RBI orders banks to lock down API money transfers: CERT-In audits for NBFC clients, whitelisted payees by 3 December

The Reserve Bank of India has told banks that offer API based fund transfers to tighten the controls around them, according to an advisory dated 3 November 2026 that was first reported by The Head and Tale and later detailed by MediaNama and Elets BFSI. The document came from the Cyber Security and IT Risk group of the RBI's Department of Supervision and is addressed to scheduled commercial banks and urban co-operative banks. It is confidential, so the rules below are as described by those outlets, not from a published RBI circular. An API, or application programming interface, is the software doorway that lets an NBFC, a payment aggregator or a fintech tell a bank to send money to a customer's account without a person keying in each transfer.

Banks must keep a full inventory of every client using their APIs to start transfers, including the client's business profile, the services used, integration details, transaction limits and security contacts. NBFCs that use bank APIs, directly or through an intermediary, need a cybersecurity audit by a CERT-In empanelled auditor. New NBFC clients must finish it before they get access, existing ones have until 3 February 2027, and the audit has to be repeated every year and after any material cyber incident. Other API clients such as banking correspondents, payment aggregators, payment service providers and fintechs must be risk assessed immediately and audited within three months, and banks must brief all API clients on the threat picture every quarter.

The controls most likely to change daily operations are beneficiary whitelisting and maker-checker approval. Under whitelisting, a client registers verified customer accounts in advance, any payout to an unregistered account is rejected, and changes to the list can only be made through a separate channel protected by multi-factor authentication. Under maker-checker, a debit sent through the API is shown again on a separate channel, such as corporate internet banking, for a second approval. Every regulated client using API transfers must be on at least one of the two. New integrations need it before going live, and existing ones by 3 December 2026. Per transaction and daily limits apply at once, intra-day velocity limits within a month, and banks must flag patterns such as bursts of new beneficiaries, transfers just under limits, odd-hour activity and changes in app version or network fingerprints.

The advisory follows a run of warnings about attackers abusing these pipes. Elets BFSI links it to attacks on smaller NBFCs that allegedly exploited loan origination systems and payment APIs, with estimated losses of about Rs 300 crore. A banker quoted by The Head and Tale, via MediaNama, said individual frauds ranged from Rs 3 crore to Rs 15 crore and that the RBI held a meeting of close to two hours with banks on the issue. CERT-In's 4 November advisory on the Crafty Falcon group, which tested fund flows with Rs 1 transfers, and the Indian Cyber Crime Coordination Centre's warning on AI agent attacks on payment APIs, both covered on bharat.digital, point at the same weakness.

For customers, the practical effect is likely to be extra steps and short delays when an app pays out to a newly added bank account, since that is what whitelisting and second approvals are meant to do. For fintechs and NBFCs that rely on bank payout APIs, the deadlines are near: one month to put a safeguard on existing integrations, and three months to get a CERT-In empanelled audit done.