RBI Cybersecurity Audits Intensify for Banks After API Attack Surge

On October 30, 2026, the Reserve Bank of India increased oversight of commercial banks, NBFCs, and payment entities after multiple API breaches. Officials demanded documented proof of compliance with existing rules and concrete plans to address AI-driven threats during recent supervisory meetings.

RBI Cybersecurity Compliance Demands Stronger API Controls

The October 19 advisory directs banks and payment operators to treat any exposed credentials or unauthorized access as full compromises until forensic review clears every layer of code, configuration, and cloud storage. Entities must rotate or delete affected credentials, maintain complete API inventories, and retire unused or test endpoints immediately. Real-time monitoring must flag unusual request volumes, bulk data pulls, or patterns that deviate from normal traffic.

Additional controls include mandatory multi-factor authentication, strict least-privilege access, and removal of administrative interfaces from public internet exposure. These requirements now extend explicitly to third-party vendors and fintech partners that connect through APIs. Any breach must be reported to the RBI within six hours via the DAKSH platform, consistent with the July 31, 2026 Cybersecurity Directions that already required bi-annual vulnerability assessments and annual penetration tests for internet-facing systems.

Incident data shows why the emphasis on APIs matters. Between October 8 and 9, 2026, attackers used compromised credentials to trigger more than 700 unauthorized transfers totaling roughly two million dollars from ICICI Bank accounts belonging to two Mumbai NBFCs. A separate breach exposed details of approximately 3,900 State Bank of India customers. CERT-In’s October 9 advisory noted that roughly 20 institutions faced similar credential theft targeting payment aggregators and partner-bank APIs, often with AI-assisted tooling that bypassed KYC, sanctions, and transaction limits.

Background on RBI Framework and AI Threats

The July 31, 2026 Directions established the baseline now being enforced. Commercial banks and NBFCs must maintain independent CISO reporting lines, conduct half-yearly disaster-recovery drills, and apply third-party risk controls. Implementation shortfalls prompted the latest round of meetings, where RBI staff asked lenders to detail their readiness for AI-related attack vectors.

Smaller NBFCs and fintech vendors remain primary targets because their API connections to larger banks often carry weaker authentication. The RBI advisory stresses that dormant or deprecated APIs create persistent entry points. Banks must now demonstrate active decommissioning processes and maintain logs that support rapid forensic reconstruction after any suspected event.

Global regulators have issued similar warnings about AI-assisted attacks on financial infrastructure. RBI Governor Sanjay Malhotra has publicly referenced these evolving risks in recent statements. The current enforcement push focuses on measurable evidence rather than policy statements, requiring banks to show working controls rather than planned improvements.

Practical Steps and Expected Developments

Banks should immediately audit all API endpoints, verify that no deprecated interfaces remain active, and confirm that every administrative console sits behind MFA and network restrictions. Third-party contracts need updated clauses that mirror the new forensic and reporting obligations. Institutions that demonstrate clear gaps risk additional supervisory actions, including on-site inspections or mandated remediation timelines.

Investigations into the October incidents continue. CERT-In and RBI teams continue to track whether the same credential sets appear in further attacks. No specific future enforcement dates have been announced, yet ongoing monitoring of API traffic anomalies and credential hygiene will determine whether further guidance or penalties follow.

For technology and compliance teams, the immediate priority is producing the requested evidence packages on API security posture and AI threat preparedness. Failure to respond adequately during the current review cycle could delay approvals for new products or partnerships that rely on open banking connections.