When a regulator issues a directive with a specific deadline, compliance teams have a concrete obligation to respond to. RBI's June 2026 directive — issued as part of the Financial Stability Report — directed all regulated entities to conduct a frontier AI risk assessment and submit time-bound action plans by the end of June 2026. The assessment was to be anchored to CERT-In's April 2026 advisory on defending against frontier AI-driven cyber risks.
This is not a best-practice recommendation or a consultation paper. It is a directive from India's banking regulator with a documented deadline. Banks that did not complete the assessment and submit action plans face a supervisory examination finding. Banks that completed the forms but did not build the substantive governance capability face the same examination risk when the findings from those action plans are reviewed.
This post maps what "frontier AI risk assessment" means in the India BFSI context — what CERT-In's advisory requires, what MeitY's threat report documented, and what RBI examination teams will look for when they review the submitted action plans.
CERT-In April 2026 Advisory: Defining Frontier AI Threats for India BFSI
CERT-In's April 26, 2026 advisory "Defending Against Frontier AI Driven Cyber Risks" accompanied by the blueprint "Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure" defined the threat landscape that Indian financial institutions were directed to assess.
CERT-In defines "frontier AI" in this context as large-scale, general-purpose AI systems capable of performing complex tasks across multiple domains — specifically including the capability to conduct autonomous cyberattacks, generate convincing synthetic content, and automate vulnerability exploitation at scale. The advisory identifies three categories of frontier AI threat that are directly relevant to BFSI.
Category 1: AI-Augmented Cyberattacks
The first category covers attacks where AI amplifies the effectiveness of traditional attack techniques. For BFSI, the most material examples:
AI-personalized spear-phishing. Adversaries using LLMs and social media intelligence to generate highly personalized phishing emails and SMS messages that impersonate bank officers, regulatory officials, or the customer's relationship manager. The personalization quality that previously required skilled human social engineers can now be automated at scale — a thousand individually tailored messages where previously there were a thousand identical ones. Detection rates drop; conversion rates rise.
AI-accelerated vulnerability exploitation. AI tools that scan newly disclosed CVEs and automatically generate proof-of-concept exploits faster than defender patch cycles. For Indian banks running legacy core banking systems with slower patch cycles, this accelerates the window of exposure between vulnerability disclosure and remediation.
AI-automated credential stuffing. AI-optimized credential stuffing that adapts to CAPTCHA and rate-limiting defenses in real time, maintaining effectiveness against authentication systems designed to defeat traditional automated attacks.
Category 2: Deepfakes and Synthetic Media
The second category is particularly acute for India BFSI because of the regulatory mandate for digital KYC. India's Video KYC (vKYC) framework — used by thousands of account openings and loan applications daily — relies on video authentication of identity. Deepfake technology that generates real-time synthetic video of a target face creates a specific attack vector against this process.
CERT-In's advisory covers three deepfake attack patterns for BFSI:
vKYC bypass. A deepfake face overlay used during the video KYC process, impersonating a legitimate identity document holder while using fraudulent personal details. Detection of this attack requires liveness detection systems specifically trained for AI-generated video artifacts — not just motion detection, which is fooled by AI-animated still images.
CEO fraud and authorized push payment fraud. Synthetic audio impersonating senior management or board members to authorize fraudulent transactions or override controls. The combination of voice cloning (which requires as little as a few seconds of audio) with caller ID spoofing creates a highly effective fraud vector for treasury operations.
Customer impersonation for call centers. AI voice synthesis impersonating a customer calling a bank's customer service to request account changes, obtain OTPs, or initiate transfers. Call center authentication procedures designed for human callers are often inadequate against AI-generated voice impersonation.
