RBI bank cybersecurity scrutiny is intensifying as India’s financial system faces a new wave of attacks aimed not only at banks themselves, but also at the software links and outside vendors connecting them to the wider digital economy.
The Reserve Bank of India has asked lenders to demonstrate compliance with existing cybersecurity requirements and explain how prepared they are for AI-related threats, according to Reuters. The increased attention follows several incidents involving customer information, unauthorised transfers and weaknesses around application programming interfaces, or APIs.
Cybersecurity is no longer only about protecting a bank’s internal network. The perimeter now extends to fintech partners, non-bank lenders, cloud platforms, software providers and every API trusted to move instructions or data.
RBI Bank Cybersecurity Checks Put APIs in Focus
Reuters reported that the RBI has asked banks in recent meetings to investigate vulnerabilities in APIs. These software connections are essential to modern finance because they allow banks, fintechs and other institutions to exchange information and initiate services automatically.
Two Mumbai-based non-bank lenders lost about $2 million through more than 700 unauthorised instant transfers on October 8 and 9, according to a police complaint reviewed by Reuters. The complaint said hackers compromised an API used to send loan-disbursement instructions to ICICI Bank.
Separately, State Bank of India has been investigating a leak involving data belonging to roughly 3,900 customers.
On October 30, AU Small Finance Bank also said it was investigating a potential leak involving a software-as-a-service platform managed and hosted by Salesforce. The bank said the affected platform held limited information related to vehicle-loan customers, while its own systems were unaffected and banking services continued normally.
A breach involving an outside platform is not the same as a compromise of a bank’s core systems. But from a customer’s perspective, the larger ecosystem still holds financial information and can create operational risk.
Third-Party Risk Is Becoming Banking Risk
Indian finance has become deeply interconnected.
Banks work with payment companies, lending platforms, verification services, analytics providers and cloud vendors. APIs make those relationships faster and more scalable. They also mean a weakness outside the bank can potentially become a route into a financial process.
That is why the latest RBI bank cybersecurity push fits a broader shift already visible in India.
The fintech industry is developing a code of conduct for technology vendors, while regulators have increasingly focused on operational resilience and third-party risk. Breakington recently covered how Indian fintechs are trying to strengthen the vendor layer as cyber threats move beyond a company’s own systems.
The RBI’s scrutiny gives the same issue greater urgency for regulated lenders.
Smaller lenders, non-bank finance companies and third-party vendors can be attractive targets because attackers may expect weaker controls than at the largest banks. Yet these organisations can still connect to high-value payment and lending infrastructure.
AI Raises the Stakes on Both Sides
The RBI is also asking lenders about preparedness for AI-related risks.
That does not mean every recent attack was created by artificial intelligence. It means AI can increase the speed and sophistication of phishing, reconnaissance, credential theft, social engineering and automated attacks.
India’s cyber agency CERT-In warned earlier in October that attackers were stealing banking API credentials to move money from lenders’ systems, potentially using AI-assisted tools. The agency has also provided cybersecurity training to hundreds of officials from financial institutions.
Banks themselves are simultaneously adopting AI for fraud detection, customer service, credit decisions and internal automation.
That creates a dual challenge. Financial institutions need to use AI defensively while governing the risks created by their own models and AI-enabled applications.
The RBI had already proposed a framework requiring stronger oversight of AI and machine-learning models, including board-approved risk management, model inventories, independent validation and human oversight for automated decisions.
Cybersecurity and AI governance are therefore starting to converge.
What Banks Need to Prove Now
The important phrase in the latest development is not “new rules.” Reuters reported that the RBI is seeking stronger evidence that existing cybersecurity directions are actually being implemented.
A sophisticated policy document has limited value if controls are inconsistent across thousands of integrations, credentials, vendors and endpoints. Banks need visibility into which systems can issue sensitive instructions, who controls those systems and how unusual behaviour is detected.
API credentials require strict protection. Third-party access needs continuous review. Incident-response plans must account for failures outside a bank’s own infrastructure. AI systems also need governance that connects model risk with cybersecurity rather than treating them as separate compliance exercises.
India’s Digital Finance Success Creates a Bigger Target
India’s digital financial infrastructure is one of its strongest technology achievements. Fast payments, app-based banking and API-driven financial services have made transactions dramatically easier.
Scale, however, attracts attackers.
The RBI bank cybersecurity push reflects the next stage of that evolution. Financial innovation cannot depend only on faster connections; those connections must also be verifiable, monitored and resilient.
The recent incidents do not mean India’s banking system is broadly compromised. They do show why the definition of a bank’s security perimeter has changed.
In modern finance, the weakest link may sit several companies away from the institution whose name appears on the customer’s screen. Regulators and banks now have to secure the entire chain.
