--- title: "RBI API Security Advisory: Banks Must Audit NBFC Clients" description: "A confidential 3 November advisory, reported by The Head and Tale and carried by MediaNama and Elets BFSI, sets hard deadlines for the software pipes that..." url: "https://bharat.digital/originals/rbi-api-security-advisory-banks-nbfc-cert-in-audit-whitelisting-nov-2026/index.md" canonical: "https://bharat.digital/originals/rbi-api-security-advisory-banks-nbfc-cert-in-audit-whitelisting-nov-2026/" published: "2026-11-07T19:05:00+04:00" updated: "2026-11-07T19:05:00+04:00" section: "Originals" type: "startup" author: "bharat.digital desk" image: "https://bharat.digital/img/originals/rbi-api-security-advisory-banks-nbfc-cert-in-audit-whitelisting-nov-2026-auto-c32d2724-og.jpg" language: "en-IN" site: "bharat.digital" --- # RBI orders banks to lock down API money transfers: CERT-In audits for NBFC clients, whitelisted payees by 3 December *A confidential 3 November advisory, reported by The Head and Tale and carried by MediaNama and Elets BFSI, sets hard deadlines for the software pipes that lenders and fintechs use to move money.* By bharat.digital desk. Startup, Startups & Fintech. Published 2026-11-07T19:05:00+04:00. 3 min read. ![RBI orders banks to lock down API money transfers: CERT-In audits for NBFC clients, whitelisted payees by 3 December](https://bharat.digital/img/originals/rbi-api-security-advisory-banks-nbfc-cert-in-audit-whitelisting-nov-2026-auto-c32d2724-hero.webp) ## At a glance - Company: Reserve Bank of India (API security advisory) - What it does: Confidential RBI supervisory advisory on API based fund transfers by banks to NBFCs and fintech clients - Based in: Mumbai - Latest: RBI advisory tightens bank API fund-transfer security - Date: 2026-11-03 The Reserve Bank of India has told banks that offer API based fund transfers to tighten the controls around them, according to an advisory dated 3 November 2026 that was first reported by The Head and Tale and later detailed by MediaNama and Elets BFSI. The document came from the Cyber Security and IT Risk group of the RBI's Department of Supervision and is addressed to scheduled commercial banks and urban co-operative banks. It is confidential, so the rules below are as described by those outlets, not from a published RBI circular. An API, or application programming interface, is the software doorway that lets an NBFC, a payment aggregator or a fintech tell a bank to send money to a customer's account without a person keying in each transfer. Banks must keep a full inventory of every client using their APIs to start transfers, including the client's business profile, the services used, integration details, transaction limits and security contacts. NBFCs that use bank APIs, directly or through an intermediary, need a cybersecurity audit by a CERT-In empanelled auditor. New NBFC clients must finish it before they get access, existing ones have until 3 February 2027, and the audit has to be repeated every year and after any material cyber incident. Other API clients such as banking correspondents, payment aggregators, payment service providers and fintechs must be risk assessed immediately and audited within three months, and banks must brief all API clients on the threat picture every quarter. The controls most likely to change daily operations are beneficiary whitelisting and maker-checker approval. Under whitelisting, a client registers verified customer accounts in advance, any payout to an unregistered account is rejected, and changes to the list can only be made through a separate channel protected by multi-factor authentication. Under maker-checker, a debit sent through the API is shown again on a separate channel, such as corporate internet banking, for a second approval. Every regulated client using API transfers must be on at least one of the two. New integrations need it before going live, and existing ones by 3 December 2026. Per transaction and daily limits apply at once, intra-day velocity limits within a month, and banks must flag patterns such as bursts of new beneficiaries, transfers just under limits, odd-hour activity and changes in app version or network fingerprints. The advisory follows a run of warnings about attackers abusing these pipes. Elets BFSI links it to attacks on smaller NBFCs that allegedly exploited loan origination systems and payment APIs, with estimated losses of about Rs 300 crore. A banker quoted by The Head and Tale, via MediaNama, said individual frauds ranged from Rs 3 crore to Rs 15 crore and that the RBI held a meeting of close to two hours with banks on the issue. CERT-In's 4 November advisory on the Crafty Falcon group, which tested fund flows with Rs 1 transfers, and the Indian Cyber Crime Coordination Centre's warning on AI agent attacks on payment APIs, both covered on bharat.digital, point at the same weakness. For customers, the practical effect is likely to be extra steps and short delays when an app pays out to a newly added bank account, since that is what whitelisting and second approvals are meant to do. For fintechs and NBFCs that rely on bank payout APIs, the deadlines are near: one month to put a safeguard on existing integrations, and three months to get a CERT-In empanelled audit done. ## Sources 1. [The Head and Tale: Exclusive: RBI tightens API security rules for banks after NBFC cyberattacks](https://theheadandtale.com/deepdives/exclusive-rbi-tightens-api-security-rules-for-banks-after-nbfc-cyberattacks-mandates-audits-beneficiary-checks/) 2. [MediaNama: RBI meets bankers amidst rising AI cyber-attacks, mandates security audits](https://www.medianama.com/2026/11/223-rbi-bankers-ai-cyber-attacks-security-audits/) 3. [Elets BFSI: RBI Mandates API Safeguards for Bank-NBFC Transfers](https://bfsi.eletsonline.com/rbi-bank-nbfc-api-controls/) 4. [CybersecurityASEAN: RBI Advisory Makes Cybersecurity Audits Mandatory for NBFCs Moving Money Through Bank APIs](https://cybersecurityasean.com/daily-news/rbi-advisory-nbfc-api-security-audit-cert-in) Written by the bharat.digital desk from the sources above. Figures are as reported by those sources.