RBI Advisory Makes Cybersecurity Audits Mandatory for NBFCs Moving Money Through Bank APIs

The Reserve Bank of India has told banks that any NBFC sending money through their payment APIs must pass a cybersecurity audit by a CERT-In-empanelled auditor, Head and Tale reported on 5 November, citing a confidential advisory the central bank hasn't published. Elets BFSI dates the advisory to 3 November and reports that NBFCs already connected have until 3 February 2027 to complete the audit. New clients have to be audited before onboarding.

In the NBFC thefts the RBI describes, attackers broke into loan origination systems or injected their own beneficiary accounts into payout API requests. A banker who spoke to Head and Tale put a typical incident at "Rs 3 crore to Rs 15 crore". CERT-In had already warned the sector about the same method, naming the campaign Crafty Falcon.

What banks must change

Each bank has to keep an inventory of every client using its APIs to start fund transfers. A payout to an account the client hasn't pre-registered "must be rejected". Existing integrations need this whitelisting, or a second approval on API debits, by 3 December 2026.

Per-transaction and daily cumulative caps apply immediately, and velocity limits within one month. Monitoring is meant to catch volume spikes, bursts of new beneficiaries and transfers "just below prescribed limits".

When a client reports a compromise, or the bank spots one itself, it's expected to restrict or revoke API access.

What NBFCs must do

A companion advisory tells NBFCs to extend the audit to third-party systems in the payment flow, including lending service providers and LOS hosts. They also have to reconcile each API-initiated payment against the bank debit at intervals during the day, and the audit is repeated every year and after any material cyber incident.