The Reserve Bank of India (RBI) has instructed banks and payment providers to assume their entire tech system is hacked if they suffer any data breach or credential leak, remaining under that status until fully cleared by forensic experts.
This strict directive follows a warning from CERT-In about cybercriminals using advanced AI agents to launch complex attacks on India's financial sector.
Strict Forensic Protocol & System Lockdown
Under the RBI's mandatory guidelines, financial institutions must immediately initiate forensic investigations whenever a potential breach or exposure occurs. The required checks include exhaustive audits across:
Digital Infrastructure: Source code, repositories,
configuration files, client-facing applications, and cloud storage systems. Credential Protocols: Any exposed or compromised credentials must be rotated, revoked, or purged instantly to prevent unauthorized re-entry.
Access Control: All management and administrative interfaces must be immediately delisted from the public internet. Furthermore, Multi-
Factor Authentication (MFA) must be strictly enforced, and access to cloud/backend systems restricted under the "principle of least privilege."
Rigorous API & Third-Party Oversight
To address key open banking vulnerabilities, the RBI ordered entities to update their API inventories and immediately deactivate dormant, deprecated, or test APIs. Regulated institutions must now implement real-time API monitoring to detect automated threats, such as abnormal request spikes, bulk data extraction, or suspicious account creation.
Additionally, these requirements extend to third-party vendors, with strict timelines mandating prompt incident reporting to the RBI's central and regional offices.
The Rising Threat of AI-Driven Attacks
The advisory follows a CERT-In report issued on October 15, which highlighted a dangerous shift toward AI-enabled cyber threats. According to the response team, threat actors are deploying multiple autonomous AI agents simultaneously to handle reconnaissance, exploit vulnerabilities, and execute malicious commands with minimal human oversight.
CERT-In warned that these AI tools have drastically reduced the attack lifecycle, shrinking the window between initial access and major financial damage from several days to mere hours.
Response to Emerging Sector Incidents
The central bank's intervention follows recent cyber threats across India's financial sector. Prior reports indicated that roughly 20 financial institutions were targeted in attacks involving stolen partner-bank credentials and exploited payment/disbursement APIs used in attempts to divert funds.
The RBI's sweeping mandate underscores a shift toward a zero-trust model, requiring continuous real-time monitoring and rapid incident containment as cyber threats become increasingly automated.
Essential Business Intelligence, Sharp Market Insights, Practical Personal Finance Advice, Daily Fuel, Gold and Silver Prices and Latest Stories — On NDTV Profit.