The Reserve Bank of India (RBI) on 3 November 2026 issued a confidential Cyber Security and IT Risk (CSITE) advisory directing scheduled commercial banks (SCBs) and urban co-operative banks (UCBs) that offer application programming interface (API)-based fund transfers to non-banking financial companies (NBFCs) — directly or via an intermediary or third-party service provider (TPSP) — to tighten security controls, with hard deadlines for audits, beneficiary checks and fraud monitoring.
The advisory from the CSITE Group of the RBI’s Department of Supervision, reviewed in exclusive reporting, follows cyberattacks on smaller NBFCs that allegedly exploited loan origination systems and payment APIs, with estimated losses of about ₹300 crore. It builds on earlier RBI cybersecurity checks on banks, fintech and NBFC APIs and sits alongside the separate Master Directions on cyber resilience for non-bank payment system operators.
What banks must do on API fund transfers
Banks must inventory every API fund-transfer client — profile, services, account and integration details, limits, and key business, technical and security contacts. A companion advisory sets parallel obligations for NBFCs using bank APIs.
CERT-In-empanelled cybersecurity audits are mandatory for NBFC API users. New NBFC clients must finish the audit before onboarding or API access; existing clients have until 3 February 2027. Audits must run at least annually and again after any material cyber incident, and banks must track completion and act on non-compliance. For non-NBFC API clients such as banking correspondents, payment aggregators, payment service providers and other fintechs, banks must assess risk immediately and require a periodic audit within three months — sooner if risk is higher — while briefing all API clients on the threat landscape at least quarterly.
Beneficiary whitelisting, maker-checker and limits
Banks must put regulated API fund-transfer clients on at least one of two safeguards: beneficiary whitelisting (only pre-registered end-customer accounts; list changes via a separate multi-factor channel) or maker-checker / out-of-band confirmation of API debit requests via a channel such as corporate internet banking. New go-lives need the control before launch; existing integrations by 3 December 2026. Narrow written exceptions are allowed for highly automated flows after a documented bank risk assessment.
Per-transaction and daily cumulative limits apply immediately. Intra-day or velocity limits calibrated to each client’s profile must be in place within one month. On any actual or suspected compromise of systems tied to API payments, banks must promptly restrict or revoke API access or cut limits, and restore access only after investigation, containment, clean-up, credential rotation where warranted and security validation.
Fraud monitoring baselines by 3 December 2026
All API-initiated transactions must sit inside existing fraud-risk frameworks, with client-specific thresholds and behavioural baselines. Banks should flag volume or value spikes, near-limit repeats, off-hours or holiday bursts, mule-account patterns, failed log-ins, abnormal invalid API requests, and changes in user-agent, app version, OS or network fingerprints where available. Technical changes for these controls on existing API set-ups are due by 3 December 2026. Banks must also harden their own API infrastructure against attackers pivoting from a compromised client’s authorised IPs or integration services.
The timing tracks rising AI-assisted threats on payment APIs, including I4C warnings on AI-agent cyberattacks targeting fintech payment APIs and coverage of small NBFCs’ estimated ₹300 crore losses. Bankers cited in the reporting said the RBI also held a nearly two-hour meeting with banks on securing API fund-transfer arrangements. Audit guidance and empanelment lists are maintained by CERT-In.
Key takeaways
- RBI’s 3 November 2026 CSITE advisory sets timed API fund-transfer controls for SCBs and UCBs serving NBFCs, with a companion NBFC advisory.
- CERT-In audits are required before new NBFC API onboarding and by 3 February 2027 for existing clients; beneficiary whitelisting or maker-checker by 3 December 2026 for existing integrations.
- Fraud baselines, fingerprint monitoring and incident-driven API restriction are immediate priorities alongside per-txn and daily limits.
FAQ
Who does the RBI API advisory cover?
SCBs and UCBs offering API fund transfers to NBFCs directly or via intermediaries/TPSPs, plus companion NBFC obligations; non-NBFC API clients face immediate risk assessment and periodic audit within three months.
What is the deadline for beneficiary whitelisting or maker-checker?
Before go-live for new integrations; by 3 December 2026 for existing ones, unless a narrow documented exception is granted for highly automated processes.
When must existing NBFC API clients finish CERT-In audits?
By 3 February 2027, then at least annually and after any material cyber incident; new NBFC clients must complete the audit before onboarding.
Featured image: Tower and building of the Reserve Bank of India, Mumbai branch. Photo: Pinakpani via Wikimedia Commons (CC BY-SA 4.0).
