Skip to main content

Authentication mechanisms for digital payment transactions

Reserve Bank of India (RBI) has issued directions on authentication mechanisms for digital payment transactions.

What is the rationale behind the directions?

All digital payment transactions in India are required to meet the norm of two factors of authentication. While no specific factor was mandated for authentication, the digital payments ecosystem has primarily adopted SMS-based One Time Password (OTP) as the additional factor. To enable the payments ecosystem to leverage the technological advancements for implementing alternative authentication mechanisms, RBI has issued the directions on authentication mechanisms for digital payment transactions.

What is Authentication?

Authentication is a process of validating and confirming the credentials of the customer who is originating the payment instruction.

What is Factor of Authentication?

Factor of Authentication is the credential of the customer which is used for authentication. The factors of authentication can be from “something the user has”, “something the user knows” or “something the user is” and may comprise, inter-alia, password, SMS based OTP, passphrase, PIN, card hardware, software token, fingerprint, or any other form of biometrics (device native or Aadhaar based).

To which entities / transactions shall the directions be applicable?

The directions shall be applicable to –

  • Payment System Providers and Payment System Participants (banks and non-banks)
  • Domestic digital payment transactions

What are the principles for authentication of digital payment transactions?

  • Minimum two factors of authentication – All digital payment transactions shall be authenticated by at least two distinct factors of authentication. Issuers (bank / non-bank maintaining customer’s account from which payment is made, such as deposit account / credit line / prepaid instrument) may, at their discretion, offer a choice of authentication factors to their customers.
  • At least one of the factors to be dynamic – It shall be ensured that for digital payment transactions, other than card present transactions, at least one of the factors of authentication is dynamically created or proven, i.e., the proof of possession of the factor, being sent as part of the transaction, is unique to that transaction.
  • Robust – The factor of authentication shall be such that compromise of one factor does not affect reliability of the other.

Which transactions are exempted from two factor authentication?

The following transactions are exempted from the requirement of two factor authentication –

  • Small-value Contactless Card transactions
  • Recurring transactions (other than the first) under the e-mandate framework
  • Select Prepaid Instruments such as Prepaid Payment Instrument - Mass Transit Service (PPI-MTS) and Gift PPIs
  • National Electronic Toll Collection (NETC) transactions
  • Small value digital payments in offline mode
  • Travel booking involving Global Distribution System / IATA through commercial / corporate cards.

What are other directions?

  • Based on the perceived risk associated with the transaction, additional checks beyond the minimum two-factor authentication may be resorted to. Issuers may also explore using DigiLocker as a platform for notification and confirmation for high-risk transactions.
  • If any loss arises out of transactions effected without complying with the directions, the issuer shall compensate the customer for the loss in full without demur.
  • The directions are not applicable to cross-border digital payment transactions. However, card issuers shall, by October 01, 2026, put in place a mechanism to validate non-recurring, cross-border card not present (CNP) transactions, where request for authentication is raised by an overseas merchant or overseas acquirer. To ensure compliance, card issuers shall register their Bank Identification Numbers (BINs) with card networks.

From when shall the directions be applicable?

Payment System Providers and Payment System Participants, including banks and non-bank entities, shall ensure compliance with the directions by April 01, 2026.


References

Reserve Bank of India. (2025, September 25). 'RBI issues Directions on Framework on Authentication Mechanisms for Digital Payment Transactions'. Retrieved from https://rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=61282

Reserve Bank of India. (2025, September 25). 'Reserve Bank of India (Authentication mechanisms for digital payment transactions) Directions, 2025'. Retrieved from https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12898&Mode=0


Follow at - Telegram   Instagram   LinkedIn   X   Facebook

Labels:

Comments

Post a Comment

Popular Posts

Cash Reserve Ratio (CRR) and Statutory Liquidity Ratio (SLR)

Reserve Bank of India (RBI) has issued the directions on maintenance of Cash Reserve Ratio (CRR) and Statutory Liquidity Ratio (SLR) by banks. To whom are the directions applicable? The directions are applicable to the following Regulated Entities (REs) – Commercial Banks  Small Finance Banks (SFBs) Payments Banks (PBs) Local Area Banks (LABs) Regional Rural Banks (RRBs) Primary (Urban) Co-operative Banks (UCBs) Rural Co-operative Banks – State Co-operative Banks (StCBs) District Central Co-operative Banks (DCCBs) What is CRR? Every bank shall maintain in India by way of cash reserve, a sum equivalent to such percent of its Net Demand and Time Liabilities (NDTL) in India, as the RBI in terms of Section 42(1) of the RBI Act, 1934 (for scheduled banks) and Section 18(1) of the Banking Regulation Act (BR Act), 1949 (for non-scheduled banks) [including provisions of Section 18(1) of the BR Act as applicable to co-operative banks], may specify. What is incremental CRR? In terms of Secti...
Post a Comment
Read more

