RBI flags AI cyber threats as top bank risk in 2026

AI shifts from efficiency tool to stability risk

Artificial intelligence is no longer being discussed only as a tool to improve banking productivity. In its June 2026 Financial Stability Report (FSR), the Reserve Bank of India (RBI) warned that AI-powered cyberattacks and wider technology risks could create fresh challenges for the financial system. The central bank also flagged the risks that can arise from dependence on common AI platforms. The message is that the same technologies helping institutions scale digital services can also expand the attack surface for malicious actors. For banks and non-banking financial companies (NBFCs), the shift matters because cyber incidents can quickly become operational disruptions. The RBI’s focus positions cyber resilience as a financial stability issue, not just an IT control topic. It also indicates that supervisory expectations are evolving alongside the threat landscape.

What the June 2026 FSR highlighted

The RBI identified AI-enabled cyber threats as the most significant emerging risk facing banks, NBFCs and other financial institutions. The report noted that rapid digitalisation is widening the range of systems exposed to cyber risks. According to the RBI, such incidents can lead to service disruptions, data breaches and payment system outages that may undermine public trust. The FSR also framed AI as a driver of increasing sophistication, speed and scale of cyberattacks. In parallel, the central bank warned that the global AI investment boom could create broader financial stability concerns. The concern is not limited to one type of institution, because digital financial services are increasingly interconnected. The RBI’s emphasis suggests that technology concentration and shared dependencies are becoming central to risk assessments.

Survey findings: lenders put AI-enabled attacks at No. 1

A key input into the RBI’s assessment was a survey of 33 scheduled commercial banks and 10 upper layer NBFCs. When asked to identify the biggest cyber risks over the next 12 months, respondents ranked AI-enabled cyber threats above ransomware, malware, phishing attacks, third-party supply-chain risks and application vulnerabilities. The results show that institutions expect cyber threats to evolve in capability, not just frequency. The ranking also suggests that boards and risk teams are increasingly viewing AI as a force multiplier for attackers. Importantly, the RBI’s report indicated that preparedness across institutions remains uneven, even as many begin integrating AI-related risks into their cybersecurity frameworks. That unevenness raises the stakes for sector-wide resilience, because weak links can create contagion-like effects through shared infrastructure and dependencies.

The risk ranking, with percentages

The RBI provided a breakdown of how respondents prioritised risks. Nearly all participants placed AI-enabled threats among their top concerns for the coming year. The same survey showed that more traditional categories, while still relevant, ranked meaningfully lower. This gap highlights why the regulator is elevating the issue in its financial stability narrative.

Why AI-enabled threats change incident dynamics

The RBI’s framing focuses on how AI can increase the sophistication, speed and scale of attacks. That is a different risk profile from many conventional cyber incidents, which often depend on human-led reconnaissance and slower iteration cycles. The concern is also tied to the growing digital and interconnected nature of the financial system, where outages can affect payment rails and customer access at short notice. The RBI’s report connects these outcomes directly to trust and stability. Separately, sector commentary referenced the idea that traditional threats moved at human speed, while AI-enabled threats can operate at machine speed. Even without assuming specific tactics, the implication is that response time and governance become critical. The RBI’s emphasis also indicates that institutions must review controls for both technology and operations, not only perimeter security.

Frontier AI models and the RBI’s specific focus

The RBI’s discussion includes references to advanced AI models, including Anthropic’s Claude Mythos, in the context of emerging cyber risks. The report described AI-enabled cyberattacks as the “most important near-term challenge” for banks from a cyber-threat perspective. This is notable because it links model capability to potential changes in attacker effectiveness. The broader point is that new AI systems may compress the window between vulnerability discovery and exploitation. That dynamic makes routine control areas like testing, monitoring and incident response more time-sensitive. It also raises questions about how banks assess exposure when AI tools and platforms are used across vendors and third parties.

Compliance action: gap assessment and June 30, 2026 deadline

Beyond risk identification, the RBI has asked banks and regulated entities to complete a board-approved assessment of risks arising from advanced AI models by the end of June. Regulated entities have also been directed to submit mitigation plans by June 30, 2026, as referenced in sector coverage of the central bank’s actions. The expectation includes identifying vulnerabilities and strengthening cybersecurity frameworks. The RBI also pointed to the need for adversarial testing and stronger governance frameworks in the face of AI-enabled threats. The requirement for board approval signals that the regulator wants accountability at the highest level. A time-bound action plan also indicates that the RBI expects measurable implementation, not only policy updates.

FY27 agenda: cyber mapping for NBFCs and stress-test review

The RBI has also indicated that it will make a significant push into AI and cybersecurity frameworks for banks and financial institutions in FY27, or fiscal 2026-27. The central bank outlined a proactive financial stability agenda focused on early risk detection linked to AI in banking systems, customer protection, and credit strengthening. For NBFCs, the RBI plans to conduct a comprehensive cyber mapping exercise. It also plans to review existing risk stress-testing norms to ensure institutional resilience. These measures align with the FSR’s message that cyber risk is now a system-level concern. The stated direction suggests closer supervisory attention on how firms identify, measure and mitigate technology risk.

Market impact: what changes for banks, NBFCs, and investors

The RBI’s findings and directives raise the compliance and governance burden across the sector, particularly for institutions with fast-growing digital footprints. Operationally, the focus on AI-enabled cyber risks underscores the potential for service disruptions, data breaches, and payment system outages to become core risk events. For investors and stakeholders, the key issue is the ability of institutions to demonstrate strong cyber resilience, especially when preparedness is described as uneven. The survey results also point to a reprioritisation of cyber budgets and risk management attention toward AI-related attack scenarios. At the system level, the RBI’s warning about dependence on common AI platforms highlights concentration risks that may not be visible in single-firm assessments. The mention of broader financial stability concerns tied to the global AI investment boom adds a macro overlay that market participants may track alongside institution-specific controls. Overall, the RBI’s messaging makes it clear that technology risk is becoming more tightly linked to supervision and stability.

Conclusion

The RBI’s June 2026 FSR places AI-enabled cyber threats at the centre of financial stability concerns, backed by survey results from banks and upper layer NBFCs that ranked these threats as the top risk over the next 12 months. The regulator has also asked regulated entities to complete a board-approved gap assessment and submit mitigation plans by June 30, 2026. With the RBI signalling a broader FY27 push on AI and cybersecurity, including cyber mapping for NBFCs and a review of stress-testing norms, the next set of updates will likely come through supervisory follow-ups and implementation milestones.