Guide · PR and communications · Banks, insurers, fintechs

Crisis communi­cations for banks, insurers and fintechs: the first 72 hours

An outage, a fraud wave, a breach, a regulator’s order or a viral post. What to say in the first hour, the first day and by hour 72, and who says it.

See the 72-hour plan →Score your readiness

By Yamm LabsUpdated 13 October 202613 min read

Short answer

Crisis communications for a bank, insurer or fintech is the plan for what the firm says, to whom and in what order when something breaks. In the first hour, confirm facts, start the reporting clocks and post a holding line. Within a day, brief staff and give customers guidance. By hour 72, publish a full account and the fix.

Illustrated young Indian woman in an orange bomber jacket and sunglasses speaks into an orange megaphone from the top of a stone bank column, a clear beam of light cutting through a swirl of blank speech bubbles, hearts and alerts, with chip cards, rupee coins, a vault door and a rising chart on a cobalt collage

01 · The definition

What is crisis communications for a bank, insurer or fintech?

On a salary-credit morning the app stops loading. Within minutes complaints arrive on social media, branch phones ring and a reporter asks whether customer money is safe. Nobody at the bank has said anything yet, and that silence is already being read as an answer.

Crisis communications for banks, insurers and fintechs is the planned, pre-approved way a regulated firm tells customers, regulators, investors, staff and the press what happened, what it means for them and what happens next, while the facts are still moving.

Three things make the financial-services version harder:

  • The reader’s money is at stake. A customer locked out of savings, a claim or a loan reads every hour of silence as risk.
  • Several clocks run at once. Cyber incidents, data breaches and market-moving events carry reporting duties to regulators and exchanges, some measured in hours.
  • Every word becomes evidence. A first-hour post can be quoted back by a regulator, a court or a journalist months later.

The firms that come through well rarely have the best words. They decided in advance who would speak, who would approve and what had to be filed first.

This guide anchors our PR and communications desk. Read every post on the PR and communications desk.

02 · The scenarios

Which crises does a financial brand need a plan for?

Five kinds cover most of what a bank, insurer, fund house, lender or fintech will face. Each has a different first audience and a different trap.

Crisis First signal Who hears first The trap
Outage: app, UPI (Unified Payments Interface), card or claims system down Customer posts arrive before the internal alert Customers on every channel, the service desk, and the regulator if reportable Calling it a “minor glitch” before you know the scope
Fraud: phishing, fake apps, account takeover Customers report debits they did not make Affected customers, with how and where to report Sounding as if you blame the customer
Data breach or leak A security alert, or data offered for sale India’s cyber agency and sector regulators; affected people as the law requires Saying “no data was compromised” before forensics finish
Regulatory action: an order, penalty or restriction The regulator’s order or press release The exchange if listed, affected customers, staff and distributors Arguing with the regulator in public
Social-media storm: a viral complaint or solvency rumour A post’s reach climbing fast The person at the centre, privately; then the public Replying in anger, or deleting posts

Real crises mix types: a breach becomes a fraud wave when stolen details feed phishing calls.

03 · The rulebook

What do Indian rules require in the first hours?

The rules decide your first audience. For most cyber and data incidents a regulator hears before the press, and a listed company tells the stock exchange before the newsroom. CERT-In is the Indian Computer Emergency Response Team; IRDAI, the RBI and SEBI are India’s insurance, banking and securities regulators. We opened each primary text on 13 October 2026.

