The RBI dressed down bank chiefs last week after AI-assisted cyberattacks led to individual frauds of up to Rs. 15 crore. The regulator now extends blame and mandates security audits across banks' entire API-connected ecosystem, including NBFCs and fintechs. Fintechs relying on bank APIs for lending or payments face immediate, mandated security audits and operational cost increases.
How We Got Here
CERT-In has been publishing advisories on vulnerabilities for months, even naming the threat actor 'CRAFTY FALCON' on November 4. The urgency escalated after attackers bypassed IP allow-listing and tested fund flows with Re. 1 transfers before executing larger frauds.
The Numbers
- RBI’s confidential advisory, issued November 3, mandates CERT-In empaneled audits for all NBFCs using bank APIs.
- New NBFC clients need an audit before onboarding; existing ones have until February 3, 2027, to comply.
- Non-NBFC API clients like BCs, PAs, PSPs, and fintechs must undergo periodic audits within three months, or sooner if risk is higher.
- Banks must maintain a full inventory of API clients, detailing business profiles, transaction limits, and key contacts.
- RBI also requires banks to brief all API clients quarterly on the current threat landscape.
What Happens Next
🇮🇳 Why This Matters for India
For fintech founders in Bangalore and Pune building on bank APIs for lending or payments, this means immediate investment in rigorous security audits and a tighter operational leash from banking partners.
The Take
The RBI is effectively offloading part of its cyber security burden onto smaller, connected entities. This will filter out undercapitalized fintechs and accelerate M&A activity for those with robust compliance already in place.
Source:
MediaNama ↗