RBI mandates security audits as AI cyber-attacks surge in India

The Reserve Bank of India (RBI) has mandated security audits for banks in response to a significant increase in AI-assisted cyberattacks targeting the financial sector. This marks a notable shift in regulatory focus, as AI's role in cyber threats has grown more pronounced. The RBI, India's central bank and primary regulator for the banking sector, has convened with bankers to address the challenges posed by these sophisticated attacks. The move underscores the urgency of bolstering digital defenses in an era where AI is increasingly leveraged by malicious actors.

The rise in AI-driven cyberattacks has prompted regulatory action from multiple Indian authorities. CERT-In, the Indian Cyber Crime Coordination Centre, has documented a sharp increase in such incidents, with 223 reported cases in 2026 alone. These attacks have targeted critical financial infrastructure, including payment gateways and customer data systems. The RBI's involvement signals a coordinated response between the central bank and cybersecurity agencies to mitigate the risks associated with AI-powered threats.

According to CERT-In’s reports, 223 AI-assisted cyberattacks were recorded in 2026, a significant increase from previous years. These attacks have exploited vulnerabilities in banking systems, particularly in APIs used for customer verification and transaction processing. The RBI has now mandated that all banks conduct regular security audits to identify and address these vulnerabilities. The audits will focus on AI-related risks, including unauthorized access and data breaches.

Indian financial institutions are now required to comply with the RBI’s new AI security auditing guidelines, which are expected to have a profound impact on the sector. Banks will need to invest in enhanced cybersecurity measures and AI monitoring tools to meet these requirements. The guidelines also emphasize the need for continuous monitoring and updates to security protocols. This shift is likely to increase operational costs for banks but may also lead to improved resilience against AI-driven cyber threats.

As the RBI’s mandate takes effect, Indian banks and financial institutions are adapting to the new regulatory landscape. The guidelines are part of a broader effort by the Ministry of Electronics and Information Technology and the Ministry of Home Affairs to strengthen national cybersecurity. While the immediate focus is on compliance, the long-term implications include a potential transformation in how financial institutions approach AI and cybersecurity. This evolving situation will continue to be monitored as the impact of these measures becomes clearer.