Reserve Bank of India mandates security audits amid rise in AI-driven cyber threats
The Reserve Bank of India has issued new security mandates for banks and financial institutions to counter the growing threat of AI-assisted cyberattacks on API-based payment infrastructure.
The Reserve Bank of India (RBI) has introduced stringent security requirements for the banking sector following a series of AI-driven cyberattacks. In a recent directive, the central bank mandated that financial institutions perform rigorous security audits on all application programming interfaces (APIs) used to process fund transfers.
The regulatory move follows a confidential advisory issued to banks, requiring them to conduct audits through agencies empaneled by the Computer Emergency Response Team (CERT-In). Banks must now maintain a comprehensive inventory of their API clients, including detailed technical and security profiles. Furthermore, the RBI has ordered the implementation of enhanced monitoring frameworks capable of detecting material deviations in transaction behavior, such as spikes in volume or suspicious API requests.
Cybersecurity agencies have noted that threat actors are increasingly using AI to test fund flow vulnerabilities and bypass IP allow-listing. To mitigate these risks, the RBI has instructed banks to enforce beneficiary whitelisting and adopt multi-factor authentication or 'maker-checker' approval processes for all high-risk API debit requests.
The new mandate requires existing API-based integrations to achieve compliance by late 2026, with stricter timelines for onboarding new clients. The RBI has also emphasized the need for banks to secure their own internal API infrastructure, including improved access management and network segmentation, to prevent attackers from pivoting through compromised client systems.