RBI gives banks until 3 December to harden API payments

An API (application programming interface) is the software link that lets a bank accept automated payment instructions from fintechs and non-bank finance companies with a single command. The report says the RBI held a meeting of about two hours with banks; one banker said individual frauds ranged from 3 to 15 crore rupees (1 crore = 10 million). The advisory sets out three main controls: pre-registration of beneficiary accounts, per-transaction and daily limits, and dual authorisation of debit instructions. Transaction limits take effect immediately, and intraday velocity limits within a month.

Customers that are non-bank finance companies will have to pass an audit by a CERT-In-empanelled auditor; the deadline for existing customers is 3 February 2027. StudyCafe reported on 1 November that the RBI had earlier asked banks to prove compliance with existing cyber rules. The same report says two non-bank lenders in Mumbai lost about 2 million dollars on 8–9 October through more than 700 unauthorised instant transfers.

The text of the confidential advisory is not public; as of 6 November its provisions could be verified only through summaries in the press. No data could be found on whether the 2 million dollars in losses was covered by insurance. The RBI's requirement books the cost of preventing such losses to banks' operating budgets for the end of 2026.