The Reserve Bank of India (RBI) has stepped up scrutiny of banks’ cybersecurity preparedness, asking lenders to demonstrate compliance with existing security requirements, investigate vulnerabilities in financial technology systems and explain how they are preparing for artificial intelligence-related threats.
The regulatory push follows a series of cyber incidents involving Indian financial institutions, including a suspected customer-data leak at State Bank of India (SBI) and unauthorised transfers worth approximately $2 million from accounts held by two Mumbai-based non-bank lenders.
Three people familiar with the discussions told Reuters that the RBI had raised these concerns during a series of recent meetings with banks.
The latest scrutiny comes amid concerns that financial institutions have been slow to implement cybersecurity requirements already issued by the regulator.
RBI Focuses On Implementation Of Existing Cybersecurity Rules
The RBI has already issued directives requiring banks to strengthen their cybersecurity frameworks and manage technology-related risks.
However, implementation has reportedly lagged behind regulatory expectations.
According to a consultant working with major banks, the regulator is now pushing lenders to demonstrate that existing requirements are being implemented effectively rather than remaining limited to internal policies and compliance documentation.
The RBI has also sought information about banks’ preparedness for risks associated with artificial intelligence.
The discussions are taking place as financial institutions increasingly depend on interconnected technology systems, external service providers and automated processes to manage transactions.
The RBI did not immediately respond to Reuters’ request for comment.
Banking APIs Become A Major Security Concern
One of the regulator’s principal concerns is the security of application programming interfaces, commonly known as APIs.
These software interfaces allow different applications and financial institutions to communicate and exchange information.
Banks use APIs to connect with fintech companies, payment platforms and non-banking financial companies for services that include loan processing and disbursement.
However, weaknesses in these connections can provide attackers with opportunities to access financial systems or initiate unauthorised transactions.
Reuters reported that the RBI had asked banks to investigate potential vulnerabilities in their APIs during recent meetings.
One person familiar with regulatory thinking said hackers increasingly view smaller lenders, non-bank financial institutions and their third-party technology providers as easier targets.
This raises concerns about security gaps extending beyond a bank’s own infrastructure to the external companies and systems connected to it.
SBI Data Leak And ICICI-Linked Fraud Raise Concerns
The RBI’s increased scrutiny follows several incidents involving India’s financial sector.
State Bank of India recently reported the suspected exposure of information belonging to approximately 3,900 customers.
The bank said it was investigating the incident and had not yet established the vulnerability responsible for the exposure.
In another case, two Mumbai-based non-bank lenders reportedly lost approximately $2 million through more than 700 unauthorised instant transfers from accounts maintained with ICICI Bank on October 8 and 9.
According to a police complaint reviewed by Reuters, attackers compromised the API connection used to send loan-disbursement instructions to ICICI Bank.
The incident highlights how weaknesses in the technology connecting financial institutions can potentially be exploited to move money through systems designed for legitimate transactions.
ICICI Bank did not immediately respond to Reuters’ request for comment.
CERT-In Warns Of Stolen API Credentials And AI-Assisted Attacks
India’s cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), had issued an advisory on October 9 warning financial institutions about attackers stealing bank API credentials to move money from lenders’ own systems.
The agency also flagged the possible use of artificial intelligence-assisted tools in such attacks.
AI can potentially help attackers automate reconnaissance, identify weaknesses and accelerate certain stages of cyber operations.
However, the advisory’s warning about AI-assisted techniques should not be interpreted as confirmation that artificial intelligence was used in every recent banking incident.
CERT-In has also stepped up engagement with the financial sector.
Earlier this week, the agency conducted cybersecurity training for approximately 300 officials representing more than 55 financial institutions.
The exercise reflects growing attention towards strengthening the ability of banks and other financial organisations to identify and respond to sophisticated cyber threats.
Third-Party Technology Providers Remain An Exposure Point
The growing dependence on external technology providers creates additional security challenges for financial institutions.
Banks and NBFCs increasingly rely on vendors for payment processing, loan management, cloud infrastructure, customer verification and other technology services.
A vulnerability in one connected service can potentially expose several institutions, particularly when access credentials or transaction interfaces are shared across systems.
Smaller lenders may face additional challenges because of limited cybersecurity resources and dependence on external vendors.
This makes vendor security assessments, API monitoring, credential management and independent security audits important components of financial-sector protection.
The RBI’s latest scrutiny suggests that regulators are increasingly concerned about whether institutions are addressing these risks in practice.
What This Means For Bank Customers
For customers, cybersecurity weaknesses in banking infrastructure can have consequences beyond phishing messages and fraudulent calls.
Compromised financial APIs and unauthorised access to connected systems can potentially expose personal information or facilitate transactions without proper authorisation.
Customers should continue monitoring account statements, enabling transaction alerts and reporting unfamiliar transfers to their banks immediately.
Financial institutions, meanwhile, need to strengthen authentication, monitor unusual transaction patterns and investigate suspicious activity across both internal and third-party systems.
The RBI’s latest intervention does not amount to a newly announced cybersecurity regulation. Instead, it signals stronger supervisory pressure on banks to demonstrate that existing safeguards are working.
As financial services become increasingly interconnected and AI-assisted attacks evolve, the effectiveness of those safeguards will become an important test of India’s banking cybersecurity preparedness.
