RBI asks banks to upgrade all ATMs still running on Windows XP

ATM (Representative Image)

Reserve Bank of India (RBI) has asked banks to uninstall the Microsoft XP operating system from all ATMs and upgrade them by June 2019.

The notification came after it was found that many banks had not complied with confidential circulars sent earlier by RBI. The central bank had raised issues about ATMs running on the dated Windows XP and other unsupported operating systems.

After Microsoft had announced in 2014 that it was discontinuing Windows XP, the company has not rolled out any security patches nor has announced any new features for the OS.

The circular issued by the central bank highlights the "vulnerability arising from the banks' ATMs operating on the unsupported version of operating system and non-implementation of other security measures" that could adversely affect the interest of consumer and impinge the image of the bank.

RBI also warned banks that not complying with the orders would result in regulatory action.

"It may be noted that any deficiency in timely and effective compliance with the instructions contained in this Circular may invite appropriate supervisory enforcement action under applicable provisions of the Banking Regulation Act, 1949 and/or Payment and Settlement Systems Act, 2007," the central bank said.

RBI has given banks a time frame to address all issues. The upgradation of ATMs needs to be completed in phases with half of them to be completed by the end of the year.

There is also a deadline to implement security measures such as BIOS password for all ATMs, disabling USB ports, disabling auto-run facility, and applying the latest patches of operating system among others.

Additionally, RBI has directed banks to implement anti-skimming and whitelisting solutions by March 2019.