The Reserve Bank of India has issued comprehensive cybersecurity advisory on October 19, directing banks, payment system operators and other financial entities to treat their technology environments as compromised until forensically cleared following any exposure of credentials or confirmed unauthorized access. According to The Economic Times, the advisory comes shortly after the Indian Computer Emergency Response Team (CERT-In) warned about the growing use of artificial intelligence agents to carry out cyberattacks. The RBI has mandated that financial entities strengthen cybersecurity controls across their own systems and those of third-party service providers, with entities required to report such incidents to its central office and the relevant regional office within the stipulated timeline. RBI Governor Sanjay Malhotra confirmed at the NDTV World Summit that the central bank and other banks are alert about emerging cyber risks posed by artificial intelligence agents and are taking measures to identify and plug vulnerabilities in their IT systems.
Under the new framework, financial entities must remove management and administrative interfaces from public internet access, enforce multi-factor authentication for administrative access, and restrict access to cloud and backend systems on a least-privilege basis. As reported by The Economic Times, the measures include auditing source code, repositories, configuration files, client applications and cloud storage for exposed credentials, and immediately rotating and purging compromised credentials. Entities have been directed to maintain an inventory of application programming interfaces (APIs) and shut down dormant, deprecated and test APIs and accounts. The RBI has also asked regulated entities to strengthen real-time monitoring of APIs, including systems capable of detecting sudden bursts of automated requests, bulk data extraction and suspicious account registrations. Malhotra emphasized that the focus is on two key areas - data security and protection against cyberattacks that could disrupt banking systems and cause downtime.
The advisory follows a CERT-In report issued on October 15, which highlighted a dangerous shift toward AI-enabled cyber threats targeting India's financial sector. According to the response team, threat actors are deploying multiple autonomous AI agents simultaneously to handle reconnaissance, exploit vulnerabilities, and execute malicious commands with minimal human oversight. As reported by The Economic Times, CERT-In warned that these AI tools have drastically reduced the attack lifecycle, shrinking the window between initial access and major financial damage from several days to mere hours. The warnings come as roughly 20 financial institutions were targeted in attacks involving stolen partner-bank credentials and exploited payment/disbursement APIs used in attempts to divert funds. The RBI's strict directive represents a response to these emerging threats that require immediate action and continuous monitoring.
The Reserve Bank of India (Commercial Banks – Responsible Business Conduct) Third Amendment Directions, 2026 will take effect on January 1, 2027, significantly expanding customer protection in online fraud cases. According to reports from Mint, the new framework widens the reporting window for zero liability to five calendar days and covers fraudulent transactions generally, including credential theft and coercion. The burden of proof shifts to banks, which must now establish the customer's liability, while resolution deadlines are set at 45 days for domestic and 60 days for cross-border cases.
Under the existing framework dating to 2017, customers have zero liability in two situations: when fraud arises from bank negligence or when third-party breaches are reported within three working days. As reported by Mint, customers must report fraud within seven working days for liability capped between ₹5,000 and ₹25,000 depending on account type. The 2026 directions expand coverage beyond unauthorized transactions to fraudulent ones generally, with compensation for small-value frauds set at 85% of loss or ₹25,000, whichever is lower.
