RBI introduces 6-hour notification rule to enhance bank account security

One97 Communications, the parent company of Paytm, has managed to receive significant relief regarding its return to the digital wallet business sector. Its subsidiary, Paytm Payments Services Limited (PPSL), received in-principle approval from the Reserve Bank of India (RBI) to issue prepaid payment instruments (PPIs), i.e., digital wallets.

However, even after receiving this permission, customers cannot immediately start using the new wallets. The company must fulfill several mandatory conditions set by the RBI. The most crucial requirement is the submission of a system audit report within the next six months. The company announced this information on November 13. This approval was issued by the RBI in accordance with the Payment and Settlement Systems Act of 2007, paving the way for PPSL to offer not only digital wallets but also other prepaid payment instruments.

Previously, Paytm indicated in its first quarter reports for the fiscal year 2026-27 that its subsidiary had applied for a wallet license. Receiving in-principle approval from the RBI significantly boosted the company's hopes for progress in this area.

Receiving approval from the RBI does not mean that Paytm will immediately start issuing new digital wallets. Currently, the company has only been granted in-principle approval. This allows it to move forward in the process of obtaining the final license. In its letter, the RBI clearly stated that PPSL can only issue new prepaid payment instruments after receiving the Certificate of Authorisation.

Therefore, until the company fulfills all necessary conditions and obtains final approval, the launch of a new wallet service line is impossible.

To obtain final approval, the RBI set a key condition for the company: Paytm Payments Services Limited must conduct an audit of its system with the assistance of a qualified auditor. This audit must comply with RBI directives concerning the security of digital payments and the strengthening of cyber systems. Indeed, on November 5, the RBI issued instructions to non-banking payment system operators regarding cybersecurity and digital payment control measures. The company is obliged to conduct a system audit in accordance with these rules.

The RBI has given the company six months to submit the audit report. This period starts counting from the date of receiving the RBI letter issued on November 13. Consequently, PPSL must submit the system audit report to the regulator within the stipulated period. If PPSL fails to provide the report on time, the in-principle approval it received will be automatically revoked. In such a case, the RBI will not consider granting the final license, making the next six months extremely critical for Paytm.

In addition to the system audit, the RBI has established other requirements. Paytm Payments Services Limited must comply with current RBI instructions regarding the storage of data related to the payment system. Furthermore, any changes in the company's share capital or ownership require prior approval from the RBI. Compliance with these rules is also part of the process of obtaining the final license.

Artificial intelligence (AI) is transforming not only the technology and business sectors but is also becoming a new tool in the hands of cybercriminals. Due to the growing use of digital banking and online payments in the country, fraudsters have developed a new method of attack. Instead of traditional hacking, criminals are now using AI-based agents to attack the digital systems of banks, non-banking financial companies (NBFCs), and fintech platforms. These attacks allow for the exploitation of system vulnerabilities at machine speed to conduct unauthorized transactions amounting to millions of rupees.

The Indian Cyber Crime Coordination Centre (I4C), operating under the Ministry of Home Affairs, and the CERT-In agency, part of the Ministry of Electronics and Information Technology, have expressed serious concern regarding this matter. Both organizations have issued warnings to institutions related to banks, NBFCs, fintech companies, payment aggregators, and payment gateways. They indicate that cybercriminals are employing AI agents for financial gain. Cases of unauthorized large-sum operations through fund distribution systems and payment APIs have been recorded.

According to investigative agency sources, 5884 AI agents are constantly online and targeting fintech companies. This fact has heightened cybersecurity concerns. However, the official I4C warning does not mention the specific number of 5884 AI agents; the official document only confirms the threat of automated cyberattacks using AI and the risk of unauthorized transactions amounting to millions of rupees.

