IBA Working on Bank-to-Bank Cyber Incident Alerts and AI Testing Sandbox, SBI Chairman Says

What the IBA chairman reported

State Bank of India (SBI) chairman C. S. Setty, who also heads the Indian Banks’ Association (IBA), said the industry body is working to establish a platform where banks can share information about cyber incidents quickly. He also described plans being examined for a controlled environment to test frontier artificial-intelligence (AI) models and cyber risks. PTI reported his remarks on 3 November; the statements were also covered by mid-day and The Times of India on 4 November 2026.

These are initiatives under development. The reports do not establish that every bank has joined a live platform, that participation is legally compulsory or that a standardized incident-sharing deadline has been announced.

Why faster communication matters

Financial institutions already share cybersecurity information with regulators and government agencies as required under existing frameworks. Setty said banks did not yet have an equivalent structured route for warning their peers immediately when a particular attack pattern appeared. A timely industry alert could allow other banks to identify similar suspicious activity and take preventive measures.

Such an initiative must not be read as permission to share customers’ confidential records, passwords or internal vulnerability reports without appropriate safeguards. The inspected reporting does not specify any final format, permitted dataset, technical architecture or approved recipients for the proposed platform.

What is an industry AI sandbox?

Setty also said IBA was considering a sandbox for assessing advanced AI risks. In banking technology, a sandbox is a limited testing environment where specialists examine possible weaknesses and trial controlled defences without treating experimental technology as ready for live customer transactions.

According to the reports, IBA has been working on an AI-related cybersecurity framework. However, a public final framework, a sandbox launch date, a detailed testing procedure and a complete participating-bank list were not established in the accounts reviewed. A proposal to test AI models is different from a direction to install or run them on production bank systems.

Different from CERT-In and I4C advisories

The IBA chairman’s remarks concern coordination between financial institutions. They are separate from the October CERT-In cyber-security communication and the distinct 4 November I4C warning on AI-assisted payment and disbursement-interface attacks. Those involve public agency security recommendations; this is an industry information-sharing concept. The subject matter overlaps, but the issuing bodies and decision status are not identical.

What bank employees should take from the report

• Information-security and incident-response teams can monitor future authentic IBA communications and continue to use existing approved reporting and escalation arrangements until new instructions arrive.
• IT and digital-banking teams should keep applying current patches, authentication, logging and access controls; none of these routine duties is replaced by an unlaunched platform.
• Branch and customer-service staff should not forward account information, incident evidence or suspicious links to unofficial groups claiming to represent an IBA cyber exchange.
• Compliance and audit staff should distinguish a chairman’s public proposal from RBI or CERT-In directions that are actually operative.

What remains to be confirmed?

Readers should watch for an authoritative IBA announcement that specifies participation, governance, permitted information sharing and launch arrangements. No rollout date, mandatory registration or legally binding common reporting format was verified in the inspected reports. No such requirements should be invented from a press statement.

Sources and References

1. mid-day (PTI report) — IBA working on cyber incidents information sharing: CS Setty (2026-11-04)
2. The Times of India — Cyber risks: Banks working on coordinated response (2026-11-04)
3. Rediff Money (PTI) — IBA Tackles Cyber Threats, AI Attacks & Info Sharing in Banking (2026-11-03)