Special Rupee Vostro Accounts (SRVAs)

Reserve Bank of India (RBI) has consolidated the guidelines governing Special Rupee Vostro Accounts (SRVAs). Who can open and maintain Special Rupee Vostro Accounts (SRVAs)? Authorised Dealer (AD) banks in India may open Special Rupee Vostro Accounts (SRVAs) of its branch outside India or a bank resident outside India. Which transactions can be settled through SRVA? The settlement of cross-border trade transactions through SRVA is an additional arrangement for invoicing, payment and settlement of exports and imports in Indian Rupee (INR).  All permissible capital and current account transactions under Foreign Exchange Management Act (FEMA) may be settled through the SRVA.  AD banks maintaining SRVA are permitted to open additional current account for exporter / importer, exclusively for settlement of export / import transactions. What can be the source and use of funds in SRVA? SRVA may be funded by way of inward remittances or transfer from other repatriable INR accounts in t...
Post a Comment
Read more

Credit Cards and Debit Cards

Reserve Bank of India (RBI) has issued directions on issuance of credit cards and debit cards. To whom are the directions applicable? The directions are applicable to the following Regulated Entities (REs) – Commercial Banks  Small Finance Banks (SFBs) Regional Rural Banks (RRBs) Primary (Urban) Co-operative Banks (UCBs) Non-Banking Financial Companies (NBFCs) for all layers – NBFC-Investment and Credit Companies (NBFC-ICC) NBFC-Factor  NBFC-Micro Finance Institutions (NBFC-MFI)  Housing Finance Company (HFC)  What is a credit card? Credit Card is a physical / virtual payment instrument issued with a pre-approved revolving credit limit that can be used to purchase goods and services or draw cash advances. What is a debit card? Debit Card is a physical / virtual payment instrument linked to a Savings Bank / Current Account which can be used to withdraw cash, make online payments, do Point of Sale (PoS) terminal / Quick Response (QR) code transactions, fund transfer, e...
Post a Comment
Read more

Highlights of RBI Annual Report 2025-26 – Chapter 7 to 12

Reserve Bank of India (RBI) has published its annual report for the financial year 2025-26. In a series of articles, we will go through the highlights of the report. This is the fifth and final article in the series.  Chapter 7 – Public Debt Management The ways and means advances (WMA) limit for the Government of India (GoI) for H1:2025-26 (April to September 2025) was fixed at ₹1,50,000 crore and for H2:2025-26 (October 2025 to March 2026) was fixed at ₹50,000 crore. The RBI entered into an agreement with the Government of National Capital Territory of Delhi (GNCTD), under Section 21A(1) of the RBI Act, 1934, to carry on the general banking business of GNCTD and manage its rupee public debt. The WMA limit of GNCTD was set at ₹890 crore, taking the aggregate WMA limit of all the states / UTs to ₹61,008 crore. The RBI introduced Separate Trading of Registered Interest and Principal of Securities (STRIPS) in the state government securities. Retail Direct Gilt (RDG) account – An au...
Post a Comment
Read more

Payment of Agency Commission to Agency Banks (ABs) and Disbursement of Government Pension by ABs

Reserve Bank of India (RBI) has issued guidelines on the conduct of Government business by Agency Banks (ABs), payment of agency commission to ABs and disbursement of Government pension by ABs. Who are ABs? ABs mean all Public Sector Banks (PSBs), scheduled Private Sector Banks (PVBs), scheduled Payments Banks (PBs), and scheduled Small Finance Banks (SFBs) appointed by the RBI under Section 45 of the RBI Act, 1934, by mutual agreement, to carry out Government banking business of the Central Government (CG) / State Governments (SGs). What is agency commission? Agency commission means the remuneration paid by the RBI to an AB in consideration of it acting as an agent of the RBI in the conduct of general banking business of the CG and the SGs at the places and in the manner specified in the agreement between the RBI and the bank, with the exception of the functions relating to the management of the public debt. What are the guidelines on appointment of ABs? Any eligible bank which intend...
Post a Comment
Read more