Data available on the AI Attacker Threat Research website identified 5884 IP addresses associated with cyberattacks. These addresses were registered based on incident reports, independent analysis, and other technical evidence. The presumed hosting network for these IP addresses is spread across 60 countries worldwide. Of the data available, 2954 are registered in Asia, and 2397 in North America. Nevertheless, this number of IP addresses cannot be directly considered the number of active AI agents.

The method of cyberattack using AI agents differs from traditional hacking. Criminals first discover weaknesses in the digital infrastructure of a bank or financial institution. Then, they attempt to exploit these vulnerabilities using AI-based tools and Agentic AI Framework. This technology allows for the automation of many stages of an attack, enabling a large number of digital operations to be conducted in a short time.

According to the threats outlined in the official warning, cybercriminals can execute such attacks in four main stages. First, they target outdated software and servers. Next come attempts to access payment APIs and fund transfer systems. Then, improperly transferred funds are directed to various accounts via mule accounts. Finally, they attempt to destroy digital evidence to evade investigation by law enforcement agencies.

Cybercriminals primarily identify software, servers, and digital platforms that have not been updated in a timely manner. The servers and IT systems of many financial institutions remain vulnerable due to incorrect configuration connected to the internet. Attackers attempt to gain unauthorized access to the system by exploiting these technical flaws. After gaining access, they may look for ways to penetrate other parts of the network.

Online interfaces created for customer complaints are also becoming targets for cybercriminals. If the security of such platforms is weak, attackers may try to gain access to the company's internal digital networks through them. Thus, even a regular external interface can pose a threat to the entire financial system. Therefore, companies must regularly check the security and configuration of all their internet-facing systems.

After gaining access to a digital system, the next target for hackers are APIs related to payments and fund transfers. APIs, or Application Programming Interfaces, are digital interfaces through which various software and systems interact. Banks and fintech companies use them to carry out payments, money transfers, and fund distribution operations. If there is a failure in the security of these APIs, it can affect financial operations.

This is where AI agents can become a dangerous weapon for cybercriminals. With the help of the Agentic AI Framework, many attack processes can be automated. This allows for the simultaneous execution of multiple actions and rapid exploitation of system vulnerabilities. Where cybercriminals previously required human intervention for each procedure, AI automation can now accelerate the attack. This leaves banks and fintech companies with very little time to detect and prevent the attack.

After unauthorized transactions occur through the payment system or fund distribution API, ...

Investing in cryptocurrencies is moving beyond the initial hype. Regulation, increased investor awareness, risk management, and new technologies are transforming how digital assets are traded while raising important questions about responsible participation in this space.

At the TechSparks 2026 event, Rajagopal Menon, Vice President of WazirX; Satish Mishra, CTO of Pi42 and SharkExchange; and Sharad Chandra, founder of EmpowerEdge Ventures, participated in a discussion with Suetha Kannan, Deputy Editor of YourStory. They discussed the changing landscape of the crypto industry, the need for regulatory clarity, and the growing role of artificial intelligence in trading.

The Indian cryptocurrency market has traditionally been a dynamic space that grew rapidly during the 2021–2022 bull cycle. Menon noted that WazirX spot markets processed nearly $48 billion in transactions during that period. However, subsequent tax measures introduced in the budget have significantly altered the market.

In Menon's view, the situation resulting from these changes puts Indian exchanges at a disadvantage compared to foreign platforms. He emphasized that local exchanges are obligated to withhold Tax Deducted at Source (TDS) and operate within the 30% tax regime, whereas foreign exchanges have not faced such requirements. He opined that a stable or improved environment should involve applying the same rules to everyone so that support for the 'Make in India' initiative is directed towards Indian exchanges.

Menon also pointed out a shift in trading activity: as spot trading volumes decline, futures and derivatives are gaining popularity. He predicts significant adoption of this segment in India.

Turning to regulation, Chandra stated that exchanges have facilitated investor education on various crypto assets and risk understanding, but gaps remain in the legal framework. He asserted that after regulation, there could be a significant inflow of capital into the country.

