RBI reportedly tells banks to audit API clients after AI-assisted cyberattacks

MediaNama reports, citing an exclusive by Head and Tale's Arti Singh, that the Reserve Bank of India met banks for nearly two hours over AI-assisted cyberattacks on the financial sector and circulated a confidential advisory dated 3 November. A banker quoted in the account said the regulator told banks sharply that they are responsible for securing these arrangements. The same banker put single frauds anywhere between Rs. 3 crore and Rs. 15 crore.

The advisory concerns the application programming interfaces that lenders use to disburse money. It reportedly asks banks to keep a full inventory of API clients, to require NBFC clients to pass an audit by a CERT-In empanelled auditor before onboarding, with existing clients given until February 3, 2027, and to repeat audits at least yearly. Non-NBFC clients are to be risk-assessed immediately, with periodic audits within three months for categories such as business correspondents, payment aggregators and fintechs. Banks must also brief clients every quarter on threats.

Other controls include fraud monitoring with per-client thresholds and behavioural baselines, alerts on volume spikes, amounts just under limits and odd-hour activity, whitelisting of beneficiaries, and maker-checker or out-of-band approval of debit requests. Per-transaction and daily limits apply immediately, and velocity limits are due within one month. The report adds that new integrations need at least one safeguard before going live, and existing ones have until December 3, 2026 to add one.

Separately, a CERT-In advisory dated November 4 named a threat actor, CRAFTY FALCON, which tested fund flows with Rs. 1 transfers and bypassed IP allow-listing through shared third-party IP pools. The Indian Cyber Crime Coordination Centre also issued a public advisory.