The Reserve Bank of India (RBI) has tightened its scrutiny of how prepared banks are for cyberattacks, asking lenders to prove they are complying with existing security rules, to check the application programming interfaces (APIs) that link them with non-bank lenders and fintech companies, and to explain how they are getting ready for threats driven by artificial intelligence (AI). The move, first reported by Reuters on 30 October 2026 citing three people familiar with the matter, follows a string of attacks on Indian financial institutions in recent weeks.
What the RBI has asked banks to do
- Show compliance: banks must demonstrate that the RBI’s existing cybersecurity directives are actually being implemented, not just documented.
- Audit partner APIs: lenders have been asked to probe weaknesses in the software links that connect them with NBFCs and fintech partners, which carry instructions such as loan disbursals.
- Prepare for AI risks: the regulator has sought details of how banks plan to handle attacks that use AI tools.
- Assume compromise: an RBI advisory dated 19 October asked regulated entities to treat their technology environments as compromised until they are forensically cleared after any credential exposure or confirmed unauthorised access.
According to the sources, the requests were made in a series of recent meetings with banks. One person aware of regulatory thinking said attackers see smaller lenders, NBFCs and their third-party vendors as “softer targets”. A consultant working with large banks said the RBI already has cybersecurity rules in place but that implementation has lagged, which has pushed the regulator to press harder.
The incidents behind the crackdown
The scrutiny comes after two Mumbai-based NBFCs allegedly lost around $2 million through more than 700 unauthorised transfers on 8 and 9 October, after hackers compromised the API used to send loan-disbursal instructions to their bank, according to a police complaint reviewed by Reuters. State Bank of India has also said it is investigating a data leak affecting about 3,900 customers.
India’s cyber agency CERT-In warned in a 9 October advisory that attackers were stealing the API credentials of payment aggregators, gateways and partner banks to move money out of lenders’ systems, possibly with help from AI tools. Elets BFSI earlier reported how small NBFCs have lost an estimated ₹300 crore to AI-powered cyberattacks exploiting such payment API gaps. CERT-In has since trained around 300 officials from more than 55 financial institutions.
Why bank-fintech APIs are now the weak link
India’s digital lending and payments model depends on APIs. Banks use them to plug in co-lending partners, digital lending apps, payment aggregators and account aggregators, so that loans, repayments and collections can run automatically. Each connection adds an entry point. If credentials leak or authentication is weak, a fraudulent instruction can look exactly like a genuine one, and a compromised vendor serving several institutions can spread losses across the system.
For fintechs, the practical effect is likely to be tougher due diligence from their partner banks: more frequent security audits, stricter API access controls, multi-factor authentication for machine-to-machine calls, transaction limits and real-time monitoring of unusual disbursal patterns. Banks have also been building their own defences, such as SBI’s new CyRIS cybersecurity centre of excellence.
What it means for India’s fintech ecosystem
The RBI’s message is that outsourcing technology does not outsource accountability. Banks remain responsible for every rupee that moves through their rails, even when the instruction comes from a partner’s system. Fintechs and NBFCs that can show strong API security, clean audit trails and readiness for AI-driven fraud are likely to find partnerships easier to win and keep, while weaker players may face slower onboarding or tighter limits.
Frequently asked questions
Why has the RBI stepped up cybersecurity checks on banks?
The RBI acted after a series of cyberattacks on Indian lenders, including about $2 million in unauthorised transfers from two Mumbai NBFCs through a compromised loan-disbursal API, and a data leak at SBI. It wants proof that existing security rules are being implemented.
How does this affect fintech companies?
Banks have been asked to review the APIs connecting them with NBFCs and fintechs, so partners should expect stricter security audits, access controls and monitoring before and during integrations.