Chandra indicated that while exchanges are required to comply with KYC norms, shortcomings persist in identity verification as assets move across the blockchain. He suggested that regulatory sandboxes could help resolve some of these issues. SEBI and IFSCA already have such sandboxes to stimulate innovation in capital markets, but fintech companies focused on native digital assets have not yet received permission to participate.

He also highlighted the potential of tokenization, citing the tokenization of corporate bonds as an example. Currently, participation in this process is limited to institutional players. Chandra proposed that opening regulatory sandboxes to a wider range of Web3 fintech companies would allow them to test new ideas, refine existing processes, and play a more significant role in the tokenization process.

Unlike traditional financial markets, cryptocurrencies trade 24/7, seven days a week. For technical teams, this means constant system monitoring, risk management, and incident response without the predictable downtime provided by market closing hours.

Mishra described how trading activity on crypto platforms can intensify during evenings and weekends, partly in response to movements in US markets. This creates continuous demands for observability, alerting, and leverage monitoring. His experience building a spot trading exchange showed how quickly demand for derivatives can outpace infrastructure development. The Pi42 team initially chose a different approach, creating a platform specifically for derivatives instead of adapting a spot trading system. Mishra noted that production incidents occurred on weekends when systems could not keep up with demand. This experience underscored the necessity of building infrastructure around the 24/7 operational model of cryptocurrencies.

As more people enter the crypto market, investor education and effective regulatory compliance become increasingly vital. Menon mentioned WazirX's 'Gangs of Cryptopur' campaign, aimed at helping investors understand what they are trading. He also spoke about the need for a disciplined approach to cryptocurrencies, comparing the historical returns of various asset classes to Bitcoin. His advice was to think long-term rather than viewing cryptocurrency as a series of short-term bets.

For exchanges, simplifying the user process is as important as maintaining compliance checks. Mishra explained that KYC can be frustrating if an application is rejected, forcing the user to start over. Technology can simplify this by allowing users to resume where they left off and clearly explaining what needs correction. He added that genuine users are generally less concerned about compliance checks than those trying to bypass them. The goal is to make the process smoother for users while retaining the checks necessary to detect suspicious activity.

Artificial intelligence is also changing how traders research markets and assess potential deals. Menon reported that WazirX implemented an AI-based feature that scans over 300 tokens to identify those exhibiting bearish momentum. WazirX AI is the first AI agent for cryptocurrencies in India that acts as a conversational assistant, processing complex multi-step queries, including technical indicators like MACD and RSI, and offering users options for consideration. Traders must confirm the chosen strategy before the AI places an order with stop-loss and take-profit parameters. Menon views AI as a way to analyze large volumes of market data and identify patterns, but he also stressed that AI should support decisions, not make them for users.

Mishra also strongly urged traders to backtest AI-generated strategies and monitor their performance before using them in live markets, advising: 'If you ask AI for a strategy and then act on it, make sure you are also watching it so that when it starts going wrong, you can turn it off.'

Chandra noted that the regulatory implications will depend on how AI is used. Educational tools may be viewed differently from systems offering personalized investment advice, which could fall under investment advisor regulations. He also emphasized the need for AI systems to be robust, explainable, auditable, and fair.

As the crypto landscape evolves under the influence of new regulations, AI breakthroughs, and changing investor expectations, Menon, Chandra, and Mishra were asked about the next phase of the sector. For Menon, this was futures and derivatives. Mishra agreed, noting that derivatives continue to grow and meet specific needs within the crypto ecosystem. Chandra pointed to another emerging opportunity: compute futures, given developments such as the launch of CME compute futures in the US, indicating how new asset classes can emerge at the intersection of AI and digital assets.

As the market develops, the discussion highlighted three interconnected priorities: clearer regulation, stronger infrastructure, and more conscious use of AI. The next phase of crypto investing in India will depend not only on new products and trading opportunities but also on how effectively the ecosystem manages risks and gains trust.