Rule Who it covers The clock For communications
CERT-In directions, 28 April 2022 Service providers, intermediaries, data centres, body corporates, government bodies Report listed incidents within 6 hours of noticing them. The list includes data breaches, phishing, fake mobile apps and unauthorised access to social media accounts. A hijacked brand account is itself reportable.
IRDAI circular, 13 June 2023 Entities IRDAI regulates CERT-In within 6 hours, copied to IRDAI; details to IRDAI within 24 hours, then updates within 24 hours of new forensic findings The public line never runs ahead of the latest filing.
RBI IT governance directions, 7 November 2023 Commercial banks, larger non-banking finance companies, credit information companies Notify CERT-In and RBI “as per regulatory requirements”; keep plans for reporting incidents to the board, senior management and customers Customer communication belongs in the incident plan, written in advance.
SEBI listing regulations, Regulation 30 Listed entities Disclose material events to the exchanges first: 30 minutes after a board decision, 12 hours if the event arises inside the company, 24 hours if outside. The largest listed entities must also confirm, deny or clarify media rumours within 24 hours of a material price move. Exchange filing before, or with, the press release. A trending rumour can become a filing duty.
Digital Personal Data Protection (DPDP) Act 2023 and Rules 2025 Organisations processing digital personal data Rules notified 14 November 2025, phased over eighteen months. Once applicable, affected people must be told without delay, in plain language: what happened, the likely impact, the steps taken and a contact. The breach notice is a legal document. Test it on someone outside the team.
RBI customer liability circular, 6 July 2017 Banks, for unauthorised electronic transactions Zero liability for a third-party breach reported within three working days; the bank credits the amount within 10 working days of the report. RBI has since moved these rules into its 2025 Directions and revised them: for commercial banks, the reporting window becomes five calendar days for transactions from 1 January 2027 In a fraud wave, “report it now, here” is the most useful sentence you can publish.

Listed entities also report cyber incidents and data loss with their quarterly governance report. Abroad, the UK’s Information Commissioner’s Office asks for breach reports, where feasible, within 72 hours, and the US Securities and Exchange Commission makes a material cyber incident filing generally due four business days after the company decides it is material. Gulf entities follow their own regulators, so map each licence. For the advertising side, see our BFSI marketing compliance FAQ.

This is general guidance, not legal advice; your compliance team decides. Confirm the current text of each rule before you rely on it.

04 · The framework

What should happen in the first hour, the first day and by hour 72?

We call our method the Three Clocks Plan. Every crisis at a regulated financial firm runs on a regulator clock, a market clock and a public clock at once; the plan fixes what each needs at three checkpoints. Hour 72 is a planning checkpoint, not an Indian legal deadline.

Clock First hour First day By hour 72 Owner
Regulator Classify the incident; confirm which reports are due File reports and copies; log every version Update filings with forensic findings; agree what can be said Chief information security officer or chief risk officer, with compliance
Market (listed firms) Assess whether the event is material Exchange disclosure inside the Regulation 30 window Clarify any rumour that moved the price; brief analysts with filed facts Company secretary and chief financial officer (CFO)
Public Holding line on owned channels and service scripts; promotions paused Customer guidance; staff and partner briefings; updates on time Full account: cause, who was hit, what was fixed, what customers get Head of corporate communications

The rule that ties them together: the public clock never says more than the regulator clock has filed.

05 · Step by step

How do you run the plan when something breaks?

Eight steps, in order. The first four belong to the first hour.

  1. Declare it, by role.

    A named role opens a crisis room with communications, compliance, legal, security, customer service and the affected business. Declaring late costs the first hour.

  2. Write the fact sheet first.

    What we know, what we do not know, what we are doing, when we will update. Nothing goes public that is not on it.

  3. Start the reporting clocks.

    Security and compliance confirm in writing which reports are due and by when.

  4. Post the holding line.

    Same words on owned channels and in call-centre and branch scripts. Pause scheduled promotions; a cheerful offer beside an outage reads as indifference.

  5. Brief the people customers ask.

    Branch staff, agents, relationship managers, distributors and partners get one page: facts, guidance and what not to say.

  6. Publish customer guidance.

    What to do and where to report. In fraud cases, say plainly that the firm will never ask for a PIN or one-time password (OTP).

  7. Keep every update promise.

    If the next update is due at 6 pm, publish at 6 pm, even if the news is only that work continues.

  8. Publish the full account by hour 72.

    Cause, who was affected, what was fixed, what customers get and what changes, checked against every filing.

06 · The voices

Who should speak for the firm in a crisis?

