Central Bank of India RTGS Glitch: One Loss, Three Versions

Central Bank of India RTGS Glitch: Three Versions From One Bank

At 9:56 on the night of Monday, 19 October, Central Bank of India’s Company Secretary and Compliance Officer, Chandrakant Bhagwat, digitally signed a letter to the National Stock Exchange and the BSE. It was brief. “A technical glitch was observed in RTGS outward system of the Bank during period from 15th October to 17th October 2026,” it said. The bank had taken “necessary steps to investigate and respond to the incident, including shutting down and isolating affected systems,” was “working with leading experts,” and confirmed “that no customer has suffered any financial loss on account of the incident.” The BSE logged it at 10:08 PM. It was the first the exchanges heard of the Central Bank of India RTGS incident.

Three days later, on 22 October, the bank’s General Manager for Treasury filed a complaint with the Additional Director General of Police, Maharashtra Cyber. The complaint, as reported, alleges that unknown persons gained unauthorised access to the central server of the Structured Financial Messaging System, which is run by IFTAS, a wholly owned subsidiary of the Reserve Bank of India, through the bank’s own SFMS server, and used it to move ₹13.97 crore out of the bank’s settlement account with the RBI in 187 transfers to 36 bank accounts. Maharashtra’s Nodal Cyber Police registered a case against unknown persons for cheating by personation.

On 24 October, IFTAS put a statement on its website. "We clarify that the Central SFMS System (Structured Financial Messaging System) managed by IFTAS and used by RTGS and NEFT payment systems is safe and secure and there is no compromise on any of the systems managed by IFTAS," it said. "Further investigation into the reported incident is ongoing at the concerned bank's end."

On 26 October, at 5:32 PM, the bank filed a second letter with the exchanges, “in continuation to” the first. The Central Bank of India RTGS outward system had been restored. “During the course of investigation, a technical issue was observed in the interface environment of localised RTGS server maintained at Bank’s end,” it said. Remedial measures had been taken. No customer had suffered a loss.

In one week, Central Bank of India has given three accounts of the same event. The stock exchanges were told of a glitch, and then of a technical issue at the bank’s end. The police were told of an intrusion into a server run by the RBI’s own subsidiary. The subsidiary says that did not happen. The ₹13.97 crore appears in the version given to the police. It appears in neither of the two filings to the stock exchanges.

Also Read:  Central Bank of India Fraud: Was the RBI’s Payment Backbone Breached?

The Board Approved the Results While the Third Day of Transfers Was Running

The bank’s own filings, read against the dates in its police complaint, show what its leadership was doing while the Central Bank of India RTGS transfers were running.

Six transfers left the settlement account on Thursday, 15 October, and 88 on Friday, 16 October. On the 19 October earnings call, the managing director, Kalyan Kumar, told analysts that “during last two days October 15, 2026 and October 16, 2026 we have mid-term strategy meet with our all general managers and regional heads,” at which they “brainstormed regarding revisiting our strategies towards focus areas.” Every general manager and regional head of Central Bank of India was in that meeting while 94 unauthorised transfers went out.

On Saturday, 17 October, 93 more transfers went out. That morning the board of directors met from 11:45 AM to 1:00 PM and approved the bank’s results for the quarter ended 30 September. The outcome of the board meeting reached the BSE at 1:24 PM, the results at 1:28 PM, the investor presentation at 1:37 PM, and a press release at 2:00 PM. The release, carrying the bank’s “Year of Business Excellence 2026-27” banner, reported net profit up 21.10% to ₹1,469 crore and gross NPA down to 2.39%. The results run to 36 pages, with notes to accounts, a limited review by four audit firms, and a certificate signed by the managing director and the chief financial officer.

None of them mentions the banking incident or any contingent loss. The quarter they cover closed two weeks before the transfers began, so no rule required a mention. But the board of Central Bank of India sat and signed the bank’s accounts on the day the last 93 unauthorised transfers were leaving its settlement account, and nothing in the record suggests anyone in the room knew.

On Sunday, 18 October, the results were advertised in the Indian Express, Financial Express, Jansatta and Loksatta.

