MUMBAI, India — The Reserve Bank of India is intensifying cybersecurity scrutiny of banks and other lenders following a series of incidents that exposed weaknesses in financial technology infrastructure. According to reporting published on October 30, 2026, the central bank is seeking stronger evidence that institutions are complying with existing security requirements and adequately assessing vulnerabilities in application programming interfaces, third-party systems, and emerging artificial intelligence technologies. The increased attention reflects growing concerns about the ability of attackers to exploit connections between financial institutions and their technology providers.
Regulator Focuses on Compliance and API Security
The RBI’s reported review focuses on whether lenders have implemented previously established cybersecurity requirements and can demonstrate that their controls are operating effectively. Financial institutions are increasingly dependent on APIs to connect internal systems with payment networks, technology vendors, customer applications, and other financial service providers. These connections support efficient transactions but can also create security risks when authentication credentials, permissions, or transaction controls are inadequately protected.
According to Reuters, implementation of some cybersecurity directives has lagged, prompting greater regulatory attention. Smaller lenders and third-party technology providers are considered particularly vulnerable because their security resources may differ from those available to large financial institutions. The reported measures do not necessarily represent a completely new regulatory framework; they emphasize enforcement and implementation of existing obligations.
Recent Incidents Expose Financial Infrastructure Risks
The increased scrutiny follows several reported security incidents affecting Indian financial organizations. Information belonging to approximately 3,900 State Bank of India customers was reportedly leaked, while two Mumbai-based non-bank lenders lost around $2 million through more than 700 unauthorized transfers during October 8–9. A police complaint connected the latter incidents to the compromise of an API used to transmit loan-disbursement instructions to ICICI Bank.
These incidents demonstrate how attackers may target the connections between institutions rather than relying exclusively on direct access to customer accounts. Compromised credentials or poorly secured transaction interfaces can potentially allow unauthorized instructions to move through systems that ordinarily support legitimate business operations. Investigations into individual incidents remain important for determining precisely which controls failed and where responsibility lies.
AI-Related Threats Become a Growing Concern
The RBI is also reportedly asking lenders to explain how they are preparing for cybersecurity risks involving artificial intelligence. AI technologies can help financial institutions identify suspicious activity and automate security monitoring, but attackers may also use automation to improve phishing, credential theft, and other malicious operations. This creates pressure for financial organizations to evaluate both the benefits and risks associated with adopting advanced technologies.
India’s cybersecurity agency CERT-In has warned that attackers are stealing API credentials to conduct unauthorized fund transfers, potentially using AI-assisted techniques. The agency has also provided cybersecurity training to hundreds of officials from financial institutions. These activities highlight the importance of coordination between regulators, cybersecurity authorities, banks, and technology providers.
Banks Face Pressure to Strengthen Operational Defenses
Financial institutions will need to demonstrate that their security controls cover the full transaction process, including third-party connections, employee access, software maintenance, and monitoring of unusual activity. Strong authentication, restricted permissions, transaction verification, and timely incident reporting can help reduce exposure to API-related attacks. Independent testing and effective vendor oversight are also important where critical financial functions depend on external providers.
The RBI’s increased scrutiny reflects the broader challenge of protecting an increasingly interconnected financial system. As digital lending, payments, and automated financial services expand, cybersecurity weaknesses can affect multiple organizations simultaneously. The regulator’s approach places greater emphasis on demonstrating operational readiness rather than relying solely on written security policies.
This website uses cookies.