One voice per audience, chosen before anything happens. The wrong spokesperson turns an incident into a story about leadership.

Customers and media

The chief executive

Speaks when money, safety or the firm’s standing is in question. Says what is being done. Does not speculate on cause.

Detail

The subject lead

The security chief, risk chief or head of claims explains the detail once facts are confirmed.

Markets

The company secretary

Owns the exchange filing and checks nothing material reaches the press first.

Everyone else

The brand’s channels

One team posts the holding line and updates. Everyone else shares and never rewrites.

Senior staff stay silent on personal accounts and point to the official update; write that into the social media policy now. How a bank’s brand earns trust in calmer times is covered in our bank branding questions.

07 · The first words

What goes into a holding statement?

A holding statement is the first public line, issued before you have the full picture. It never guesses at cause, scale or blame.

Field What to write Hypothetical example: an app outage
What happened Only what is confirmed Some customers cannot log in or make payments since this morning.
Who is affected Confirmed scope, or say it is being checked We are still checking how many customers are affected.
Is money safe Only once technology confirms it Balances and past transactions are not affected.
What to do now One action, one official channel For urgent payments, use netbanking or a branch. We will never ask for your PIN or OTP.
What we are doing The work, not the excuse Our teams are working to restore the service.
Next update A time and a place Next update at 1 pm on this page and our official accounts.

The example is hypothetical. Get the template pre-approved by compliance and legal, so only the facts are filled in on the day.

08 · The feed

How should a financial brand respond to a social-media storm?

Answer facts with facts, once in public and privately after that. A storm feeds on silence, argument and anything that looks like deletion.

  1. Pin the official update everywhere and answer the loudest posts with a link to it.
  2. Sort posts into questions, complaints, rumours and scams, each with an approved reply line.
  3. Never ask for account details in public. Name the official channels and move people there.
  4. Route fake support handles and lookalike apps to security. Both appear on CERT-In’s list of reportable incidents.
  5. Do not delete critical posts or hide replies. Screenshots outlive deletions.
  6. At a listed firm, send any rumour about a material event to the company secretary before the share price moves.

One test for every reply: would you be comfortable hearing it read aloud by your regulator?

09 · After hour 72

How does a financial brand rebuild trust after a crisis?

Trust comes back through things customers can check, not campaigns. Most firms go quiet too early.

  1. Close every affected case.

    Tell each customer what happened to their case and what they received.

  2. Publish what changed, with dates.

    A new control, a faster reporting route, a product fix, and the date of the next update.

  3. Update at fixed points.

    For example at 30 and 90 days, until the fix is complete.

  4. Measure with your own numbers.

    Complaint volumes against baseline, wait times, app ratings, searches pairing your name with “fraud”, and sentiment on your accounts.

  5. Review, then restart marketing slowly.

    Compare what was filed with what was said, fix the plan, and hold campaigns until customers feel the fix.

10 · The scorecard

How ready is your firm for its next crisis?

Score each line 0 (missing), 1 (exists, untested in the last year) or 2 (exists and tested). Below 10 out of 16, the plan is a document, not a capability.

Readiness item Score Evidence to keep
A named role, with deputies, can declare a crisis at any hour 0 · 1 · 2 On-call rota
A reporting map shows which incident triggers which report, to whom and how fast 0 · 1 · 2 Map linked to each rule
Holding statements for all five crisis types are pre-approved 0 · 1 · 2 Templates with approval dates
The company secretary joins for any possibly material event 0 · 1 · 2 Escalation rule
Scheduled ads and posts can be paused within minutes 0 · 1 · 2 Named owner and access
Staff, agent and partner briefings can go out within hours 0 · 1 · 2 Distribution lists
Fake handles and lookalike apps are spotted and routed to security 0 · 1 · 2 Monitoring and routing rule
The plan was rehearsed in the last 12 months 0 · 1 · 2 Exercise report and fixes

The line most plans miss is the reporting map. Without it, the first hour goes on finding out who must be told.

11 · The memo

What to tell your compliance team and your CFO

Paste these into an email and fill in the brackets.

