The RBI reportedly 'dressed down' bankers in a two-hour meeting after AI-assisted cyberattacks led to individual frauds of up to Rs. 15 crore. This was the central bank's first direct meeting with banks on AI-driven threats, pushing them hard on API security. Fintechs and NBFCs using bank APIs now face mandatory CERT-In security audits.
How We Got Here
The RBI issued a confidential advisory on November 3, following multiple CERT-In alerts on AI-assisted cyberattacks targeting financial institutions. This directive comes as CERT-In identified 'CRAFTY FALCON' using Rs. 1 test transfers and shared IP pools to bypass security.
The Numbers
- NBFCs using bank APIs must complete CERT-In audits before onboarding new clients, and existing ones by February 3, 2027.
- Banks must maintain a full API client inventory, including business profiles, transaction limits, and key contacts for each client.
- The advisory requires annual audits for all API clients, with immediate repeat audits after any material cyber incident.
- Non-NBFC API clients like BCs, PAs, and PSPs need risk assessments and periodic audits within three months, or sooner if risk is high.
- Banks must brief all API clients every three months on the current threat landscape.
What Happens Next
🇮🇳 Why This Matters for India
For Mumbai and Bangalore-based fintech product managers building payment integrations, this means a significantly higher compliance burden and stricter partner onboarding timelines.
The Take
The RBI is explicitly shifting the liability for ecosystem security to banks, forcing them to bear the cost and oversight. This will create a boom for CERT-In empaneled auditors, while smaller fintechs and NBFCs face increased operational costs and potential partner churn by early 2025.
Source:
MediaNama ↗