Are banks cyber-ready? RBI seeks proof of compliance amid rising attacks

NEW DELHI: The Reserve Bank of India (RBI) has asked banks to step up their cybersecurity measures and demonstrate compliance with existing rules amid a rise in attacks on financial institutions. According to three people familiar with the matter cited by Reuters, the central bank also asked banks to check their application programming interfaces (APIs) for security gaps. These software links connect banks with non-bank lenders and fintech companies, making them a key area of concern, the sources said.

The RBI has also sought information on how banks are preparing for risks associated with artificial intelligence (AI), as hackers increasingly use sophisticated tools to target financial infrastructure globally. Such attacks threaten both customer information and funds. One of the sources, a person aware of regulatory thinking, said hackers consider smaller lenders, non-bank lenders and their third-party service providers to be "softer targets". Although the RBI has already laid down directives for banks to manage cybersecurity risks, their implementation remains inadequate, said a second source, a consultant working with top banks. The regulator is now pressing banks to ensure stronger implementation of these requirements, the person added.

Recent cyber incidents put lenders under scrutiny

The concerns come against the backdrop of several cyber incidents reported in India's financial sector in recent weeks. State Bank of India, the country's largest lender, recently reported a data leak involving around 3,900 customers. The bank said last week that it was investigating the incident but had not yet identified the vulnerability responsible. In another incident, two Mumbai-based non-bank lenders suffered losses of around $2 million following more than 700 unauthorised instant transfers from accounts maintained with ICICI Bank on October 8 and 9, Reuters reported. According to the complaint, hackers had compromised the API connection through which loan disbursal instructions were sent to ICICI Bank.

The threat has also drawn attention from India's cybersecurity agency CERT-In. In an advisory issued on October 9, the agency warned that hackers were stealing banks' API credentials to move money out of lenders' own systems, potentially with the assistance of AI-based tools. CERT-In also conducted cybersecurity training earlier this week for 300 officials from more than 55 financial institutions, according to a post shared by the agency on its social media handle on X. The RBI's actions come as financial regulators globally are increasing their efforts to address the cybersecurity risks associated with AI. Authorities in the United States and Britain are among those stepping up measures to contain these threats, Reuters reported earlier this month.