Source: RBI
The Reserve Bank of India (RBI) has released the “Authentication Mechanisms for Digital Payment Transactions” Directions, 2025, aiming to strengthen the security of digital payments in India. All digital payment transactions in the country are required to use two-factor authentication (2FA). While SMS-based One-Time Passwords (OTPs) have been widely used so far, the new directions allow alternative authentication methods leveraging advanced technology.
These directions, issued under Section 18 read with Section 10(2) of the Payment and Settlement Systems (PSS) Act, 2007, primarily apply to domestic transactions. For online international transactions using Indian-issued cards, the guidelines also set standards for cross-border card transactions, in line with RBI’s 2025 regulatory updates.
Key Highlights of RBI Directions 2025:
- Effective Date: April 1, 2026, for all Payment System Providers and Participants, including banks and non-bank entities.
- Applicability: All domestic digital payment transactions, unless specifically exempted.
- Authentication Principles:
- Minimum two factors of authentication are mandatory, one of which must be dynamic for non-card-present transactions.
- Authentication methods should be robust, ensuring that compromising one factor does not affect the other.
- Issuers may offer customers a choice of authentication factors.
- Interoperability: Authentication or tokenization services must be accessible across all platforms, channels, and devices.
- Risk-Based Approach: Issuers can apply additional checks for high-risk transactions based on behavioural or contextual parameters, including transaction location, user behaviour, device attributes, or transaction history. Platforms like DigiLocker may be used for notifications or confirmations of such transactions.
- Issuer Responsibilities:
- Ensure robustness of authentication mechanisms before deployment.
- Compensate customers fully for any losses resulting from non-compliance with these directions.
- Comply with the Digital Personal Data Protection Act, 2023.
- Cross-Border Transactions:
- While domestic directions do not directly apply, card issuers must implement mechanisms to validate non-recurring cross-border card-not-present transactions by October 1, 2026.
- Issuers must register their Bank Identification Numbers (BINs) with card networks and establish risk-based controls for cross-border transactions.
The RBI’s 2025 Directions aim to enhance the security, reliability, and interoperability of India’s digital payments ecosystem while aligning with global best practices for cross-border transactions.
Author
