RBI Increases Scrutiny of Bank Cyber Defences Amid Rising AI-Driven Threats

The Reserve Bank of India (RBI) has reportedly stepped up its oversight of banking cyber defences, seeking compliance proofs and details on artificial intelligence risk preparedness. According to reports citing sources familiar with the matter, the central bank held recent meetings directing lenders to investigate vulnerabilities in application programming interfaces (APIs).

Regulatory Focus and API Vulnerabilities

• API Security: The RBI has urged banks to examine software links used for connecting with non-bank lenders and fintech partners.
• Third-Party Risks: Sources indicated that hackers frequently target smaller institutions and third-party vendors as softer entry points.
• Implementation Lags: Consultants noted that while cybersecurity directives exist, gaps in execution have driven the regulator to demand stricter compliance.

Recent Incidents and Warnings

Reports highlight a surge in recent domestic cyber incidents, drawing heightened attention from regulatory and law enforcement bodies:

• Data Leaks: State Bank of India reported investigating a customer data leak affecting thousands of accounts.
• Unauthorized Transfers: Police complaints revealed that Mumbai-based non-bank lenders suffered unauthorized instant transfers following compromised API links.
• CERT-In Advisories: India's cyber agency issued warnings regarding attackers stealing API credentials, potentially utilizing AI-assisted tools, and conducted training sessions for financial institution officials.

Practical Implications and Verification

Financial institutions are expected to audit their API integrations and third-party vendor access controls closely. Stakeholders and customers can monitor official updates and advisories directly from the Reserve Bank of India and CERT-In portals to verify regulatory announcements and security guidelines.