The Reserve Bank of India (RBI) is stepping up cybersecurity checks on banks following a series of cyberattacks targeting financial institutions. The regulator wants lenders to demonstrate compliance with existing security rules and assess their readiness to tackle emerging artificial intelligence (AI) risks.
According to a Reuters report published by India Today on October 30, 2026, the RBI has asked banks to investigate vulnerabilities in their application programming interfaces (APIs). These connections allow banks to exchange information with fintech companies and non-bank lenders.
The latest RBI cybersecurity checks come amid growing concerns about customer data breaches, unauthorised transactions and increasingly sophisticated cyberattacks.
RBI cybersecurity checks target API vulnerabilities
The RBI cybersecurity checks focus on potential weaknesses in APIs that connect banks with other financial institutions and technology providers. Hackers could exploit these connections to access sensitive information or manipulate financial transactions.
The RBI has asked banks to examine these vulnerabilities and demonstrate stronger compliance with existing cybersecurity requirements. The regulator is also concerned about delays in implementing its earlier security directives.
Smaller lenders, non-bank financial companies (NBFCs) and third-party technology vendors face particular risks. Cybercriminals may target these organisations to exploit weaknesses in the wider financial network.
Stronger API security could help banks protect customer information, prevent unauthorised transfers and reduce the risk of attacks spreading across connected financial systems.
SBI data leak and NBFC fraud raise concerns
Recent cyber incidents have increased pressure on financial institutions to strengthen their security measures.
State Bank of India (SBI), the country’s largest lender, reported a data leak affecting 3,900 customers. The bank said it was investigating the incident and had not yet identified the underlying vulnerability, according to Reuters.
In a separate incident, two Mumbai-based non-bank lenders lost approximately $2 million through more than 700 unauthorised instant transfers on October 8 and 9.
The transfers involved accounts held with ICICI Bank. According to a police complaint reviewed by Reuters, hackers compromised an API connection used to send loan-disbursement instructions to the bank.
These incidents highlight the risks associated with connections between banks, fintech companies and other financial service providers. They also underline the importance of stronger monitoring and access controls.
AI-assisted attacks add to banking security risks
Artificial intelligence is creating additional challenges for cybersecurity teams. Criminals can potentially use AI tools to automate attacks, improve phishing attempts and identify weaknesses in digital systems.
India’s cybersecurity agency, CERT-In, warned in an October 9 advisory that hackers were stealing banks’ API credentials to move money from lenders’ systems, potentially using AI-assisted tools.
CERT-In also conducted cybersecurity training for 300 officials from more than 55 financial institutions earlier this week.
The RBI cybersecurity checks reflect the growing need for banks to prepare for evolving threats. Financial institutions must protect their digital infrastructure while maintaining secure connections with