Category 3: AI-Automated Malware
The third category covers self-modifying malicious code that uses AI to adapt to security defenses in real time. For financial sector IT environments, this includes:
- Ransomware that adapts its encryption and propagation patterns to evade detection by security tools
- Banking trojans that use AI to identify and prioritize high-value credentials, avoiding low-value targets that might trigger security alerts
- AI-powered lateral movement tools that observe network patterns to identify legitimate administrative traffic and mimic it during propagation
MeitY Digital Threat Report 2025-26: What Was Already Happening in India
The MeitY Digital Threat Report 2025-26, co-authored by CERT-In, CSIRT-Fin (India's financial sector CERT), and SISA (a financial sector cybersecurity firm), documented the state of AI-driven threats in India's financial sector. The headline finding — six of seven AI-related threat predictions from the prior year's report had already been realized — put specific incidents on record:
AI-augmented phishing incidents: CSIRT-Fin attributed a 40% increase in successful credential compromise in the banking sector to AI-personalized phishing campaigns. The campaigns used scraped LinkedIn and social media data to personalize messages at scale, with individualized references to the target's employer, manager, and recent professional activity — a personalization quality previously associated only with targeted spear-phishing by skilled operators.
Deepfake fraud in video KYC: Multiple Indian financial institutions reported deepfake-based fraud attempts against their video KYC processes. Several succeeded at institutions using first-generation liveness detection that was not calibrated for AI-generated video. The report specifically called out that liveness detection trained on human behavioral anomalies fails to detect AI video generation artifacts.
AI-generated synthetic identity documents: An increase in synthetic identity documents — AI-generated ID cards combining real biometric data with fabricated personal details — used in account opening fraud. The document generation quality had improved significantly since the prior year's report, with some synthetic documents defeating optical character recognition and document verification tools designed for detecting manual forgeries.
AI-assisted BEC (Business Email Compromise): AI-generated business emails targeting finance teams at banks and large corporate clients, with quality and contextual accuracy significantly exceeding what human-authored BEC campaigns typically achieve.
RBI June 2026 Directive: The Compliance Obligation
RBI's June 2026 FSR directive translated the CERT-In advisory and MeitY threat findings into a specific supervisory obligation. The directive required all regulated entities to:
Conduct a frontier AI risk assessment covering their specific exposure to each category of frontier AI threat. The assessment should be entity-specific — not a generic acknowledgment that these threats exist, but an assessment of whether the institution's specific systems, processes, and customer base create elevated exposure to particular attack patterns.
Submit a time-bound action plan to the respective supervisory department (RBI's Department of Regulation or Department of Supervision, depending on entity type) describing how identified risks would be mitigated and by what timeline.
Include AI-based adversarial testing in cybersecurity assurance programs — implementing CERT-In's advisory by actually testing whether defenses work against AI-generated attacks, not just documenting that they should work.
Align with CERT-In's blueprint "Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure" — meaning the action plan should map to the specific controls the blueprint recommends.
CSIRT-Fin Threat Intelligence: The Sector-Specific Layer
CSIRT-Fin operates as India's financial sector CERT, coordinating with CERT-In and providing sector-specific threat intelligence to financial entities. For AI threats, CSIRT-Fin uses a three-category classification that should be integrated into banks' threat intelligence frameworks:
AI-AS-TOOL. Adversaries using commercially available AI tools to enhance traditional attacks — AI-personalized phishing, AI-generated credential stuffing lists, AI-assisted social engineering scripts. This is the most prevalent current threat category: adversaries are not building specialized AI; they are using the same LLMs and image generation tools available to everyone, applied to attack scenarios. Defenses against AI-AS-TOOL attacks should focus on output detection (detecting AI-generated content characteristics) and contextual anomaly detection (detecting behavioral patterns inconsistent with the claimed identity).
AI-AS-WEAPON. Attacks where AI is the attack mechanism itself — adversarial inputs designed to fool security models, AI-powered fuzzing for vulnerability discovery, AI-assisted malware that adapts to defenses. Defense against AI-AS-WEAPON requires adversarial robustness testing of AI-based security systems: the fraud detection AI, the AML monitoring AI, the authentication AI — each is itself an attack surface for adversarial inputs.
