AI and Financial Cybersecurity: How RBI and SEBI Are Tightening Rules

AI and Financial Cybersecurity Latest News

• As Artificial Intelligence increasingly enables sophisticated fraud, deepfakes and attacks on critical financial infrastructure, India’s key financial regulators — the RBI and SEBI — are overhauling cybersecurity frameworks to safeguard the financial ecosystem.

The Rising Threat Landscape

• AI is transforming the nature of financial fraud. Deepfake voices are being used to bypass KYC norms, while more complex scams are infiltrating critical financial institutions. 
• Several banks have already faced cybersecurity breaches in 2026. 
• Unlike traditional threats built around identifiable vulnerabilities and periodic assessments, AI dramatically increases the speed, scale and sophistication of attacks — from automated vulnerability discovery to autonomous cyberattacks.

‹ ›

SEBI’s IT Resilience Index (ITRI)

• SEBI has introduced an IT Resilience Index for Market Infrastructure Institutions (MIIs) — entities like clearing corporations and exchanges that enable trading. 
• Key features:
  • Quantifies cyber readiness across nine parameters.
  • Availability and security: 20% weightage each.
  • Integrity, governance, reliability and monitoring, modularity and flexibility, business continuity: 10% weightage each.
  • Scalability and miscellaneous (“others”): 5% weightage each.
  • MIIs must compute ITRI half-yearly, submit comparative analysis within 60 days, and outline corrective action.
  • Framework takes effect from early 2027.
  • Includes an “early warning system” for continuous risk monitoring.

Standardised Incident Reporting: The FIRE Format

• SEBI has aligned its cyber incident reporting portal with a standardised “Format for Incident Reporting Exchange” (FIRE). 
• This enables staged reporting — from initial disclosure through intermediate updates to final closure — while accommodating incomplete information at the time of first reporting.

RBI’s Cybersecurity Framework

• The RBI released a comprehensive cybersecurity framework for banks and financial institutions, mandating:
  • Board-level ownership of cyber risks.
  • Dedicated committees to monitor IT risks.
  • A strict six-hour window for reporting cyber incidents.
  • A revised fraud compensation mechanism (June 2026) expanding victim eligibility and covering newer digital scams.

The “Kill Switch” Mechanism

• Both regulators are exploring a “kill switch”:
  • RBI: Would allow users to halt all financial transactions during fraud
  • SEBI: Evaluating a similar mechanism as part of upcoming AI guidelines

SEBI’s Forthcoming AI Guidelines

• SEBI plans to “shortly” issue guidelines for the responsible use of AI and machine learning in markets. 
• It already uses AI to flag suspicious trading patterns and has constituted a dedicated team to extend AI-based surveillance to corporate investigations, including scrutiny of quarterly filings.

Expert Recommendations

• Legal experts suggest regulators should focus on:
  • AI-specific threat modelling
  • Continuous (not periodic) testing
  • Third-party and cloud concentration risks
  • Model and data integrity
  • Deepfake-enabled fraud and supply-chain vulnerabilities
  • Clear human accountability where AI influences critical decisions
  • Technology-neutral accountability backed by technology-specific safeguards, rather than an overly prescriptive code

Conclusion

• AI has fundamentally altered the financial fraud threat matrix, prompting RBI and SEBI to modernise cybersecurity frameworks through tools like ITRI, FIRE reporting and kill-switch mechanisms. 
• Sustained regulatory agility, technology-neutral accountability and AI-enabled defensive systems remain critical to securing India’s financial infrastructure.

Source: IE