RBI Tightens Cybersecurity Checks on Banks Amid Rising Attacks

October 31, 2026 admin 0 Comments AI Risk, API security, banking cybersecurity, cyber risk, cybersecurity, financial sector cybersecurity, fintech risk, NBFC cybersecurity, rbi, third-party risk

The Reserve Bank of India (RBI) has intensified its scrutiny of banks’ cybersecurity controls following a series of recent attacks on financial institutions. The central bank has asked lenders to demonstrate compliance with existing cybersecurity requirements and provide details of their preparedness for AI-related risks.

A major focus of the RBI’s recent discussions with banks has been application programming interfaces (APIs), which connect banks with non-bank lenders and fintech companies. Banks have been asked to examine these interfaces for security weaknesses, particularly as compromised APIs can potentially be used to manipulate financial instructions or gain access to sensitive systems.

The increased scrutiny follows several recent incidents. Data belonging to approximately 3,900 State Bank of India customers was reportedly leaked, while two Mumbai-based non-bank lenders suffered losses of around $2 million through more than 700 unauthorised transfers on October 8 and 9. According to a police complaint, hackers compromised an API used for sending loan-disbursement instructions to ICICI Bank.

CERT-In had also warned on October 9 that attackers were stealing bank API credentials to move funds from financial institutions’ systems, potentially using AI-assisted tools. The agency subsequently conducted cybersecurity training for 300 officials from more than 55 financial institutions.

The RBI’s renewed focus also reflects concerns that existing cybersecurity requirements are not being implemented consistently. Smaller lenders, non-bank financial institutions and third-party technology providers may represent additional points of vulnerability within interconnected financial ecosystems.

For banks and NBFCs, the development reinforces the need to strengthen API security, third-party risk management, identity and access controls, continuous monitoring, incident response and AI-risk governance.

The message for financial institutions is increasingly clear: cybersecurity compliance must be demonstrable in practice, not merely documented through policies and frameworks.