The Reserve Bank of India took a decisive step in H1 2026: for the first time, it issued advisories addressed specifically to AI-driven cyber threats — not AI cyber risk as a subcategory of general operational risk, but as the primary subject. The April 27, 2026 advisory to commercial banks (formally titled "AI-Accelerated Cyber Threats and Resilience Strategies" — AI-ACT&RS) was followed by a June 1, 2026 extension to Non-Bank Payment System Operators (NBPSOs). Within weeks of the second advisory, the RBI Financial Stability Report (June 2026) named AI-driven cyberattacks as the single most significant emerging financial stability threat to the Indian financial system. That designation — the first of its kind in FSR history — signals that AI-specific cyber risk is now a systemic concern, not just an operational one.
For India's banks, NBFCs, and payment system participants, these instruments create a new compliance obligation that sits at the intersection of three existing frameworks: the AI-ACT&RS advisory itself, the RBI Model Risk Management Framework (MRMF, June 2026), and the CERT-In AI Cybersecurity Blueprint (May 2026). Understanding where they overlap — and where a single program can satisfy all three — is the practical question compliance teams must answer before the 2026–27 examination cycle.
Two Advisories, One Message
The April 27 and June 1, 2026 Advisories
RBI issued two AI-specific cyber threat instruments in the first half of 2026:
- Advisory to Commercial Banks (April 27, 2026): AI-Accelerated Cyber Threats and Resilience Strategies (AI-ACT&RS) — addressed to all scheduled commercial banks, primary (urban) cooperative banks, and state and central cooperative banks. The advisory identifies five AI-specific cyber threat categories and calls on banks to assess their resilience against each and implement AI-specific defensive controls.
- Advisory to NBPSOs (June 1, 2026): A parallel instrument extending substantially similar obligations to Non-Bank Payment System Operators — UPI operators, payment aggregators, PPI issuers, and other entities licensed under RBI's Payment and Settlement Systems Act jurisdiction. The NBPSO advisory adds specific provisions for payment AI systems and deepfake KYC bypass threats in digital onboarding.
The FSR June 2026 designation of AI-driven cyberattacks as the #1 emerging financial stability threat carries its own weight beyond the advisory text. It signals that RBI's supervisory attention in 2026–27 examination cycles will include AI-ACT&RS controls as a priority assessment area — even in the absence of a hard compliance deadline in the advisory itself.
What the AI-ACT&RS Advisory Covers
Five AI-Specific Cyber Threat Categories
The April 2026 advisory organises the threat landscape into five categories that distinguish AI-enabled attacks from conventional cyber threats:
| Threat Category | What it means in practice | Bank AI systems at risk |
|---|---|---|
| AI-enhanced phishing and social engineering | Deepfake voice replication, synthetic email generation, AI-assisted spear phishing with personalisation drawn from data aggregation — far more convincing than traditional phishing | Authentication systems, video KYC platforms, customer-facing AI chatbots, treasury dealing desk communications |
| AI-powered malware and ransomware | Self-modifying, evasion-aware malware that adapts its behaviour to avoid detection by signature-based and behavioural security tools | Core banking systems, AI inference infrastructure, model serving endpoints, data pipelines feeding AI systems |
| Autonomous cyberattacks | AI agents conducting multi-stage attacks — reconnaissance, lateral movement, privilege escalation, exploitation — without human direction at each step; attack velocity and scale beyond human-operated equivalents | Bank network perimeters, API gateways, internal AI orchestration systems, inter-bank settlement infrastructure |
| AI-driven credential attacks | AI-assisted brute force, credential stuffing with statistical optimisation for banking authentication patterns, AI-generated OTP interception workflows | Mobile banking authentication, net banking login, internal privileged access systems, API authentication for AI pipelines |
| Adversarial attacks on bank AI systems | Model evasion (crafting inputs that bypass fraud detection without triggering alerts) and data poisoning (corrupting training data to degrade model performance over time) | Fraud detection models, credit scoring AI, AML transaction monitoring, underwriting AI — any production AI system that makes or influences material decisions |
The fifth category — adversarial attacks on bank AI systems — is the most structurally significant from a governance standpoint. It places bank-deployed AI systems explicitly in the threat surface, not just as tools that might be misused, but as primary attack targets. A fraud detection model that can be reverse-engineered by a fraudster to craft evasion inputs, or a credit scoring model whose training data can be poisoned through a supply chain compromise, are now explicitly in-scope threats that banks are expected to build defences against.
