RBI Governor Flags AI and Cyber Risks

Summary: RBI Governor Sanjay Malhotra has warned that future financial crises may originate outside banks, including through cyberattacks, geopolitical shocks or technological failures. In an October 3 address, he also identified stretched AI-related valuations, global debt, leverage and private credit as emerging risks. The RBI nevertheless assesses India’s financial system as resilient and said it sees no imminent signs of stress.

India’s banking system is currently resilient, but the sources of the next financial shock may look very different from those behind earlier crises. RBI Governor Sanjay Malhotra used his October 3 address at the Fifth Kautilya Economic Conclave to focus attention on technology, cyber dependence and interconnected global risks.

The message was not a prediction of an imminent crisis. Malhotra explicitly said the RBI does not see immediate signs of stress. His argument was that long periods of stability can encourage risk-taking, leverage and complacency, making preparation important before vulnerabilities compound.

What Happened

In an address titled “Preserving Financial Stability in an Evolving World,” the Governor identified five major global risks: elevated debt, stretched asset valuations—particularly those linked to AI—high leverage, private credit and cyber threats compounded by AI.

He said a future crisis could begin with a geopolitical event, cyberattack or technological failure and then spread into finance through several channels. The RBI transcript also warns that AI raises model risk, dependence on third parties and concerns about weakened human oversight and accountability.

Malhotra said individual risks may not be alarming on their own, but their simultaneous occurrence could pressure the global financial architecture. Financial Express and Indian Express independently reported the speech and its warning against complacency.

Why It Matters

Financial institutions increasingly depend on cloud infrastructure, vendors, models, payment networks and cross-border technology systems. A disruption at one critical provider can therefore affect several institutions even when their own capital and liquidity remain sound.

The RBI’s focus widens the definition of financial resilience. It implies that banks and regulators must assess not only loans, market exposure and funding, but also cyber controls, model governance, technology concentration and recovery arrangements across the wider system.

Market Impact

No demonstrated share-price movement attributable specifically to the Governor’s remarks was identified. Indian exchanges were closed for the weekend, and the speech did not announce a new interest-rate decision, institution-specific enforcement action or immediate capital requirement.

The RBI did note that Indian equities had corrected from high valuations in recent months in an orderly manner. That observation describes market conditions; it should not be interpreted as a forecast or trading signal.

Industry Context

The RBI said India’s financial system remains supported by healthy bank and non-bank balance sheets. It cited June 2026 stress tests showing banks’ aggregate common-equity tier-one ratio remaining comfortable under adverse scenarios.

For non-bank finance companies, the Governor reported an average capital-to-risk weighted assets ratio of 24.6% as of March 31, 2026, compared with a 15% regulatory requirement. He said private credit in India remains small and is not currently assessed as a risk.

The speech follows other steps to refine banking oversight. BusinessNews1 recently covered the RBI’s simplified approval process for eligible institutional investors acquiring major bank shareholdings.

What To Watch Next

RBI guidance on AI model risk, red-teaming and human oversight.
Implementation of 2026 cyber-governance directions for commercial banks.
Stress-testing of third-party technology and cloud-service dependencies.
New disclosures on interconnected exposures between banks and non-banks.
The RBI’s October monetary-policy decision and its financial-stability commentary.

FAQs

Did the RBI Governor predict an imminent financial crisis?

No. Sanjay Malhotra explicitly said the RBI does not see signs of imminent stress. His warning concerned how quickly vulnerabilities can build and how future shocks may originate outside traditional banking. The speech called for vigilance, system-wide resilience, stronger data and scenario analysis rather than forecasting a specific crisis date.

Why does the RBI see AI as a financial-stability risk?

The RBI identified two broad channels. Stretched AI-related equity valuations could reprice sharply if investment or earnings slow, while AI can also increase cyber risk, model risk, dependence on external providers and loss of human oversight. These risks become more significant when institutions and markets are highly interconnected.

How strong are Indian banks and NBFCs currently?

The RBI assesses the system as resilient. Its June 2026 stress tests found banks’ aggregate CET1 ratio comfortable under adverse scenarios. The Governor also said NBFCs had an average capital adequacy ratio of 24.6% at March 31, above the 15% regulatory requirement. Those buffers do not eliminate future operational risks.

What changes does the RBI want financial institutions to make?

The speech emphasised better granular data, broader scenario analysis and resilience across banks, non-banks, markets, payment systems, technology infrastructure and critical third parties. It also highlighted model-life-cycle safeguards, explainability, red-teaming, human oversight and stronger incident-response controls as important elements of managing AI and cyber exposure.