Reserve Bank of India Governor Sanjay Malhotra has warned that the next major financial crisis may not begin inside a bank or even within the traditional financial sector.
It could instead be triggered by a cyberattack, technological failure or geopolitical event that spreads through interconnected financial systems, he said.
Speaking at the Kautilya Economic Conclave in New Delhi on October 3, Malhotra called for stronger resilience across banks, financial markets, payment networks, technology infrastructure and critical third-party service providers.
“Today’s resilience may not necessarily imply tomorrow’s immunity,” he said, warning regulators and financial institutions against becoming complacent simply because the system currently appears stable.
FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals
Cyberattack Could Become Starting Point of Wider Financial Crisis
Past financial crises have often originated within banks, credit markets or highly leveraged financial institutions.
Malhotra said future crises may look very different.
A major cyberattack or technology failure could disrupt payment systems, financial institutions or infrastructure providers and then spread through multiple channels across the economy.
“It may begin with a geopolitical event, a cyberattack or a technological failure that affects the financial system through multiple channels,” he said.
That changes how regulators need to think about systemic risk.
Protecting individual banks is no longer enough if those banks depend on the same cloud providers, payment infrastructure, software systems or communication networks.
AI Makes Cyber Risk More Immediate
Malhotra also directly linked the rapid development of artificial intelligence with growing cybersecurity risk.
He said increasingly sophisticated AI tools could expand the ability of attackers to launch cyber operations or identify weaknesses in financial systems.
“With the development of sophisticated AI tools… the most immediate concern is regarding cyber risk,” Malhotra said.
AI can help defenders detect fraud and security threats.
But the same technology can potentially make phishing, social engineering, automated vulnerability discovery and other attacks faster and more convincing.
For financial institutions, the risk is magnified because banking and payment systems are highly interconnected.
A serious disruption at one institution or technology provider can therefore have consequences beyond the initial target.
RBI Wants Resilience Beyond Banks
Malhotra said financial stability cannot depend solely on strong commercial banks.
Regulators must also examine non-bank financial intermediaries, markets, payment systems, technology infrastructure providers, critical third parties and cross-border financial networks.
This reflects an important shift in financial regulation.
A bank may have healthy capital reserves but still face severe disruption if a payment processor, cloud provider or critical software system on which it depends suddenly stops functioning.
Cybersecurity therefore becomes a financial-stability issue rather than merely an IT problem.
India’s Financial System Is Strong, but RBI Warns Against Complacency
Malhotra stressed that India’s financial system currently remains resilient.
Banks have strong capital positions and asset quality has improved, while non-banking financial companies also maintain significant capital buffers.
But he warned that periods of apparent stability can encourage excessive risk-taking.
Financial vulnerabilities can build quietly and then surface quickly when conditions change.
“The cost of allowing vulnerabilities to build is simply too high,” he said.
His broader message was that policymakers should prepare for shocks before they occur rather than assuming current balance-sheet strength guarantees future safety.
Five Risks Could Combine to Stress Financial System
The RBI Governor highlighted several risks that could interact with each other.
These include elevated global debt, stretched financial-market valuations, particularly around AI-linked companies, high leverage, cyber threats and the expansion of private credit markets.
Any one of those risks may be manageable in isolation.
The danger arises when several occur simultaneously.
For example, a geopolitical event could trigger market volatility while a cyber incident affects payment or financial infrastructure at the same time.
That combination could intensify financial stress and make recovery more difficult.
AI Market Boom Creates Another Financial Risk
Malhotra also warned about the extraordinary amount of investment flowing into artificial intelligence.
He said the AI investment cycle has become an important support for global financial markets.
If expected earnings fail to materialise or investment slows sharply, assets linked to the AI ecosystem could face significant repricing.
That does not mean the RBI is predicting an AI market crash.
The warning is about valuation risk.
When investors price companies on expectations of extremely rapid future growth, disappointing earnings can trigger abrupt corrections.
Because AI-related companies now occupy a major position in global equity markets, such corrections could have broader financial consequences.
RBI Says Shocks Cannot Be Eliminated Completely
Malhotra argued that financial regulation should not attempt to remove every possible risk.
Doing so could suppress innovation, investment and useful financial activity.
Instead, regulators should build systems capable of absorbing shocks without allowing them to spread across the wider economy.
“We cannot prevent every shock,” he said.
The goal, according to the RBI Governor, should be to ensure that the financial system functions as a shock absorber rather than amplifying disruption.
Better Data Needed to Detect Emerging Threats
Malhotra also called for stronger monitoring systems and more granular data.
Traditional financial supervision often focuses on bank balance sheets, credit quality and liquidity.
But cyber and technology risks can develop outside those areas.
Regulators increasingly need visibility into technology dependencies, third-party service providers, cloud infrastructure and connections between institutions.
Mapping those relationships can help authorities identify situations where a single failure could affect several financial organisations simultaneously.
Geopolitical Shocks Are Becoming Financial Risks
Cybersecurity was only one part of Malhotra’s warning.
He also pointed to geopolitical conflict as a possible source of future financial stress.
Wars, sanctions, trade restrictions and supply-chain disruptions can affect commodity prices, currencies, inflation and capital flows.
Recent conflict in West Asia has already added pressure to global energy prices and inflation expectations, according to reporting from the conclave.
This creates another challenge for central banks.
Financial stability risks increasingly originate outside the financial system itself.
RBI Remains Cautious on Cryptocurrency
During the same discussion, Malhotra reiterated the RBI’s cautious position on cryptocurrencies.
He said India supports technologies such as distributed ledgers and tokenisation but remains concerned about private cryptocurrencies because of their potential impact on monetary policy, capital flows and the singleness of money.
The central bank has consistently argued that innovation should be separated from risks associated with privately issued crypto assets.
That fits the broader message of Malhotra’s speech: technological innovation should continue, but the financial system must be prepared for risks created by new technologies.
What this means for you
Cybersecurity failures are no longer simply technology problems for banks. RBI’s warning shows that a sufficiently serious cyberattack or technology outage could become a financial-stability event, which means banks, payment companies and critical technology providers will face growing pressure to demonstrate operational resilience.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