MRMF and CERT-In Blueprint Intersection
Three-Framework Convergence
Banks navigating AI-ACT&RS compliance face a three-framework convergence that, if managed well, can be resolved through a single integrated program:
- RBI AI-ACT&RS Advisory (April 2026): AI as attacker, and bank AI systems as targets requiring resilience controls
- RBI MRMF (June 2026): AI model governance, adversarial testing requirements, and the mandatory kill switch provision for AI systems that influence material decisions
- CERT-In AI Cybersecurity Blueprint (May 2026): 12-hour containment mandate, AI Bill of Materials (AIBOM), mandatory adversarial testing for AI systems, and 6-hour incident reporting for AI system compromise events
The convergence point that most simplifies compliance is adversarial testing. MRMF requires it as part of model validation (testing model robustness against adversarial inputs before and during deployment). CERT-In Blueprint mandates it as an AI-specific penetration testing requirement (testing AI systems for model inversion, prompt injection, and indirect prompt injection). AI-ACT&RS requires it implicitly through the resilience obligation against the fifth threat category (adversarial attacks on bank AI systems). A single adversarial testing program, structured to cover all three frameworks' requirements, satisfies the obligation across all three instruments. Banks that build three separate programs waste significant resources; banks that build one structured program create a compliance artefact that answers supervisory questions under any of the three frameworks.
The adversarial testing obligation under MRMF (model validation), CERT-In Blueprint (AI-specific pen testing), and AI-ACT&RS (resilience against adversarial attacks on bank AI) can be satisfied by one program if it is structured to produce evidence for all three. The adversarial testing evidence package — scope, methodology, findings, remediation — should be the same document presented in each regulatory context.
NBPSO Extension (June 1, 2026)
What Payment System Operators Must Do
The June 1, 2026 extension to NBPSOs expands the scope of AI-ACT&RS obligations to the full ecosystem of non-bank entities operating payment systems under RBI's regulatory perimeter. The NBPSO advisory addresses three areas of specific concern beyond the commercial bank advisory:
- Payment AI systems explicitly in scope: Fraud detection models, transaction risk scoring, and AML monitoring AI deployed by payment system operators are explicitly designated as systems requiring AI cyber threat resilience — they are attack targets in their own right, not just general IT infrastructure.
- Deepfake KYC bypass for digital payment onboarding: The advisory directly addresses the deepfake threat to video-based KYC processes used for digital payment account onboarding. This creates an obligation for liveness detection, video KYC integrity controls, and anti-spoofing verification for NBPSO onboarding pipelines that use AI-assisted identity verification.
- NPCI UAP and DPIP intersection: The NBPSO advisory intersects with NPCI's Unified Agent Protocol (announced Global Fintech Fest, September 2026) — which enables AI agents to transact on UPI — and with RBI's Digital Payment Intelligence Platform (DPIP, August 2026). AI agents transacting on UAP are themselves AI systems that must meet AI-ACT&RS resilience standards; DPIP monitoring of agent transactions creates an additional layer of AI-specific cyber risk data flowing through the payment infrastructure.
Five Controls Indian Banks Must Build
The AI-ACT&RS Compliance Response
The advisory does not prescribe specific controls — it identifies threat categories and requires banks to assess resilience and implement defensive measures. From the five threat categories and the intersection with MRMF and CERT-In Blueprint, five specific control capabilities emerge as the minimum viable compliance response:
- AI threat intelligence programme: Traditional threat intelligence focuses on indicators of compromise — IP addresses, file hashes, signatures. AI-accelerated attacks require an additional layer: adversarial ML attack pattern intelligence. Banks must monitor the evolution of model evasion techniques, deepfake generation capabilities, and AI-assisted credential attack methods — not just IOC feeds. This is a new function that most bank security teams do not currently have. The programme does not need to be built from scratch; it can be embedded within the existing threat intelligence function with AI-specific subscriptions and internal model monitoring alert mechanisms.
- Adversarial robustness testing: Scheduled red-teaming of fraud detection, credit scoring, AML, and other production AI systems against model evasion and data poisoning attack scenarios. The testing programme must cover both white-box testing (where the tester has knowledge of model architecture) and black-box testing (simulating an external attacker who can only observe model outputs). Results must be documented as evidence for MRMF model validation, CERT-In Blueprint adversarial testing, and AI-ACT&RS resilience assessment. Frequency: at minimum, before each significant model change and annually for stable models, with trigger-based testing if the threat intelligence programme detects relevant new attack techniques.
