India’s central bank has ordered banks and payment firms to assume breached environments are compromised, tighten access controls and remove exposed credentials as autonomous AI tools accelerate cyberattacks.
India’s central bank has moved to harden the financial system against a wave of AI-assisted cyberattacks, warning banks and payment firms that any environment exposed by leaked credentials or an intruder must be treated as compromised until a full forensic review proves otherwise. According to reporting from TV9 Hindi, the Reserve Bank of India issued the directive on 19 October after a series of warnings from the country’s cyber defence agencies about the speed and scale at which autonomous AI tools are being used to probe and penetrate corporate networks. KPMG’s summary of the RBI’s April and June 2026 advisories shows the bank has been building a broader response to AI-accelerated cyber threats for months.
The concern is not merely theoretical. CERT-In warned on 15 October that criminals are increasingly using autonomous AI systems to search for weaknesses, execute commands and exploit them without human intervention. Business Standard reported in June that the RBI had already told regulated entities to assess the cyber risks posed by advanced AI models and produce mitigation plans by the end of that month. Together, those warnings suggest the central bank sees AI not as a future hazard but as an active tool already shortening the time between intrusion and theft from days to hours, especially in attacks aimed at financial institutions and their payment rails.
The advisory, as described by TV9 Hindi, sets out a series of immediate controls that banks, payment system operators and other regulated firms must put in place. Administrative interfaces should be removed from the public internet, privileged access must be protected with multi-factor authentication, and cloud and back-end access should be limited to only those who genuinely need it. Firms are also expected to audit source code, repositories, configuration files, client applications and cloud storage to find leaked passwords, then replace or delete any exposed credentials without delay.
The RBI is also pressing firms to clean up ageing infrastructure that may offer attackers an easy way in. Institutions must build a complete inventory of application programming interfaces, or APIs, and shut down those that are unused, obsolete or left over from testing. That matters because APIs increasingly connect banking systems to apps, partners and payment services, making them a prime target when security controls are weak or credentials have been stolen. The central bank has also asked firms to watch for unusual automated request volumes, large-scale data extraction and suspicious account registrations in real time.
The latest advice fits into a wider regulatory push this year. In July, according to compliedAI summaries of RBI directions, the central bank issued separate cybersecurity and digital-payment control frameworks for payments banks and urban co-operative banks, laying out broader expectations on governance, resilience, audit and board-approved security policies. The newer warning builds on that foundation by treating AI-enabled attacks as a direct operational threat, and by insisting that firms report incidents to the RBI’s central office and relevant regional office within the required time frame, while also complying fully with CERT-In’s guidance.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
