An RBI cybersecurity advisory issued on October 19 directs banks, payment system operators and other regulated entities to treat their technology environments as compromised until forensically cleared after any exposure of credentials or confirmed unauthorised access, The Economic Times reported. It also calls for multi-factor authentication for administrative access, removing management interfaces from the public internet, keeping an inventory of APIs and shutting down dormant and test APIs, and real-time monitoring for bursts of automated requests and bulk data extraction.
Why it matters: The advisory followed a CERT-In warning that attackers are using autonomous AI agents, which in one campaign against Indian entities cut the time from initial access to final impact from days to a few hours. For API-heavy fintechs and payment aggregators that depend on third-party providers, the API inventory and monitoring requirements are likely to mean real compliance work.
Source: The Economic Times, October 23, 2026
Related: Pine Labs and WEBXPAY bring UPI and Indian payment methods to Sri Lankan merchants
