The RBI has moved from warning banks about AI attacks to asking for proof

Facts are attributed and linked to their sources. The analysis and opinions are the author's own.

What it is

According to Reuters, via Business Standard on 30 October, the Reserve Bank of India has stepped up its scrutiny of banks' cyber defences. It is asking for proof that banks comply with existing rules and evidence of how they are preparing for AI-related risk. It has also asked them to probe weaknesses in the APIs that connect them to NBFCs and fintechs. The report says smaller lenders and vendors are seen as "softer targets", and that implementation lags.

The report links this to a recent loss. On 8 and 9 October two Mumbai NBFCs lost about $2 million in more than 700 unauthorised instant transfers from ICICI Bank accounts after a loan-disbursal API was compromised. The same report mentions a data leak at SBI affecting 3,900 customers, and says CERT-In issued an advisory on 9 October and trained 300 officials from more than 55 institutions.

Separately, on 30 October the government set up a six-month High Level Committee on Banking for Viksit Bharat, chaired by Suresh N Patel, with RBI Deputy Governor Shirish Chandra Murmu, NS Vishwanathan and Padmaja Chunduru as members, PTI reported via ETBFSI. The Indian Express reports that its remit includes a roadmap for AI and digital innovation with cyber safeguards.

Why it matters

Last week, in Issue 02's India's regulators to finance: assume the agent already got in, the message was a warning. This is the next step: show the evidence. The detail that matters most is the API. The reported loss did not come through a bank's own front door. It came through a partner's disbursal link that the bank's systems trusted. Every co-lending, embedded-finance or buy-now-pay-later arrangement is an API with a credential that can move money.

The report does not say whether an agent was involved in that attack. It does not need to. Seven hundred transfers in two days is work for a script, and this issue's cover story shows what attackers now do with a stolen credential at machine speed.

A partner API that can move money is part of the bank's perimeter, whatever the contract says.

Proof, in practice, means artefacts a supervisor can inspect: an inventory of partner APIs and what each one is allowed to do, per-API limits on volume and value, alerts on bursts of transfers, and a kill switch that has been tested, not just documented. Smaller lenders will struggle to build this alone, which is why the "softer targets" line in the report matters. Expect shared services or minimum standards to follow.

What I'd watch

• Whether the RBI turns its request for proof into formal directions on partner-API security.
• What the High Level Committee says about AI and cyber safeguards, and whether it reports within its six-month term.
• Whether industry bodies offer smaller NBFCs shared API monitoring.