For compliance

We are updating our crisis communications plan. Each template states only confirmed facts, a customer action and the next update time. We have mapped our reporting clocks, including CERT-In’s six-hour window and [our regulator and exchange filings], and the public line will follow the filed version. Every statement, approver and time stamp will be kept in [location]. Please review by [date].

For the CFO

The plan costs [internal hours and any agency fee] plus one simulation a year. It limits the costs of a badly handled incident: call-centre overload, customers leaving and regulatory follow-up. We will measure time to first holding statement, time to full account and how fast complaints return to baseline. If two simulations show no improvement, we will change the approach.

This is general guidance, not legal advice; your compliance team decides.

12 · The limits

When is a full crisis response the wrong choice?

A crisis plan is for incidents that affect customers, markets or a regulator’s view of the firm. Used on everything, it does harm.

  • A single complaint you can solve privately. A public statement turns one unhappy customer into a story.
  • A glitch fixed before anyone noticed. A notice can create the alarm it describes, though a reportable incident is reported whatever its size.
  • A matter under regulatory confidentiality or investigation. Counsel leads; communications prepares lines but does not publish.
  • A rumour with no traction and no price move. Answering it can spread it.
  • Any plan where an agency would be the voice. An agency drafts, monitors and trains; the firm’s own people speak.

Choose the full plan if customers are affected, a filing is due or the story is moving without you. Otherwise, choose a quieter route.

13 · Answers

Frequently asked questions

What is crisis communications for banks?

Crisis communications for banks is the planned, pre-approved way a bank tells customers, regulators, investors, staff and the media what happened, what it means for them and what happens next during an outage, fraud, data breach, regulatory action or social-media storm.

How fast must a bank or insurer report a cyber incident in India?

CERT-In’s directions of 28 April 2022 require listed cyber incidents to be reported within 6 hours of noticing them. IRDAI asks insurers to copy it on that report and send it available details within 24 hours. Your compliance team confirms what applies to you.

Should a listed bank tell the stock exchange or the press first?

The stock exchange. SEBI’s listing regulations say a listed entity shall first disclose material events to the exchanges: within 30 minutes of a board decision, 12 hours for events arising inside the company and 24 hours for events arising outside it.

What should a holding statement say?

What is confirmed, who is affected so far, one action customers should take and the official channel to use, what the firm is doing, and when the next update will come. It should not guess at cause, scale or blame.

Who should speak for a bank in a crisis?

The CEO or managing director when customers’ money or the firm’s standing is in question, a subject lead such as the security chief for technical detail, and the company secretary for exchange filings. Other staff should point to the official update.

How long does it take to rebuild trust after a financial-services crisis?

There is no fixed period. Trust returns as customers see the fix: affected cases closed, a public account of what changed, and updates at fixed points until the work is done.

Sources, all accessed 13 October 2026

  1. CERT-In: Directions under section 70B(6) of the IT Act, 2000. 28 April 2022
  2. IRDAI: Reporting of Cyber Security Incidents by Regulated Entities. 13 June 2023
  3. RBI: Master Direction on IT Governance, Risk, Controls and Assurance Practices. 7 November 2023
  4. RBI: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions. 6 July 2017
  5. RBI: Commercial Banks – Responsible Business Conduct Third Amendment Directions, 2026. 24 June 2026
  6. SEBI: LODR Regulations, 2015, amended up to 22 January 2026
  7. Press Information Bureau: DPDP Rules, 2025 Notified. 17 November 2025
  8. ICO (UK): Report a personal data breach
  9. US SEC: press release 2023-139 on cybersecurity disclosure. 26 July 2023

Related: Read every post on the PR and communications desk · Bank branding questions · BFSI marketing compliance FAQ · All question hubs

Before the next incident

Know what your brand stands on.

Trust is easier to defend when it was built on purpose. The free Fintech Brand Audit scores your brand on eight dimensions, including trust signals and compliance-readiness, in about ten minutes.

Take the free brand audit →Contact Yamm Labs