Daijiworld Media Network - Mumbai
Mumbai, Oct 30: The Reserve Bank of India (RBI) has stepped up scrutiny of banks amid rising cyberattacks targeting the country's financial infrastructure, seeking evidence of compliance with existing cybersecurity rules and details of their preparedness to tackle risks associated with artificial intelligence (AI).
According to people familiar with the matter, the central bank has held a series of recent meetings with banks and asked them to examine vulnerabilities in their application programming interfaces (APIs), which enable banks to connect with non-banking financial companies (NBFCs), fintech firms and other service providers.
The RBI's heightened vigilance comes amid growing concerns that hackers are using increasingly sophisticated AI tools to target financial institutions, potentially exposing customer information and funds to unauthorised access.
One source familiar with regulatory thinking said smaller lenders, NBFCs and third-party technology vendors were increasingly viewed by cybercriminals as softer targets. Another source, a consultant working with leading banks, said implementation of existing RBI cybersecurity directives remained uneven, prompting the regulator to push financial institutions to strengthen compliance.
The sources spoke on condition of anonymity as the discussions are not public. The RBI did not immediately respond to a request for comment.
The latest scrutiny follows a series of cyber incidents involving Indian financial institutions. State Bank of India, the country's largest lender, recently disclosed that preliminary investigations had identified 3,897 customer records containing personal information among data found on the dark web. The bank said it was investigating the exposure and had engaged an independent cybersecurity agency to assess the incident.
In another incident, two Mumbai-based NBFCs reportedly lost around $2 million through more than 700 unauthorised instant transfers from accounts maintained with ICICI Bank on October 8 and 9. A police complaint reviewed by Reuters alleged that hackers had compromised the API used to transmit loan-disbursal instructions to the bank. ICICI Bank did not immediately respond to requests for comment.
India's cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), had issued an advisory on October 9 warning financial institutions about attacks involving stolen API credentials. Hackers were allegedly using compromised credentials to initiate transfers from lenders' systems, with indications that AI-assisted tools may have been used to facilitate such attacks.
Earlier this week, CERT-In also conducted cybersecurity training for around 300 officials representing more than 55 financial institutions, according to a post by the agency on X.
The developments come as banking regulators across the world, including in the United States and Britain, are increasing their scrutiny of AI-related threats to financial systems. The growing use of AI tools has raised concerns about the speed and sophistication of cyberattacks, particularly where banks rely on interconnected platforms and external technology providers.
The RBI's latest intervention signals a stronger push to ensure that banks not only have cybersecurity policies in place but also effectively implement safeguards across their systems, digital interfaces and third-party partnerships.