Science & Tech
RBI orders forensic clearance after banks face credential breaches
Banks must prove their wider systems are safe before restoring trust.
Banks must prove their wider systems are safe before restoring trust.
A stolen password can put an Indian bank’s wider technology systems under suspicion until checks show they are safe. The ’s October direction tells banks, payment firms and other regulated companies to review source code, code stores, settings, customer apps and cloud storage. They must replace and delete exposed passwords at once. They must also close unused, outdated or test and accounts, and check systems managed by vendors.
The rule builds on the RBI’s July 31 cybersecurity framework. It requires incidents to be reported to RBI through and to within six hours. Stronger login checks, narrower access and tighter vendor controls aim to protect customer data and stop repeat attacks. Deeper checks may cost more, limit services and delay recovery. Customers may face more disruption after a breach, but gain stronger proof that systems are secure.
Institutions now face a more intensive response after a breach, including broader investigation, credential replacement, access reduction, API and account shutdowns, and evidence-based clearance before normal trust is restored. Containment may require restricted services or longer recovery work, particularly where cloud systems, vendors or are involved. The intended customer-protection benefit is reduced risk of repeated unauthorised access, stronger protection of customer data and safer restoration of financial services.
The post-breach review must examine source code, repositories, configuration files, client applications and cloud storage for exposed credentials and other . Institutions must immediately rotate and purge compromised credentials rather than relying only on a password reset. They must also inventory and shut down and accounts, while closing exposed access paths and monitoring for continuing misuse.
RBI advised banks, payment system operators and other entities under its purview to treat affected technology environments as compromised until forensically cleared after credential exposure or confirmed unauthorised access. The advisory was issued on October 19, 2026, and required containment and investigation before affected systems could be considered safe.
The July 31, 2026 framework addressed application and network security, data protection, vulnerability management, third-party technology risk, , , and cyber-incident response and recovery. Related RBI digital-payment security directions separately addressed security controls for digital-payment products and services.
The directions required centralised authentication, , and stronger authentication for . They also increased scrutiny of vendor personnel who access or manage critical assets, extending security obligations beyond an institution’s own employees. These controls address the risk that compromised administrator accounts or technology providers can expose wider banking systems.
The new framework required banks to report cybersecurity incidents to RBI through the within six hours of detection, alongside applicable reporting to . It also established a formal chain from detection and notification to post-incident analysis, forensic investigation where necessary and corrective action. The requirement pushed institutions toward faster escalation and better-preserved evidence after an attack.
On July 31, 2026, the Reserve Bank of India issued entity-specific Cybersecurity, , alongside separate . The framework covered technology governance, cybersecurity, operational resilience, information-systems assurance, incident response and third-party technology risk. The directions took effect immediately for the entities covered by each respective instrument.