RBI’s Authentication Mechanisms for Digital Payment Transactions Directions, 2025 mark the biggest change to Indian payment authentication since the card “additional factor of authentication” rules. The general compliance date was 1 April 2026, and the cross-border card-not-present requirement applies from 1 October 2026. If your stack still treats SMS OTP as the only second factor, it is time to revisit it.
What the directions require
- Two distinct factors for every domestic digital payment, drawn from something you know, something you have and something you are
- At least one dynamic factor that is unique to each transaction
- Technology neutrality: SMS OTP is still allowed, but it is no longer assumed. Issuers can use app-based tokens, device binding, biometrics, passkeys and similar
- Risk-based authentication: issuers may use behaviour, device and location signals to decide when to step up
- Liability on the issuer if non-compliance leads to customer loss
- