RBI tightens cyber checks on banks amid rising hacks, seeks details on AI risks

The Reserve Bank of India (RBI) has stepped up scrutiny of banks' cybersecurity preparedness following a spate of cyberattacks on financial institutions, seeking proof of compliance with existing rules and details of their readiness to tackle risks arising from artificial intelligence (AI), reported news agency Reuters.In a series of recent meetings, the central bank asked banks to examine vulnerabilities in their application programming interfaces (APIs), which are software links that allow banks to connect with non-bank lenders and fintech companies, three people familiar with the matter told Reuters.The RBI's increased vigilance comes at a time when banks across the world are facing cyberattacks involving increasingly sophisticated AI tools, putting customer data and funds at risk.Regulators in countries including the United States and Britain are also stepping up efforts to address AI-related risks, Reuters reported earlier this month. The RBI has already issued directives to banks on managing cybersecurity risks. However, implementation of these rules has been lagging, a consultant working with top banks told Reuters. This has prompted the central bank to push lenders to ensure stronger implementation of existing requirements.API VULNERABILITIES UNDER RBI SCANNERThe central bank's focus on APIs comes amid concerns that weaknesses in the technology connecting banks with other financial institutions could be exploited by hackers. APIs allow different financial systems to communicate and exchange information. Banks use these connections to work with fintech companies and non-bank lenders, including for services such as loan disbursals.One of the sources, a person aware of regulatory thinking, told Reuters that hackers view smaller lenders, non-bank lenders and their third-party vendors as "softer targets".The RBI has therefore asked banks to investigate potential weaknesses in these connections as part of its broader cybersecurity scrutiny.SBI DATA LEAK, NBFC FRAUD RAISE CONCERNSThe RBI's increased vigilance follows a series of cyber incidents involving Indian financial institutions in recent weeks.At State Bank of India (SBI), the country's largest lender, data belonging to 3,900 customers was leaked. The bank said last week that it was investigating the incident and had yet to determine the vulnerability, according to Reuters.In another incident, two Mumbai-based non-bank lenders lost around $2 million through more than 700 unauthorised instant transfers from accounts held with ICICI Bank on October 8 and 9.According to a police complaint reviewed by Reuters, hackers compromised the API link used to send loan disbursal instructions to ICICI Bank.The incident has brought attention to the risks associated with technology links between banks and non-bank financial institutions, particularly when these are used to facilitate financial transactions.CERT-IN WARNS OF AI-ASSISTED CYBERATTACKSIndia's cybersecurity agency CERT-In had warned in an advisory issued on October 9 that hackers were stealing banks' API credentials to move money out of lenders' own systems, possibly using AI-assisted tools.Earlier this week, the agency also conducted cybersecurity training for 300 officials from more than 55 financial institutions, CERT-In said in a post on social media platform X.The RBI's latest push to strengthen cybersecurity checks comes amid growing concerns over the ability of hackers to exploit vulnerabilities in financial infrastructure, including through third-party technology connections and AI-assisted tools.- Ends