RBI tells banks and payment firms to treat systems as compromised after a credential exposure until forensic checks clear them

The Reserve Bank of India has asked banks, payment system operators and other regulated entities to treat their technology environment as compromised if credentials are exposed or unauthorised access is confirmed, until a forensic investigation clears it, according to reports of 23 October 2026. Kotak Neo gives the advisory date as 19 October, while The420.in says only that it followed a CERT-In warning of 15 October, so the date is uncertain. Spectate Media has not seen the RBI document and relies on these secondary reports.

What the advisory asks

Management and administrative interfaces should not be reachable from the public internet, and administrative access should use multi-factor authentication. Source code, repositories, configuration files, client applications and cloud storage should be reviewed for exposed credentials, which must be changed and removed. Access to cloud and backend systems should be limited to operational need. Entities should keep an inventory of their APIs, shut dormant, deprecated and test APIs and unneeded accounts, and monitor API activity in real time for bulk data extraction, bursts of automated requests and suspicious account registrations. Third-party providers with system or data access must follow suitable controls. Incidents must be reported to the RBI's central office and the relevant regional office within a prescribed timeline, which the reports do not state.

The background

Kotak Neo reports that CERT-In and CSIRT-Fin warned on 9 October that attackers were using stolen credentials to reach fund-transfer and disbursement APIs at NBFCs, digital lenders, fintechs, payment providers and wallet operators. On 15 October CERT-In said AI tools were being used for reconnaissance and exploitation and that the time from first access to impact had fallen from days to a few hours. SBI disclosed on 21 October that it examined about 3.75 lakh records and found 3,897 customer records with personal information. The report says there is no indication that the SBI incident alone prompted the advisory.

Key numbers

• Presumption: Systems compromised (Until forensic checks clear them)
• Admin access: Multi-factor authentication (And no public internet access)
• SBI records with personal data: 3,897 (From about 3.75 lakh examined)
• CERT-In warning: 15 October (Access to impact in hours)

What boards and CFOs should note

Three points stand out. First, the instruction to presume compromise applies from the moment of exposure, not from confirmed loss. Second, the API inventory and monitoring requirements affect fintechs and service providers as well as banks. Third, the reporting timeline needs to be confirmed from the RBI document.

Source: Kotak Neo, 23 October 2026. This is a summary of a news report, published as general information. It is not legal, tax or investment advice.