Update: RBI presses banks to prove cyber compliance and audit partner APIs
The RBI has reportedly told banks to prove their cyber rules are followed, audit APIs shared with NBFCs and fintechs, and plan for AI attacks.
The Reserve Bank of India (RBI) has reportedly asked banks to prove that their existing cybersecurity rules are being followed in practice, to probe weaknesses in the software links they share with non-bank lenders and fintechs, and to explain how they would handle attacks that use AI tools. The BFSI Network (Elets) reported this on 2 November, saying Reuters first carried the story on 30 October, citing three people familiar with the matter. What is new since this site's earlier report on the attacks is the regulator's response: the requests were made in a series of meetings with banks, and there is no published circular and no deadline yet.
What the RBI is reportedly asking for
According to the Elets report, the RBI's message to banks has three parts. First, banks should show that the cybersecurity directives already on the books are being implemented and not merely written down. Second, they should audit the weak points in their connections with non-banking finance companies (NBFCs) and fintech partners, including the links that carry loan-disbursal instructions. Third, they should explain how they would deal with attacks built with AI tools.
The requests were made in meetings rather than in a formal notice, and Elets says it found no deadline for banks or fintechs. That matters for readers: until the RBI puts something in writing, what is described here is a supervisory expectation, and it rests on unnamed sources.
The report also points to an RBI advisory dated 19 October. Elets says that advisory told regulated entities to treat their technology systems as compromised until a forensic check clears them, after any credential exposure or confirmed unauthorised access. In other words, the regulator wants firms to assume the worst first and prove otherwise.
Why the RBI is leaning on APIs
An API (application programming interface) is a doorway that lets one company's software talk to another's. When a digital lender wants to pay out a loan, its system sends an instruction through an API to the bank that actually moves the money. Think of it as a courier's pass: whoever holds the pass can walk into the building, so a stolen pass is as good as the real one.
Banks use these links with co-lending partners, digital lending apps, payment aggregators and account aggregators. Each link is a possible way in. Elets points to the incidents that appear to have triggered the push. Two Mumbai-based NBFCs allegedly lost about $2 million (roughly Rs 190 crore at the Rs 94.90 per dollar rate reported on 2 November) through more than 700 unauthorised transfers on 8 and 9 October. Hackers reportedly compromised the API used to send loan-disbursal instructions to their bank. State Bank of India is separately said to be investigating a data leak affecting about 3,900 customers.
CERT-In, India's national cyber agency, issued an advisory on 9 October. As reported by Elets, it warned that attackers were stealing the API credentials of payment aggregators, gateways and partner banks so that they could move money out of lenders' systems, possibly with AI tools. Elets also repeats an earlier report that small NBFCs had lost an estimated Rs 300 crore to such attacks. That figure has not been confirmed by the RBI or CERT-In, and it is an estimate from sources.
The June warning, and what is different now
This is not the first time the RBI has talked about AI and cyber risk. Outlook Business reported on 10 June 2026 that banks and other regulated entities had been asked to complete a board-approved gap assessment of their AI preparedness and to submit a time-bound action plan by the end of that month. The worry then was frontier AI models that can find software flaws, including zero-day flaws, which are weaknesses nobody has fixed yet. The same report said the RBI had told the Monetary Policy Committee it was "fully prepared" to deal with such threats, and that Finance Minister Nirmala Sitharaman had urged banks in April to secure their IT systems and report suspicious incidents promptly, including to CERT-In.
The difference between June and now is the shift from preparation to evidence. In June the ask was a plan. According to Elets, the ask now is proof: show that rules are followed, show what you found in your partner links, and show how you would respond. A consultant who works with large banks told the publication that the RBI's cybersecurity rules already exist but implementation has lagged, which is why the stance is tougher. A person aware of regulatory thinking said attackers see smaller lenders, NBFCs and their third-party vendors as "softer targets".
What is confirmed and what is not is worth keeping apart. The 9 October CERT-In advisory and the 19 October RBI advisory are described as documents. The figure of $2 million for two Mumbai NBFCs and the Rs 300 crore estimate come from reports based on sources and a police complaint reviewed by Reuters, and they are not official loss totals. The identity of the two NBFCs has not been given.
What it means for lenders, fintechs and borrowers
The RBI's position, as reported, is that banks stay accountable for funds moving through their systems even when a partner's system issues the instruction. That puts the bank on the hook for a failure that started in someone else's code.
Elets expects fintechs to face tougher due diligence from their partner banks. That could mean more frequent security audits, stricter controls on who can use an API, multi-factor authentication for machine-to-machine calls, limits on transaction size and real-time monitoring for unusual payouts. Fintechs and NBFCs with strong API security may find partnerships easier to win and keep, while weaker players could see slower onboarding or tighter limits.
For a borrower, the effect should mostly be invisible if it works: a loan that is disbursed a little more slowly because of an extra check, or a payout flagged for review. For a small lender, the practical questions are concrete. Who holds the keys to our disbursal API? Are credentials stored in code or in plain configuration files? Can one stolen credential send unlimited money? The RBI has not published a checklist in this case, so any firm's own review is the safest guide.
A transaction cap is one of the simplest controls, and it is easy to see why. Try the sliders below to see how a per-transfer limit would change the total of a run of unauthorised payments of the size described in the report. The inputs are the reported figures and an example cap, so treat it as arithmetic, not a forecast of any firm's losses.
What to watch next
Watch for three things. One is whether the RBI turns these meetings into a written circular with a deadline, since that would turn an expectation into a rule. Another is whether banks start asking their NBFC and fintech partners for fresh security audits or tighter API terms, which would show up first in contract changes. The third is any official confirmation, correction or total for the losses reported so far; until then the Rs 300 crore figure stays an unconfirmed estimate.
Key takeaways
- The RBI has reportedly asked banks to show that cybersecurity rules are implemented, to audit partner APIs and to explain their readiness for AI-driven attacks, according to a 2 November Elets report citing Reuters.
- The requests came in meetings, not a published circular, and no deadline has been reported.
- Two Mumbai NBFCs allegedly lost about $2 million through more than 700 unauthorised transfers on 8 and 9 October, and the larger Rs 300 crore estimate is unconfirmed.
- Banks remain accountable for money that leaves their systems even when the instruction comes from a partner, so fintechs and NBFCs should expect tougher security terms.
Sources
- [BFSI Network (Elets): RBI tightens cyber checks on bank-fintech APIs](https://bfsi.eletsonline.com/rbi-cybersecurity-checks-banks-fintech-nbfc-api/)
- [Outlook Business: RBI moves to shield banks from emerging AI threats](https://www.outlookbusiness.com/economy-and-policy/rbi-moves-to-shield-banks-from-emerging-ai-threats)
- [Telangana Today: Sensex jumps 1,233 points, Nifty closes above 23,400 on oil price fall](https://telanganatoday.com/sensex-jumps-1233-points-nifty-closes-above-23400-on-oil-price-fall)
Tags: RBI Cybersecurity NBFC Digital lending AI security