Fintech Deep Dive — Sunday | October 25, 2026

Coverage window: October 18–25, 2026 (India time)

Five developments this week span personal-data security, depositor access, regulatory priorities, cross-border payments and automated customer service. Across them, announcements explain what is being launched or restricted more clearly than how customers can recover when something goes wrong. The sections below distinguish official directions and agendas from company-reported claims.

1. SBI’s suspected data exposure became a customer-notification story

On October 21, State Bank of India told the stock exchanges that it had received alerts on October 16 from its threat-intelligence provider, the Defence Cyber Agency and CERT-In about a suspected exposure of customer data on the dark web. In a preliminary review of roughly 375,000 records circulating there, SBI identified 3,897 customer records containing personally identifiable information. The bank listed names, mobile numbers, dates of birth, email and residential addresses, branch and customer identifiers, and metadata associated with loan and lead records. SBI said it had activated incident-response measures, hired a CERT-In-empanelled firm, and was still investigating authenticity, source and extent. It reported no material effect on core operations or business continuity.¹

On October 23, SBI said it had individually informed all customers whose data had been identified, by email and/or WhatsApp.² The October 21 exchange filing described the suspected exposure but did not say whether customers had been notified. This is an important step in the response, but the bank’s own filing keeps several facts provisional: 3,897 is a count of identified records, not necessarily a verified count of unique people; and the bank had not yet established the full authenticity or completeness of the exposed material. SBI’s assurance that balances are safe addresses immediate access to money, not the separate risk that exposed contact and identity details can make phishing more convincing.

For customers who receive a notice, the safest response is to verify it through SBI’s official app, website, branch or a phone number independently obtained from the bank—not through links or numbers in an unsolicited message. Be alert to callers who know personal details and then ask for an OTP, PIN or password. The bank has reported a notification step; the public material reviewed here does not yet answer how the data left the bank’s control, whether a vendor was involved, or what prevention changes followed. Those are the questions that turn a notification into accountability.

2. Puducherry co-op bank depositors face a hard limit on access

An RBI direction for Puducherry Co-operative Urban Bank Ltd took effect at the close of business on October 21. Without prior written RBI approval, the bank cannot make new loans or investments, accept fresh deposits, incur specified liabilities or make payments except as allowed by the direction. RBI cited the bank’s liquidity position and said supervisory concerns had not been addressed with concrete effort. It directed the bank to permit withdrawals of no more than ₹5,000 from savings or current accounts or any other account of a depositor; loan set-off is allowed under the direction’s conditions. Eligible depositors may claim DICGC insurance of up to ₹5 lakh in the same capacity and right, after submitting willingness and completing verification.³ RBI said the directions do not, by themselves, cancel the bank’s licence; they remain in force for six months from October 21 and are subject to review.

The ₹5,000 withdrawal limit and the ₹5 lakh insurance ceiling are different things. The first is the immediate amount the bank may let a depositor withdraw under the order; the second is an insured claim subject to eligibility and process. The RBI notice does not say that every depositor will receive ₹5 lakh immediately, nor does the ceiling itself explain when a verified claim will be paid. A depositor should check the bank’s displayed direction and DICGC instructions rather than treat the insurance maximum as cash already available.

This is a cooperative-bank supervision action, not evidence that a particular fintech or payment app caused the problem. It belongs in a digital-finance review because a bank account is still the funding source and safety net behind most app-based payment journeys. When access to an account is restricted, QR convenience cannot replace rent money, wages or medicine. The test for consumer protection is not only whether a payment rail works on a normal day; it is whether people can understand the restriction, find the correct claim route and plan around the loss of liquidity.

3. Regulators set out a roadmap; delivery remains ahead

At its October 23 meeting, the Financial Stability and Development Council (FSDC), chaired by the Union Finance Minister, discussed fintech innovation and the prospects for tokenisation of financial and other real-world assets. It also reviewed financial-sector cyber resilience, noted an inter-ministerial Financial Sector Cyber Security Strategy, and discussed critical information infrastructure and cyber preparedness at regional rural banks. Its priorities included digital KYC for non-resident Indians and foreign portfolio investors, scaling Account Aggregator and Unified Lending Interface (ULI) infrastructure with a focus on MSMEs, and reducing intermediation costs.⁴

On October 24, SEBI chair Tuhin Kanta Pandey set out a four-part market roadmap in an address to the Association of National Exchanges Members of India: simpler rules, deeper markets, responsible technology and wider access. He described work underway on graded broker compliance, safeguards against trading-terminal misuse, an AI sandbox, and responsible-AI guidance with tiered accountability, data controls, kill switches and human oversight. He said the next Demat 2.0 phase would bring tokenised corporate bonds into secondary trading. The speech also cited a participation gap: nearly two-thirds of households knew about securities products, but fewer than one in ten invested.

