India’s banking regulator has intensified scrutiny of cybersecurity systems across banks following a series of attacks on financial institutions. The Reserve Bank of India (RBI) has asked lenders to demonstrate compliance with existing cybersecurity rules, examine weaknesses in their digital infrastructure and explain how they are preparing for emerging threats linked to artificial intelligence.
The move comes after incidents involving customer information at State Bank of India (SBI) and fraudulent transactions affecting two Mumbai-based non-banking financial companies (NBFCs). These incidents have raised concerns about the security of digital connections between banks, fintech companies and other financial service providers.The latest scrutiny also highlights a wider challenge for India’s financial system. As banking services become increasingly dependent on digital platforms, vulnerabilities in one institution or technology provider can create risks across multiple organisations.
According to a Reuters report published on October 30, citing three people familiar with the matter, the RBI has held recent discussions with banks and asked them to examine weaknesses in their application programming interfaces (APIs). The regulator has also sought information about their preparedness for artificial intelligence-related cyber risks.
RBI cybersecurity checks focus on banks’ digital infrastructure
The RBI’s latest intervention focuses on whether banks are properly implementing cybersecurity requirements that already exist.
Rather than announcing an entirely new set of rules in response to the recent incidents, the regulator is seeking evidence that financial institutions have effective security arrangements in place.A major area of concern is API security.
APIs allow different software systems to communicate with one another. Banks use them to connect their platforms with fintech companies, lending institutions, payment providers and other financial services.
These connections help customers access faster digital services. However, poorly secured APIs can also create entry points for attackers.
A compromised API credential or an improperly protected connection could allow criminals to interfere with financial instructions, access sensitive information or initiate unauthorised transactions.
Reuters reported that the RBI has specifically asked lenders to investigate potential weaknesses in these connections.
People familiar with the discussions also indicated that smaller financial institutions and third-party technology vendors could be more vulnerable because attackers may view them as easier targets.
The RBI’s concerns therefore extend beyond the internal systems of individual banks. They also involve the wider technology networks that support modern financial services.
Recent cyberattacks put financial institutions under pressure
Two incidents have brought these vulnerabilities into sharper focus.The first involved State Bank of India, India’s largest public-sector lender.
In October, the bank disclosed an incident involving the loss of certain customer-related data after receiving alerts about information allegedly appearing on the dark web.
The incident reportedly involved information belonging to approximately 3,900 customers. SBI said it had initiated an investigation, although the exact vulnerability responsible for the exposure had not yet been established.
The bank’s investigation is important because exposed customer information can create risks even when criminals do not immediately gain access to bank accounts.
Names, contact details and financial information can help attackers construct convincing phishing messages, impersonate bank officials or target customers through fraudulent calls.
The second incident involved two Mumbai-based NBFCs.According to a police complaint reviewed by Reuters, the companies lost approximately $2 million through more than 700 unauthorised instant transfers on October 8 and 9.
The complaint alleged that hackers compromised an API used to transmit loan-disbursement instructions to ICICI Bank.
The incident raised questions about the security of connections between financial institutions and the systems responsible for processing payments.
AI-assisted cyberattacks create a new regulatory challenge
Artificial intelligence is adding another layer of complexity to financial-sector cybersecurity.
Criminal groups can potentially use AI tools to automate reconnaissance, analyse exposed systems, generate convincing fraudulent communications and improve social-engineering attempts.
This creates risks beyond traditional hacking methods. Attackers may use impersonation techniques to trick employees into sharing credentials or authorising fraudulent transactions.
India’s cybersecurity authorities have also raised concerns about criminals stealing API credentials to move money through financial systems.
On October 9, the Indian Computer Emergency Response Team (CERT-In) issued a warning about attacks involving banking API credentials.
The agency has also conducted cybersecurity training for around 300 officials from more than 55 financial institutions, according to information reported by Reuters.
The RBI had already begun addressing AI-related threats before the latest incidents. Its 2026 cybersecurity advisories covered risks associated with AI and generative AI, including attacks on technology infrastructure and AI-enabled social engineering.
The regulator’s approach reflects a growing recognition that banks must protect both their own use of artificial intelligence and the possibility that criminals will use similar technologies against them.
Why smaller lenders and technology vendors matter
India’s financial ecosystem has expanded beyond traditional banking.
NBFCs, fintech companies, payment providers and digital lending platforms now depend on interconnected systems to process transactions and deliver services.
This creates efficiency, but it also expands the potential attack surface.A security weakness at a third-party vendor can affect several financial institutions.
Similarly, compromised credentials at one organisation could provide attackers with access to systems connected to other institutions.
Smaller lenders may face additional difficulties because they do not always have the same cybersecurity budgets, specialist teams or monitoring infrastructure as large commercial banks.
The challenge is particularly significant when institutions rely on external providers for cloud infrastructure, payment processing, customer verification and software development.
The RBI’s emphasis on API vulnerabilities and third-party risks therefore addresses a structural issue within digital finance.
India’s digital banking expansion faces a critical test
India has built one of the world’s largest digital financial ecosystems, supported by mobile banking, instant payments, digital lending and interconnected financial platforms.
That expansion has improved convenience and access to financial services. However, it has also increased the importance of protecting the systems connecting banks, customers and technology providers.
The latest RBI scrutiny signals that regulatory compliance will need to translate into demonstrable cybersecurity preparedness.For financial institutions, the challenge is not simply to install better security software.
They must identify vulnerabilities, monitor suspicious activity, protect third-party connections and respond quickly when systems are compromised.
The recent incidents do not establish that India’s banking system is broadly unsafe. They do, however, demonstrate how weaknesses in interconnected financial infrastructure can create risks beyond a single institution.
The RBI’s next challenge will be to ensure that banks convert regulatory requirements into effective security practices.
The resilience of India’s digital banking system will increasingly depend on how well financial institutions protect the connections on which modern banking operates.
Curated news reports, in-depth analysis, and special features by India’s Opinion editorial team.
