India's Regulatory Cleanup: ED Targets Legacy FERA Cases by 2026, Audit Powers Redefined

A significant regulatory cleanup is underway in India, with two parallel developments signaling a shift in how the country manages legacy compliance burdens and modern oversight. The Enforcement Directorate (ED), India's premier financial investigation agency, has set an ambitious target to close all pending cases under the archaic Foreign Exchange Regulation Act (FERA) by early 2026. This initiative represents a decisive move to clear decades-old administrative baggage, freeing institutional resources for contemporary financial crimes, many of which are cyber-enabled.

The FERA Legacy: A Pre-Digital Law in a Digital Age
Enacted in 1973, FERA was a stringent law designed for an era of closed economies and tight foreign exchange controls. It was repealed and replaced by the more liberal Foreign Exchange Management Act (FEMA) in 1999. However, cases initiated under FERA before its repeal have continued to linger in the system, some for over three decades. These 'legacy cases' often involve outdated documentation, witnesses who may no longer be available, and alleged violations that pertain to a financial ecosystem that no longer exists. For cybersecurity and fintech compliance officers, this historical liability has been a peculiar backdrop, a reminder of a regulatory past disconnected from today's digital-first, globalized transactions involving cryptocurrencies, cross-border SaaS payments, and digital asset flows.

The ED's fast-tracking of these closures is not merely an administrative exercise. It is a strategic reallocation of enforcement bandwidth. By resolving these dormant files—through closure, compounding, or prosecution—the agency can redirect its specialized investigators and forensic accountants toward more pressing threats. These include complex money laundering schemes using digital wallets, fraud on online trading platforms, and violations of cybersecurity guidelines that protect financial data. The 'legacy liability' of FERA cases has long acted as a drag on proactive, intelligence-driven enforcement against modern financial crime vectors.

Concurrent Shift: Redrawing the Lines of Audit Oversight
In a related development that completes the regulatory modernization picture, the Institute of Chartered Accountants of India (ICAI) has proposed a clear division of audit oversight responsibilities with the National Financial Reporting Authority (NFRA). The NFRA, established in 2018, was created to enhance audit quality and oversight, particularly for large public-interest entities. Its emergence led to over a year of jurisdictional ambiguity and tension with the ICAI, the traditional statutory body for the audit profession.

The proposed truce involves a bifurcated model: the NFRA would focus its regulatory and disciplinary powers on large, systemically important entities and their auditors, while the ICAI would retain oversight of auditors for smaller and medium-sized companies. This delineation aims to eliminate duplication, clarify the compliance landscape for audit firms, and establish a more efficient supervisory structure.

Implications for Cybersecurity and Compliance Professionals
For professionals in cybersecurity, risk, and compliance, these intertwined developments offer critical insights:

1. The Era of Regulatory Cleanup: Governments worldwide are grappling with 'legacy liability'—the accumulated burden of old cases and outdated regulations. India's proactive stance sets a precedent. Organizations should audit their own compliance histories for dormant issues that could be similarly 'cleared' or that may require updated controls.

1. Resource Reallocation to Digital Threats: As agencies like the ED shed legacy caseloads, their enhanced focus will inevitably turn to the digital frontier. Expect increased scrutiny on compliance with cybersecurity frameworks (like India's CERT-In directives), data localization norms, and anti-money laundering (AML) controls in fintech and e-commerce. Proactive cybersecurity investment becomes a key shield against this sharper regulatory focus.

1. Clarity in Professional Oversight: The ICAI-NFRA model provides a blueprint for managing transitions in regulatory authority. In cybersecurity, similar evolutions occur as new data protection authorities (like India's upcoming DPB) are established alongside existing IT ministry powers. Clear jurisdictional lines reduce compliance complexity and help organizations know which regulator to engage for specific issues.

1. Forensic Readiness: The closure of old FERA cases often involves forensic accounting reviews. This underscores the perennial need for robust data retention and retrieval policies. In a digital context, this translates to ensuring long-term integrity and accessibility of audit logs, transaction records, and system metadata—a core cybersecurity hygiene practice.

Conclusion: Modernizing Enforcement for a Digital Economy
India's dual-track approach—closing the books on the FERA era while rationally reorganizing audit oversight—represents a mature step in regulatory evolution. It acknowledges that enforcement efficacy in the 21st century requires unburdening agencies from the past and providing clear, modern rules of engagement for professionals. For the global cybersecurity community, it is a case study in how nations are attempting to align their regulatory machinery with the realities of a digital economy, where crimes and compliance challenges move at network speed. The message to organizations is clear: as regulators clean their own house, they will have more capacity to examine yours. Ensuring your digital compliance and cybersecurity defenses are not 'legacy liabilities' themselves is the imperative takeaway.