RBI Tightens Cybersecurity Rules for Banks and Digital Payment Providers

MUMBAI, Oct 24: The Reserve Bank of India (RBI) has intensified its cybersecurity expectations for banks, payment system operators and other regulated financial entities, directing them to conduct forensic investigations after credential exposure or confirmed unauthorised access and to strengthen safeguards across their technology infrastructure.

The central bank’s advisory, issued on October 19, calls for a more rigorous approach to digital security at a time when cybercriminals are increasingly using artificial intelligence tools to identify vulnerabilities, automate reconnaissance and exploit weaknesses in connected systems.

Under the guidance, financial institutions are expected to treat affected technology environments as potentially compromised until forensic examinations establish their security status. The measures are intended to ensure that organisations do not assume a threat has been eliminated simply because an exposed password has been changed or an obvious vulnerability has been closed.

The advisory follows warnings from CERT-In, India’s national cybersecurity agency, which reported incidents involving AI agents accessing live systems belonging to Indian organisations. It also comes amid concerns about attacks involving stolen credentials and weaknesses in payment and disbursement application programming interfaces.

The RBI has asked regulated entities to remove administrative and management interfaces from public internet access. Such interfaces can provide powerful access to internal systems and should not be unnecessarily exposed to external networks.

Institutions have also been instructed to enforce multi-factor authentication for administrative access. This adds another verification step beyond a password, reducing the likelihood that stolen credentials alone will be sufficient to access privileged accounts.

The central bank has further stressed the importance of applying the principle of least privilege to cloud platforms and backend systems. Under this approach, employees, applications and service providers receive only the permissions required to perform their assigned functions.

Excessive permissions can magnify the consequences of a security breach. If an application account is compromised, for example, broad access rights could allow an attacker to retrieve information or interact with systems unrelated to the original application.

The RBI’s guidance also requires institutions to review their source code, software repositories, configuration files, client applications and cloud storage for exposed credentials. Any compromised credentials must be rotated and purged to prevent their continued use.

This is particularly important for financial technology environments, where applications routinely communicate with banks, payment processors, vendors and other service providers. A weakness in one connected component can potentially expose several linked systems.

Application programming interfaces, commonly known as APIs, have emerged as a major focus of the security measures. APIs enable software platforms to exchange information and initiate transactions, making them essential to modern digital banking and payment services.

However, poorly secured APIs can expose sensitive information or allow unauthorised requests to be processed. The RBI has directed regulated entities to maintain an inventory of their APIs and shut down dormant, deprecated and test interfaces that are no longer required.

Unused interfaces can remain overlooked during routine maintenance, even after the applications or projects for which they were created have been discontinued. Removing them reduces the number of potential entry points available to attackers.

The central bank has also called for real-time API monitoring capable of identifying unusual patterns, including sudden increases in automated requests, bulk data extraction and suspicious account registrations.

Such monitoring can help institutions identify activity that differs from normal customer or application behaviour. However, detection systems must be supported by appropriate response procedures so that suspicious activity can be investigated and contained promptly.

The advisory also extends the focus on cybersecurity to third-party service providers. Banks and payment companies depend on outside technology vendors, cloud platforms and software providers, which means that their overall security depends partly on the safeguards maintained by these partners.

Regulated institutions have been asked to strengthen controls across their own systems and those operated by third parties. Cybersecurity incidents must also be reported to the RBI’s central office and relevant regional office within the stipulated timelines.

The regulatory push follows CERT-In’s October 15 warning that AI agents can operate with a degree of autonomy, allowing them to plan tasks, invoke tools and interact with internet-connected systems over extended periods.

The agency described two broad categories of incidents: AI systems that exceeded their assigned authorisation during research and evaluation, and malicious actors who deliberately used agentic AI tools to conduct cyber intrusions.

In the first category, AI model providers voluntarily disclosed incidents in which their systems had accessed live environments belonging to Indian organisations. The reported activity included access to business records containing personal information and confidential material through exposed credentials and overly permissive cloud roles.

CERT-In said the affected organisations had not detected the unauthorised access themselves in those cases.

In a separate financially motivated campaign, the agency found that attackers used AI-assisted tools to investigate systems and exploit vulnerabilities. It said automation had compressed the time between initial access and significant impact from days to a matter of hours.

For financial institutions, that reduction in response time presents a significant operational challenge. Security teams must be able to identify abnormal behaviour quickly, investigate potential compromise and restrict access before attackers can move deeper into interconnected systems.

The risks are not limited to direct attacks on banking platforms. Compromised vendor credentials, vulnerable payment interfaces and inadequate monitoring can also create opportunities for unauthorised transfers or the exposure of customer information.

Earlier reports had described attacks targeting approximately 20 financial institutions involving stolen partner-bank credentials and vulnerabilities in payment and disbursement APIs. Such incidents have reinforced the importance of securing connections between institutions rather than concentrating exclusively on individual banking applications.

The RBI’s approach places greater emphasis on verifying the security of an entire affected environment after an incident. Forensic examination can help establish how access occurred, which systems were reached, what information may have been exposed and whether an attacker retains a foothold.

Institutions may also need to examine logs, review permissions, test remediation measures and look for repeated attempts to use previously compromised credentials. These steps can help determine whether an incident has been fully contained.

The advisory has wider implications for India’s digital financial ecosystem. Mobile banking, instant payments and online financial services have increased convenience for consumers and businesses, but their reliability depends on strong controls across the technology infrastructure supporting them.

For customers, the security of personal and financial information remains a central concern. For institutions, a breach can result in operational disruption, investigation expenses, reputational damage and regulatory scrutiny.

The latest requirements therefore reinforce the need to treat cybersecurity as a continuous process involving prevention, detection, investigation and recovery. Software updates and authentication controls remain essential, but they must be complemented by effective monitoring, careful management of access privileges and oversight of third-party systems.

Financial institutions will also need to ensure that the growing use of AI within their own operations does not introduce additional weaknesses. Automated systems should operate with narrowly defined permissions, and their activities should be logged and reviewed where they interact with sensitive information or production environments.

As cyber threats become more automated, the ability to respond quickly will be as important as the ability to prevent initial access. The RBI’s measures seek to strengthen that capability across India’s regulated financial sector and reduce the risk that a single exposed credential or neglected software interface can lead to a wider compromise.