Defin News: FinTech and AI on 11 October 2026

01Top story

Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers in BFSI Entities

PaymentsAPAC

CERT-In, 9 October 2026

India's CERT-In warned on 9 October that attackers are stealing payment-gateway and partner-bank API credentials at NBFCs, lenders, PSPs and wallets, then calling disbursal APIs directly to bypass KYC, beneficiary checks and per-transaction limits. Funds move over IMPS and NEFT to mule accounts, and the agency recommends API-stage limits, maker-checker and real-time transfer monitoring.

Read the source

Why it matters

The attack works where controls live in the application while the payout API trusts any call from whitelisted infrastructure. Firms elsewhere that disburse through bank or gateway APIs with a similar design could face the same gap.

Takeaway

Check that limits, beneficiary validation and approval steps are enforced at the point where the debit is sent, not only in the upstream app. Rotate static API tokens and reconcile payouts against bank statements in near real time.

02All stories in this issue

02UK slaps sanctions on three crypto exchanges over alleged Russia linksThe UK sanctioned three crypto exchanges, including Cryptomus and TokenSpot, and payment platforms Processing KG (VexPay) and Tsunami Payments in a package of 38 Russia-related designations. Two targets handled transactions involving the A7 network behind the ruble-pegged A7A5 stablecoin, and British financial institutions are barred from processing payments through several of them.Why it mattersThe UK is now naming the payment processors around sanctioned stablecoin networks, not just the exchanges. That pushes screening duties deeper into the chain, onto PSPs and EMIs whose counterparties may route flows through such platforms.TakeawayLoad the new designations into screening lists and check merchant and counterparty data for the named brands, including VexPay. Routing rules should block payments to, from or through the listed firms rather than only flag them.CoinDeskRead the source Regulation9 OctRegulation9 Oct
03Apple Pay launches in IndiaApple launched Apple Pay in India on 30 September, initially for Axis Bank-issued Visa and Mastercard credit cards on iPhone, iPad and Apple Watch. PSPs including Razorpay, PayU, Paytm, Pine Labs and Juspay are enabling acceptance, while UPI and RuPay are not supported.Why it mattersThe launch tests whether tokenised card wallets can win share in a market where UPI's zero-fee model dominates. With one issuer at launch and banks added deal by deal, issuer onboarding will set the pace.TakeawayNo direct consequence for teams outside India. For those routing Indian card traffic, check that acquirers pass Apple Pay token transactions correctly and that risk rules do not treat the new wallet as an anomaly.Apple NewsroomRead the source Payments30 SeptPayments30 Sept
04HSBC and Ant Digital Pilot AI-Agent Payments With Tokenized DepositsHSBC and Ant Digital Technologies tested an AI-agent payment flow in which a simulated agent selected a digital service and paid a micropayment using HSBC's Tokenised Deposit Service, settled in real time on the Jovay testnet. Ant Digital's Anvita Flow handled discovery and execution, while HSBC ran settlement and real-time risk checks; the firms called it a technical test, not a product.Why it mattersBanks are positioning tokenised deposits, not only stablecoins, as the settlement asset for agent micropayments, with the bank keeping the risk check. If that model holds, agent payments stay inside regulated bank rails rather than moving to crypto-native ones.TakeawayNothing to change now: it is a testnet demo. Keep watching whether real-time risk checks in such pilots sit with the bank or the platform, because that decides where limits for agent payments will live.CryptoCompassRead the source AI10 OctAI10 Oct
05Swift Names Execs From HSBC, Citi and JPMorgan to New Supervisory BoardSwift moved to a two-tier governance structure with a new 15-member supervisory board, including executives from HSBC, Citi and JPMorgan and four independent directors, chaired by J.P. Morgan's Graeme Munro. The board will oversee Swift's plans for a blockchain-based ledger for tokenised assets and round-the-clock fund movements.Why it mattersThe large banks that will decide whether Swift's ledger succeeds now sit directly on the body overseeing it. Expect the 24/7 ledger's priorities to reflect what those member banks need.TakeawayNo immediate action. Keep tracking Swift's ledger timeline, because round-the-clock cross-border settlement would change cut-off assumptions in routing and liquidity rules.Fintech News SingaporeRead the source Infrastructure9 OctInfrastructure9 Oct
06Singapore Passes Bill to Address Risks Behind Digital Service OutagesSingapore's Parliament passed the Digital Infrastructure Bill on 7 October, requiring licences for data centres with at least 10MW of critical IT load and for cloud providers whose IaaS and PaaS revenue from Singapore users averages at least S$100m a year over three years. Licensees must keep recovery plans and report incidents to the Infocomm Media Development Authority (IMDA), with fines of up to S$1m or 10% of annual Singapore turnover, whichever is higher.Why it mattersRegulators are extending resilience duties beyond banks to the cloud and data-centre providers underneath them, after outages that stopped payments. Payment firms gain a regulated counterpart for incidents but still own their own continuity.TakeawayMap which payment providers and banks in the routing chain depend on a single cloud region, and keep failover routes that do not share it. Provider incident notices should feed routing decisions automatically.Fintech News SingaporeRead the source Regulation9 OctRegulation9 Oct

FinTech & AI on 11 October: 6 stories

01Top story

Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers in BFSI Entities

02All stories in this issue

03Past issues