Exclusive: RBI tightens API security rules for banks after NBFC cyberattacks; mandates audits, beneficiary checks

The Reserve Bank of India (RBI) has issued a confidential cybersecurity advisory directing banks offering automated fund-transfer services to non-banking financial companies (NBFCs) to strengthen safeguards against unauthorised transactions.

In an advisory dated November 3, 2026, issued by the Cyber Security and IT Risk (CSITE) Group of the RBI's Department of Supervision, the regulator has asked scheduled commercial banks (SCBs) and urban co-operative banks (UCBs) offering application programming interface (API)-based fund-transfer services to implement specific security controls. 

The advisory, seen by The Head and Tale, covers bank-NBFC integrations, including arrangements where API connectivity is provided directly to an NBFC or through an intermediary or third-party service provider (TPSP).

Separately, a banker told The Head and Tale that the RBI also held a nearly two-hour meeting with banks on Wednesday to discuss the attacks. During the meeting, the regulator raised concerns over gaps in lenders' security measures and emphasised that banks are responsible for securing API-based fund-transfer arrangements.

The move follows a series of cyberattacks targeting NBFCs, in which hackers allegedly exploited vulnerabilities in software systems used to initiate fund transfers and disbursements, with some attacks involving AI-powered tools. The Economic Times recently reported nearly Rs 300 crore in cyber fraud losses at smaller NBFCs over two months.

In recent months, cybercriminals have repeatedly targeted lenders, particularly smaller NBFCs, exploiting vulnerabilities in loan origination systems (LOS), internal applications and payment integrations to initiate unauthorised fund transfers.

There has been several warnings and advisories issued by the Indian Computer Emergency Response Team (CERT-In). Yesterday, the government’s nodal agency for responding to cybersecurity incidents issued fresh warnings about AI-assisted attacks on BFSI entities.

Dressing down by RBI

According to the RBI, several incidents have been brought to its notice wherein unauthorised fund-transfer transactions were carried out by threat actors after: compromising transaction-originating systems, such as Loan Origination Systems (LOS); and/or tampering with or injecting beneficiary-account details in fund-transfer/payout API requests.

The banker cited above said, "The RBI gave banks a dressing down. The problem is that whenever such incidents happen, banks start getting blamed for not having adequate security measures."

He, however, added that the frequency of attacks had become a concern for all banks. “If you look at it, individual fraud incidents are typically in the range of Rs 3 crore to Rs 15 crore, but the larger concern is the number of attempts being made across the ecosystem.”

At one mid-sized bank, its fraud-risk management team received more than 20 cyberattack alerts over four days, including the weekend. Most of these attempts were prevented, although one of its NBFC clients was hit during this period by an attack, one of the industry sources claimed.

"The RBI's bigger worry is also payment aggregators because even larger NBFCs do not generally keep substantial funds lying in their bank accounts. They deploy their money and manage treasury returns. If hackers can target NBFCs and their payment systems so frequently, the exposure at payment aggregators could be a much bigger concern," the banker quoted above informed.

The RBI has also issued a companion advisory setting out cybersecurity requirements that NBFCs themselves must follow when using bank APIs.

Safety controls mandated for banks

The RBI has set deadlines for implementing the controls, with some measures required immediately and others to be completed within one or three months of the advisory.

Under the November 3 advisory, banks have been asked to create and maintain a comprehensive inventory of all clients using their APIs to initiate fund transfers. The inventory must capture business profile of every client, the API services being used, account and integration details, applicable transaction limits, and key business, technical and security contacts.

The RBI has also made cybersecurity audits by CERT-In-empanelled auditors a requirement for NBFCs using bank APIs directly or through an intermediary or TPSP. For new NBFC clients, the audit must be completed before onboarding or granting access to the bank's API; while the existing clients have been given three months from the date of the advisory, or until February 3, 2027, to complete the audit. The audit must be conducted at least once a year and repeated after any material cyber incident.

According to the advisory, banks must track completion and act against NBFC clients that do not comply.

