The Reserve Bank of India has tightened its cyber checks on lenders after a spate of hacks, warning banks of rising cyberattacks on financial infrastructure and seeking proof of compliance with existing rules and details of their preparedness for AI-related risks, Reuters reported on Friday, citing three people familiar with the matter.

Source: Reuters via The Sen Times

In a series of recent meetings, the RBI asked banks to probe weaknesses in their application programming interfaces (APIs) — the software links banks use to connect with non-bank lenders and fintechs — Reuters reported. One source, described as a person aware of regulatory thinking, said hackers see smaller lenders, non-bank lenders and their third-party vendors as “softer targets.”

While the RBI has already issued directives on managing cybersecurity risk, implementation lags, a second source — a consultant working with top banks — told Reuters, and that has prompted the regulator to push for stronger implementation. The sources declined to be named because the discussions are not public, and the RBI did not immediately respond to a request for comment, Reuters said.

The attacks behind the push

India has seen a surge in cyber incidents in recent weeks. At State Bank of India, the country's largest lender, data of 3,900 customers was leaked, Reuters reported. In another case, two Mumbai-based non-bank lenders lost about $2 million in more than 700 unauthorised instant transfers from accounts held with ICICI Bank on October 8-9, according to a police complaint reviewed by Reuters, which said hackers had compromised the API link used to send loan disbursal instructions to the bank.

India's cyber agency CERT-In warned in an advisory on October 9 that hackers are stealing banks' API credentials to move money out of lenders' own systems, possibly using AI-assisted tools, Reuters reported. Earlier this week CERT-In also ran cybersecurity training for 300 officials from more than 55 financial institutions, the agency said in a post on X cited by Reuters.

Regulators in the United States and Britain are also stepping up efforts to contain AI-related risks to banks, Reuters reported earlier this month. For Indian customers, the immediate change is behind the scenes: banks are being asked to show, not just state, that their existing cyber defences actually work.