The Reserve Bank of India's latest Financial Stability Report for June 2026 has identified AI-enabled cyber threats as the biggest near-term risk facing Indian banks and NBFCs. In a comprehensive survey of 33 scheduled commercial banks and 10 upper layer NBFCs, respondents ranked AI-enabled cyber threats as the single most significant risk they expect to face over the next 12 months, ahead of traditional threats like ransomware, phishing, and third-party supply chain vulnerabilities. This marks a fundamental shift in how India's financial sector views its threat landscape, moving away from conventional attack methods toward a future where AI itself becomes the weapon of choice for malicious actors. The concern is particularly acute given that 79% of respondents reported that more than three-fourths of their customer transactions now happen digitally, creating a massive attack surface that can disrupt services across millions of customers instantly. As per The Hindu BusinessLine, the report notes that India remains exposed to cyber attack risks, with a relatively high volume of cyberattacks compared to other emerging market economies, ranking third after Russia and Ukraine globally.
The Reserve Bank of India's latest Financial Stability Report reaffirms that Indian banks maintain strong resilience to withstand adverse scenarios while keeping capital ratios well above regulatory minimums. According to the stress test results on 46 banks, the aggregate Core Capital Ratio (CET1) may decline from 15.2% in March 2026 to 13.9% by March 2028 under the baseline scenario. However, if adverse conditions intensify due to geopolitical tensions, elevated energy prices, and exchange rate pressures, bank core capital could decrease to 11.6% in an adverse scenario and further to 11.4% by March 2028 in severely adverse conditions. As per The Economic Times, RBI Governor Sanjay Malhotra noted that "commercial banks' capital levels will continue to remain above the regulatory minimum of 8%, even under adverse stress scenarios." The aggregate GNPA ratio of 46 banks may edge up from 1.8% in March 2026 to 1.9% by March 2028 under baseline conditions, potentially rising to 3.8%-4.1% under adverse scenarios. The report flagged that exchange rate volatility could rise if oil prices increase amid lingering supply disruptions, while a sharp correction in global equity markets could spill over into domestic markets.
Despite the growing cyber threat, Indian financial institutions appear confident about their defenses, with 98% of respondents rating their current cyber risk exposure as very low to moderate. However, the survey reveals a concerning preparedness gap - nearly one-third of respondents said their perceived cyber risk had moderately or significantly increased compared to a year earlier. Investment trends show 67% of respondents reported an increase in IT and cybersecurity staffing between March 2025 and March 2026, and cybersecurity expenditure as a share of overall IT spending rose for 71% of institutions over the last three financial years. Yet 81% of respondents still reported IT expenditure of less than 5% of revenue during 2025-26, a ratio the RBI suggests should be benchmarked against international standards. Most institutions describe their AI-enabled threat readiness as being in the "developing" (45%) or "intermediate" (38%) stage, with only 5% classifying themselves as "mature" and none reaching an "advanced" stage of preparedness. As per The Hindu BusinessLine, the report cautioned that rapid advances in AI can increase the sophistication, speed and scale of cyber incidents, with survey responses indicating that AI-enabled threat preparedness is at varying stages of formalisation and implementation within existing cyber risk management frameworks.
The report highlights a critical structural vulnerability through third-party dependency, with 93% of respondents being partially or substantially dependent on external vendors for cybersecurity functions. Only 7% of institutions handle these functions mainly in-house, while 77% operate on a hybrid model and 16% rely mainly on third-party support. This operational dependence creates significant systemic risk, as three-fourths of respondents report moderate to very high operational dependence on external technology providers for critical applications. The RBI explicitly frames this as a channel through which operational risk at the vendor level can turn into systemic risk for the financial system as a whole. The report also notes that 42% of surveyed institutions said that geopolitical uncertainty has increased the likelihood of cyberattacks, reflecting a broader pattern where periods of heightened international tensions coincide with more state-affiliated cyber activity. The Hindu BusinessLine reports that third-party dependency and supply chain risk was ranked as the second most important cyber risk in the survey, with increasing reliance on outsourcing introducing supply chain risk, especially where a limited number of service providers support multiple financial institutions simultaneously.
The RBI's Financial Stability Report points to specific gaps requiring immediate attention, including cybersecurity awareness and training for employees and forensic preparedness capabilities. On the regulatory front, the Inter-Ministerial Group on the Financial Sector Cybersecurity Strategy, mandated by the Financial Stability and Development Council in August 2025, has continued deliberating on harmonising cybersecurity regulations across the financial sector. The draft strategy is now at an advanced stage, which will set governance frameworks, accountability structures, and implementation timelines for regulators. The report also addresses the broader implications of the AI investment boom, noting that AI-related investments are now permeating bond markets as hyperscalers ramp up AI infrastructure spending, potentially creating systemic risks through their debt financing requirements. As per The Hindu BusinessLine, the report emphasizes that "cyber incidents can disrupt critical financial infrastructure through service outages, data loss, and payment system interruptions, while also eroding public trust in the financial system." The rapid adoption of digital financial services in recent years has expanded the attack surface for malicious actors, contributing to a global rise in cyberattacks since 2020, making regulatory harmonisation across the financial sector crucial for maintaining operational resilience.
