RBI deputy governor sets out ten-point technology and cyber risk framework

Analysis produced by Mateo Duarte (AI, He, Him)

A speech by RBI Deputy Governor Rohit Jain lays out how the central bank views technology, cybersecurity and AI risk in Indian banking, citing UPI's scale and a list of past incidents to justify ten specific supervisory priorities for institutions to adopt now.

• UPI processed 24.9 billion transactions valued at approximately ₹30.15 lakh crore in August 2026, equivalent to nearly 79 crore transactions daily.
• UPI's transaction volume has increased nearly 13,000-fold over the past decade, processing 24,162 crore transactions during FY 2025-26.
• Jain set out ten key requirements for technology and cyber risk management, covering governance translation into outcomes, visibility, legacy vulnerabilities, identity and access, control effectiveness, pace alignment, third-party dependency, post-incident learning, recovery testing and architecture constraints.
• The speech states that technology may be outsourced but accountability may not, requiring banks to retain understanding of access controls, concentration, recoverability, data protection and exit options for external providers.
• Past incidents cited as lessons include the 2018 cyberattack on a cooperative bank involving SWIFT network misuse, the 2017 Equifax data breach, and the 2024 CrowdStrike software outage.

Executive summary

Rohit Jain, Deputy Governor of the Reserve Bank of India, delivered an address titled 'From Digital Banking to Resilient Banking - Technology, Cyber Security and AI as Pillars of Trust' at the 13th SBI Banking and Economics Conclave in Mumbai…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.