RBI Orders Mandatory Forensic Audits as Banks Face Rising Threat of AI-Assisted Cyberattacks — October 24, 2026

The Reserve Bank of India (RBI) has issued strict directives instructing commercial banks, payment system operators, and non-banking financial companies (NBFCs) to implement exhaustive forensic system audits following any confirmed unauthorised access or exposure of credentials. Under the central bank's enhanced supervisory posture, regulated entities must assume their technology environments are compromised until comprehensive forensic checks definitively confirm they are clean and secure.

The regulatory intervention follows an advisory issued by the Indian Computer Emergency Response Team (CERT-In), which warned of cybercriminals deploying autonomous artificial intelligence agents to target financial infrastructure. According to CERT-In, AI-driven automation has compressed the timeline between initial unauthorized access and network breach execution from several days to just a few hours, enabling simultaneous multi-agent reconnaissance and vulnerability exploitation without human intervention.

Speaking at the NDTV World Summit, RBI Governor Sanjay Malhotra underscored that the central bank and lenders remain on high alert against emerging risks stemming from rogue AI agents. Highlighting global precedents where third-party AI tools breached customer accounts and exfiltrated sensitive data abroad, the Governor affirmed that Indian authorities are continuously collaborating with financial institutions to identify and patch system flaws before threat actors exploit them.

Key Protocols Mandated by the RBI:

• Forensic Verification: Regulated entities experiencing data breaches or leaked credentials must initiate external forensic investigations across source code repositories, configuration files, cloud buckets, and client-facing applications.
• Access Control Lockdown: Financial institutions must instantly purge and rotate compromised credentials, enforce strict multi-factor authentication (MFA) across all administrative portals, and strip public internet access from management interfaces.
• API Inventory & Pruning: Institutions are required to catalog all Application Programming Interfaces (APIs), monitor them in real time for suspicious payloads, and decommission dormant, test, and deprecated APIs.
• Principle of Least Privilege: Cloud and backend architectures must restrict internal user and administrative access solely to essential operational tasks.

The heightened regulatory scrutiny comes against the backdrop of recent cybersecurity incidents affecting domestic financial institutions. State Bank of India (SBI) acknowledged the suspected exposure of 3,897 customer records containing personally identifiable information on the dark web. In parallel, industry reports revealed that around 20 financial institutions were recently targeted in attacks exploiting compromised partner-bank credentials and vulnerable disbursement APIs to execute unauthorized transactions.

Market Impact and Outlook

For institutional and retail investors tracking the Nifty Bank and Nifty Financial Services indices, the RBI's stringent cyber audit guidelines signal an acceleration in technology expenditure across the banking sector. While elevated IT capital expenditures could moderately trim short-term operating margins for mid-tier lenders and fintechs, mitigating operational disruption and systemic reputational damage remains paramount.

The central bank emphasized that regulatory and supervisory teams will maintain ongoing scrutiny of banking software lifecycles. Lenders that fail to report incidents within prescribed timelines or demonstrate gaps in their forensic recovery protocols face regulatory penalties and potential restrictions on digital onboarding.

Tags: Reserve Bank of India State Bank of India Banking Sector CERT-In FinTech Nifty Bank