The Reserve Bank of India has asked banks to demonstrate cybersecurity compliance amid a surge of data breaches.
The central bank also instructed banks to audit application programming interfaces (APIs) for vulnerabilities, after noting that these software links are a prime vector for fraud. A source aware of RBI's regulatory thinking said hackers target smaller lenders and their third‑party providers as "softer targets".
Recent incidents have put the sector under scrutiny: State Bank of India reported a data leak affecting roughly 3,900 customers, while two Mumbai‑based non‑bank lenders lost about $2 million after 700 unauthorized instant transfers via an ICICI Bank API.
CERT‑In issued an advisory on October 9 warning that attackers were siphoning API credentials, and earlier this week trained 300 officials from over 55 institutions to harden defenses.
The RBI's push follows a global tightening of cyber norms, with regulators in the United States and Britain also raising their security bar for financial firms.
In the coming weeks, the RBI will convene a compliance review of banks’ API security and AI risk protocols, with a deadline set for the end of the fiscal year.