AI-AS-TARGET. Attacks on the bank's own AI systems — model theft, training data poisoning, prompt injection, RAG corpus poisoning. This is the category that overlaps most directly with MRMF's security requirements. The RAG corpus poisoning, supply chain attack, and prompt injection posts in this series address AI-AS-TARGET attacks in detail.
FREE-AI Alignment: The Assurance Pillar
FREE-AI's Pillar 6 (Assurance) requires AI stress testing and security assessment as a component of responsible AI deployment. The CERT-In directive and RBI's frontier AI risk assessment requirement are operationalizations of this pillar. A bank that has implemented FREE-AI's Assurance pillar will have:
- A documented adversarial testing program that includes frontier AI attack scenarios
- Red teaming results that cover AI-augmented social engineering, deepfake detection failures, and adversarial input attacks on security AI
- Incident response procedures updated for AI-speed attack scenarios
- Staff training that covers recognition of AI-generated attacks
Banks that have implemented these elements under FREE-AI's assurance requirements are well-positioned to demonstrate compliance with the CERT-In advisory and RBI directive. Banks that have not yet implemented the assurance pillar face dual exposure: non-compliance with both the FREE-AI framework and the specific CERT-In/RBI directive.
Frontier AI Risk Assessment and Action Plan: India BFSI Checklist
- ☐ Frontier AI risk assessment completed: covers all three CERT-In categories (AI-augmented attacks, deepfakes, AI-automated malware)
- ☐ Assessment is entity-specific: exposure assessment reflects institution's specific systems, customer channels, and operational profile — not generic
- ☐ Action plan submitted to RBI supervisory department by June 2026 deadline (or documentation of status)
- ☐ Action plan maps to CERT-In blueprint: specific controls from blueprint addressed in the plan
- ☐ Deepfake detection: vKYC liveness detection tested against AI-generated video; detection system updated if first-generation; results documented
- ☐ Voice cloning detection: call center authentication procedures tested against AI voice synthesis; step-up authentication for high-risk operations documented
- ☐ AI-personalized phishing: email and SMS security controls tested against AI-generated phishing scenarios; staff training updated to address AI-quality social engineering
- ☐ Adversarial input testing: AI-based security systems (fraud detection, AML monitoring, authentication AI) tested against adversarial inputs designed to defeat them
- ☐ CSIRT-Fin registration: institution registered to receive CSIRT-Fin threat intelligence bulletins; designated point of contact for financial sector CERT coordination
- ☐ AI-AS-TARGET defenses: RAG corpus integrity controls, model theft defenses, training data poisoning monitoring — documented in governance records
- ☐ Incident response AI update: IR playbooks updated to address AI-speed attack timelines (compressed detection-to-containment window); tabletop exercise conducted for AI attack scenario
- ☐ Staff training: security awareness training updated to cover AI-augmented social engineering recognition; completion tracked
- ☐ FREE-AI Assurance pillar: adversarial testing program documented as part of FREE-AI Pillar 6 implementation
- ☐ MRMF security intersection: AI-AS-WEAPON attack scenarios included in MRMF Section 6 production monitoring risk assessment for security AI models
- ☐ Third-party AI vendor security: vendor agreements include AI-specific security incident notification SLA; vendor frontier AI risk posture assessed
- ☐ Board briefing: board or board risk committee briefed on frontier AI threat landscape and institution's response — documented in board minutes
The difference between the CERT-In/RBI directive and general AI security best practices is specificity: the directive names the threats, the assessment framework, the timeline, and the regulatory reporting obligation. Indian banks that have implemented generic AI security frameworks — firewalls, DLP, endpoint protection — have not necessarily addressed the specific threats that CERT-In identified and RBI required assessment of. The frontier AI risk assessment is not a security audit in the traditional sense; it is a targeted exercise addressing the specific attack patterns that AI has newly enabled, mapped to the specific assets and processes of an India BFSI institution.