For API clients that are not NBFCs, such as banking correspondents (BCs), payment aggregators (PAs), payment service providers (PSPs) and other fintech firms, banks must assess risk immediately. They must require a periodic audit within three months, or sooner if the risk is higher. Banks must also brief all API clients at least once every three months on the threat landscape.

The RBI has asked banks to bring all API-initiated transactions under their existing fraud-risk management and transaction-monitoring frameworks. Banks must establish thresholds and behavioural baselines specific to each client's business profile and expected transaction patterns.

Banks are expected to identify material deviations, including sudden increases in transaction volumes or values, repeated transactions just below prescribed limits, unusual activity outside business hours or on holidays, and sudden bursts of new beneficiary accounts, known mule-account patterns, and repeated failed log-ins and abnormal numbers of invalid API requests.

The RBI has specifically asked banks to consider changes in the technical fingerprints of software making API calls. These include changes in user-agent details, application versions, operating systems and network attributes, wherever such information is available. Banks have until December 3 to make the necessary technical changes to existing API set-ups.

Banks must secure their own API infrastructure, including access management, network segmentation, patching and monitoring. The RBI has flagged attackers using a compromised client’s infrastructure, authorised IP addresses, ports or integration services as a stepping stone to the bank.

The controls likely to change daily operations are – beneficiary whitelisting and maker-checker confirmation. 

Under the beneficiary whitelisting, bank allows clients to register verified beneficiary accounts of end customers in advance. Any payout request involving an account that has not been registered must be rejected. The list must be specific to each client. Adding or modifying beneficiary details must happen through a separate channel, such as corporate internet banking, protected by multi-factor authentication.

And, under maker-checker or out-of-band confirmation, banks are required to provide an additional authorisation mechanism for debit requests received through APIs. Transaction details can be presented to the client through a separate channel, such as corporate internet banking, for maker-checker approval or additional confirmation before the debit is processed. The additional confirmation can apply to all transactions or transactions above a risk-based threshold.

Banks must onboard regulated entities using API-based fund transfers for at least one of these two safeguards. Banks must also make debit information available quickly so clients can reconcile transactions one by one. 

For new integrations, the controls must be operational before the service goes live. Existing integrations have been given one month, until December 3, 2026, to implement them.

The RBI allows narrow, case-by-case exceptions for highly automated payment processes where neither control is practical. The client must apply in writing and the bank must document its risk assessment.

In addition, banks are directed to prescribe per-transaction and daily cumulative limits for every API client with immediate effect. Intra-day or velocity limits, designed to prevent a large number of transactions within a short period, must be implemented within one month. The limits must be calibrated to the client's declared and observed business profile and the associated risk. Any material increase in limits must be supported by a documented risk assessment.

Banks can also consider maker-checker confirmation as a compensating safeguard when assessing the need for intra-day limits, provided the control is commensurate with the risk and the decision is documented.

The advisory also makes incident reporting and recovery procedures an immediate requirement. Banks must ensure that clients promptly report any actual or suspected compromise of systems connected to the API-based payment process.

On receiving such a report, or independently identifying credible signs of a compromise, banks must quickly assess whether to restrict API access, revoke credentials or reduce transaction limits. Access can be restored only after investigation, containment, clean-up, rotation of credentials where warranted and security validation.

On the other hand, a separate advisory for NBFCs prescribes a CERT-In-empanelled cybersecurity audit before API access is enabled. The audit must also cover third-party systems involved in the payment journey, including those of lending service providers (LSPs) and service providers hosting the loan origination system (LOS).

Starting immediately, NBFCs must monitor for unusual activity such as sudden spikes in volumes or values, and reconcile every API-initiated payment against the bank debit at suitable intervals through the day, more often for higher-volume arrangements. As per the advisory, NBFCs must adopt beneficiary whitelisting or maker-checker and out-of-band confirmation their bank offers, within a month for existing arrangements once the facility is available.

Like banks, NBFCs must promptly report any actual or suspected compromise of systems linked to API-based payments.