On the morning of Monday, 19 October, the managing director, three executive directors and the chief financial officer held the earnings call. The transcript, filed with the exchanges on 23 October, is fifteen pages long. The Central Bank of India RTGS incident or any type of fraud is not mentioned in it. In his opening remarks the managing director thanked the bank’s stakeholders, “including our customers, regulators, governments.” An analyst asked about the bank’s investment in technology and was told about mobile app journeys and a new department. A General Manager for Treasury, Dr G. Bhaskar, took a question on provisions for security receipts.

At 3:23 that afternoon, the bank filed the audio recording of the call as letter number 187. At 9:56 that night, it filed the technical glitch disclosure as letter number 188. There is no letter between them. The disclosure says the bank acted ‘immediately upon becoming aware of the incident’. Either it was aware when its managing director spoke to investors that morning and the subject was not raised, or it became aware only that evening, two days after the transfers stopped. The bank has not said which.

“Only Information Available in Public Domain Was Discussed”

In the week after the 19 October Central Bank of India glitch disclosure, the bank’s management met investors three times. After each meeting, as the listing rules require, it filed a note with the exchanges recording who it met, and each note carried the same line: ‘Only information available in public domain was discussed in the meeting’. 

On 21 October, the managing director gave an interview to a business television channel on the quarter’s results: margins, cost of funds, slippages, recovery and treasury yields. He said the bank saw no stress signals anywhere in its book. The same day, the management held a virtual one-on-one meeting with Arihant Capital Markets. The filing recording that meeting, signed at 5:44 PM, carries a standard line: “Only information available in public domain was discussed in the meeting.”

On 22 October, management met Mytemple Capital Advisors in person. The filing, signed at 2:26 PM, carries the same line. At that point the only information in the public domain about the Central Bank of India RTGS incident was the word ‘glitch.’ On the same day, the General Manager for Treasury filed the police complaint alleging that ₹13.97 crore had been taken through the central messaging server run by the RBI’s subsidiary.

On 26 October, management held a virtual one-on-one with Tata Mutual Fund. The filing, signed at 4:57 PM, carries the same line again. Thirty-five minutes later, at 5:32 PM, the bank filed its second disclosure on the incident, which told the exchanges for the first time that the problem lay in a server 'maintained at Bank's end'.

Three investor meetings, two exchange filings, one earnings call and one television interview. In none of them has Central Bank of India said that money left its account. The only document in which the bank has written down ₹13.97 crore is a complaint at a police station.

Also Read:  RBI Bans Dark Patterns: A Confession Dressed as a Circular

The Bank’s Complaint Now Contradicts the Bank

The three accounts of the Central Bank of India RTGS glitch do not merely differ in tone. They locate the failure in different places.

The 19 October filing puts the glitch in the “RTGS outward system of the Bank.” The 22 October complaint puts the intrusion in IFTAS’s central SFMS server, reached through the bank’s server. The 26 October filing puts the issue in the “interface environment of localised RTGS server maintained at Bank’s end.” IFTAS, on 24 October, said its systems were not compromised and that the investigation was ongoing “at the concerned bank’s end.”

If IFTAS and the bank’s second filing are right, the bank’s own SFMS endpoint generated 187 payment messages that the central system accepted as genuine, that the bank’s core banking system never recorded, over three working days, with no one at Central Bank of India noticing. That is a failure of the bank’s controls, and the bank now appears to accept as much. But its police complaint alleges something different: that the central server of the payment messaging system run by the RBI’s subsidiary was accessed. The RBI’s subsidiary says it was not. The bank has not explained which of its two versions it stands by, or why it told the police one thing and the exchanges another four days later.

Nor has it told its shareholders anything about the money. In the September quarter results, the bank reported seven frauds totalling ₹35.53 crore and “Digital Frauds: 00.” The October incident will have to appear in the next quarter results.  

Set against the ₹17,809 crore the bank held in cash and balances with the RBI at the end of September, ₹13.97 crore is a small sum. Set against the line the bank attaches to every investor meeting filing, that only public information was discussed, it is the sum that was never made public.

The Probe has asked Central Bank of India whether it stands by the description of the incident as a technical glitch, how its police complaint squares with its 26 October filing, whether the complaint has been amended, and whether any of the ₹13.97 crore has been recovered. It has asked IFTAS whether it has examined the central SFMS server and shared findings with the bank, and the RBI whether it has advised other banks to check their SFMS endpoints. This story will be updated when they respond.