to be giving it, and senior management needs to state publicly inside the company that no one will be penalised for that refusal. The training point is short: realism is no longer evidence.

Mobile approval paths need to be mapped. Given the targeting pattern in the Indian threat data, the device on which the final approval happens is now part of the control environment. Where approvals happen on personal handsets, either bring those devices into managed control or move the approval step back onto a managed channel.

Finally, run the incident once on paper. A tabletop exercise that starts with a cloned-voice payment release and forces the group through forensic preservation, bank recall, insurer notification under both policies, materiality assessment, and a draft exchange intimation will surface the sequencing problems while they are still cheap. The most common finding is that nobody had decided who signs the disclosure while the coverage position is unknown.