- AI-specific incident response playbook: The existing cyber incident response playbook must be extended with a dedicated AI system compromise playbook. Scenarios that require distinct procedures include: model poisoning detected (who decides to take the model offline, what is the fallback decision process, how is the poisoned training data identified and quarantined); inference-time attack confirmed (evasion pattern detected in live transaction data, immediate model isolation vs. continued operation with enhanced monitoring); AIBOM integrity compromise (third-party AI component in CERT-In Blueprint scope found to be modified). The playbook must name the CERT-In 6-hour reporting trigger condition for AI system compromise — a model poisoning event or confirmed inference-time attack is a cyber security incident under CERT-In's mandatory reporting requirements.
- Deepfake detection for authentication: Liveness detection upgrades for video KYC, anti-spoofing controls for voice authentication, and synthetic media detection for document and identity verification. The RBI V-CIP guidelines already require liveness detection — AI-ACT&RS requires that liveness detection itself be robustly tested against AI-generated synthetic video and voice. Banks that passed V-CIP certification with first-generation liveness detection may need to upgrade detection capabilities as generative AI deepfake quality improves. FATF's January 2026 Horizon Scan on AI and Deepfakes identified deepfake KYC bypass as a primary 2026 financial crime risk — the AI-ACT&RS advisory creates a parallel regulatory obligation to act on the same threat.
- AI system isolation and kill switch: The AI-ACT&RS resilience requirement for autonomous cyberattacks and adversarial attacks on AI systems overlaps directly with the MRMF kill switch provision — the requirement for a tested mechanism to isolate or shut down an AI system that is behaving anomalously or has been compromised. The kill switch must be: automated (not requiring manual chain-of-command approval that introduces delay while an attack is in progress); tested (MRMF requires evidence of a tested kill switch, CERT-In Blueprint requires tested containment); and linked to DPIP monitoring triggers (for payment AI systems, DPIP anomaly signals should be a trigger condition for isolation consideration). The isolation procedure must include a fallback operating mode — a bank cannot isolate its primary fraud detection model without having a fallback scoring mechanism, manual review escalation path, or rule-based substitute ready to activate.
Compliance Timeline and Examination Implications
No Deadline, High Supervisory Priority
The AI-ACT&RS advisory contains no explicit compliance deadline. This is consistent with RBI's advisory instrument format — advisories are guidance instruments, not Master Directions, and do not carry the same immediate enforcement timeline. However, the FSR's designation of AI-driven cyberattacks as the #1 emerging financial stability threat for 2026 signals that these controls will feature in the 2026–27 examination cycle as priority assessment areas. Banks that wait for a formal circular with a deadline before beginning implementation are likely to face examination observations during the cycle before that circular arrives.
The examination implications are compounded by a specific MRMF intersection: banks whose AI cyber controls degrade the data quality of DAKSH submissions — for example, if a model poisoning event corrupts the outputs of an AI pipeline feeding regulatory returns — face compound supervisory risk. A DAKSH anomaly flag (which degrades the Supervisory Data Quality Index score) coinciding with an AI-ACT&RS non-compliance signal in the same examination creates a significantly more adverse supervisory observation than either in isolation. The convergence between DAKSH data quality obligations and AI-ACT&RS resilience requirements means that a bank's AI cyber governance posture is not just a security function matter — it directly affects the supervisory data quality profile that DAKSH continuously monitors.
Frequently Asked Questions
More India AI compliance guides
CERT-In AI Cybersecurity Blueprint 2026: Banking Compliance
12-hour containment mandate, AIBOM requirements, adversarial testing obligations, and the CERT-In and RBI MRMF convergence for Indian banks.
Read →RBI eMRM: independent validation and tier classification
Independent validation requirements, tier classification, and third-party AI model governance under MRMF.
Read →RBI DAKSH: AI-Powered Supervisory Monitoring Compliance
DAKSH is live and processing bank compliance data in near real-time. SDQI scores every bank's data submission — poor scores trigger escalated supervisory attention.
Read →RBI MRMF GenAI and Agentic AI Gap Analysis 2026
Six explicit GenAI provisions in MRMF — and the four extensions Indian banks must build for agentic AI not covered by the framework.
Read →Ready to build your AI-ACT&RS compliance programme?
Zytra's India compliance team will map your current AI cyber controls against AI-ACT&RS, MRMF, and CERT-In Blueprint obligations — and design the adversarial testing programme that satisfies all three frameworks with one evidence package.