These are agendas, not instructions in force. The FSDC release records discussion, while the SEBI address outlines work with no effective dates. The statements leave basic questions unanswered: which assets qualify for tokenisation, and how investors would exercise rights if a platform fails. Mentioning Account Aggregator or ULI is no proof that every MSME can now obtain credit through them. Until the rules and systems are concrete, this is direction, not evidence of implementation.

A separate financial-inclusion campaign, launched for October 21 to December 31, is intended to reach 2.70 lakh Gram Panchayats and urban local bodies. Its stated activities include opening Jan Dhan accounts, re-KYC, enrolment in insurance and pension schemes, and awareness of digital fraud.⁵ The measurable follow-through should be published: campaign completions rather than targets alone, complaint and remediation outcomes, and whether new digital rails reduce the cost of borrowing without shifting risk onto small businesses or account holders.

4. Pine Labs and WEBXPAY take Indian payment methods to Sri Lanka

Pine Labs and Sri Lanka’s WEBXPAY announced a cross-border partnership on October 22. The companies say merchants in WEBXPAY’s network can accept UPI, UPI AutoPay, Indian cards, net banking across more than 100 banks, EMI conversions and Credit on UPI. The arrangement uses the RBI-authorised Payment Aggregator–Cross Border (PA-CB) framework and was described as the first PA-to-PA collaboration of its kind in Sri Lanka. It is embedded in merchants’ existing integrations, with settlement to merchants on a T+1 basis; the network spans travel, hospitality, retail and online commerce.⁶⁷

This is a practical expansion of the “pay like home” proposition: instead of asking an Indian traveller to install a local wallet or find a card terminal, a participating merchant can offer payment methods the traveller already knows. But “participating” is doing real work here. Neither announcement provides a consumer-facing directory of accepting outlets, complete transaction limits, fee tables, exchange-rate treatment, refund timelines or a clear map of which company handles a failed or disputed payment. T+1 describes merchant settlement; it should not be mistaken for a guarantee that a customer’s refund will arrive in one day.

Credit on UPI and EMI choices also make this more than a checkout convenience. The customer still needs to see whether credit is available, what it costs, and which lender is responsible before confirming. Cross-border acceptance should be judged by the entire payment lifecycle—price shown before authorisation, proof of payment, cancellation, refund and complaint handling—not by the number of logos at checkout. The next useful disclosure from the partners would be a country-specific consumer help route and plain-language terms for each payment option.

5. Karta AI raises $3 million to automate financial-services calls

Bengaluru-based Karta AI raised a $3 million seed round on October 22, led by PeerCapital and Cedar Hill Capital, with Wyser VC, CDM Capital and Seedstars also participating. The startup builds voice and other customer-service agents for banks, lenders, fintech firms and insurers. Inc42 reported company claims of about two million conversations handled per month across more than 25 languages, 10–12 paying customers, and roughly 70% of borrower queries resolved end-to-end without a human agent. Karta says this can cut cost per query by about half; those performance figures are company-reported, not an independently audited service-quality study. No valuation was reported in the coverage reviewed.⁸

The product proposition goes beyond answering FAQs. Karta says its agents can handle multi-part requests—such as checking loan disbursal status and requesting a foreclosure statement—by connecting to enterprise systems. It says fraud and other high-risk interactions, as well as workflows without clear procedures, are routed to people, and that customers can request a human representative.⁸ Those safeguards are promising design claims; the report does not establish how quickly an escalation happens in production, how often a call is misrouted, or whether a human can see the conversation and its actions.

Customer value depends on whether the system understands a request, retrieves the correct account data, performs only authorised actions, and leaves an inspectable record. If a bot mishandles a failed payment, loan statement or insurance claim, the person should not have to start again from zero or prove that the system made an error. A deployment worthy of trust needs visible human escalation, a case reference, a clear correction route and published error and resolution measures. The $3 million round will fund distribution and product development; it is not evidence that automated service already works equally well for every language or customer.

What the week adds up to

Across these five developments, digital finance is extending outward: into a customer’s personal data, bank access, cross-border checkout and conversations about credit. The FSDC’s agenda recognises the need to build cyber resilience alongside innovation, while the SBI case shows how slow and incomplete the public record can be during a live incident. The practical standards are plain: disclose what is known and what remains uncertain; show customers where money and data are held; make charges, limits and recovery routes visible; and let a person reach a human when the automated path fails.

The consumer test is whether a customer can see the terms, get a correct answer, reach a person when needed, and recover when a system fails. A launch or policy agenda is only part of that test.