The Reserve Bank of India (RBI) has intensified its cybersecurity scrutiny of banks following a series of recent cyber incidents affecting India’s financial sector. Banks have been asked to provide evidence that existing cybersecurity requirements are being implemented and to explain their preparedness for AI-related cyber risks.
A particular focus is on application programming interfaces (APIs) that connect banks with NBFCs, fintech companies and other financial institutions. The RBI has asked banks to examine these connections for security weaknesses, as compromised APIs can potentially be exploited to initiate unauthorised transactions or bypass conventional application-level controls.
The scrutiny follows several incidents. Data involving approximately 3,900 SBI customers was reportedly leaked, while two Mumbai-based NBFCs suffered around $2 million in losses through more than 700 unauthorised transfers on October 8–9. A police complaint said hackers had compromised an API used to send loan-disbursement instructions to ICICI Bank.
CERT-In had separately warned on October 9 that threat actors were stealing API credentials associated with payment aggregators, gateways and partner banks to move funds from financial institutions’ systems. The agency has also conducted cybersecurity training for 300 officials from more than 55 financial institutions.
The RBI’s concern extends beyond individual bank systems to the wider third-party and fintech ecosystem. Smaller lenders, NBFCs and technology vendors can become attractive targets because weaknesses in one interconnected entity can potentially create access points into another institution.
The development is particularly significant because the RBI’s 2026 Cybersecurity, Technology: Risk, Resilience and Assurance Framework is already in force for commercial banks. The latest scrutiny therefore appears focused not simply on whether policies exist, but on whether banks can demonstrate effective implementation of those controls.
For banks and NBFCs, the immediate priorities include API security, third-party risk management, privileged-access controls, credential protection, real-time monitoring and AI-risk preparedness. The incidents also demonstrate why cybersecurity needs to be treated as an enterprise-wide operational and financial risk rather than solely as an IT function.
Want to deepen your expertise beyond today’s news?
Explore practical certification courses designed for banking, risk, insurance, compliance, ESG, AI, and emerging technologies professionals.
Learn from industry experts and earn certifications from RMAI and BFSI Sector Skill Council of India.
#Riskmanagementnews