RBI deputy governor sets out ten-point technology and cyber risk framework
A speech by RBI Deputy Governor Rohit Jain lays out how the central bank views technology, cybersecurity and AI risk in Indian banking, citing UPI's scale and a list of past incidents to justify ten specific supervisory priorities for institutions to adopt now.
- UPI processed 24.9 billion transactions valued at approximately ₹30.15 lakh crore in August 2026, equivalent to nearly 79 crore transactions daily.
- UPI's transaction volume has increased nearly 13,000-fold over the past decade, processing 24,162 crore transactions during FY 2025-26.
- Jain set out ten key requirements for technology and cyber risk management, covering governance translation into outcomes, visibility, legacy vulnerabilities, identity and access, control effectiveness, pace alignment, third-party dependency, post-incident learning, recovery testing and architecture constraints.
- The speech states that technology may be outsourced but accountability may not, requiring banks to retain understanding of access controls, concentration, recoverability, data protection and exit options for external providers.
- Past incidents cited as lessons include the 2018 cyberattack on a cooperative bank involving SWIFT network misuse, the 2017 Equifax data breach, and the 2024 CrowdStrike software outage.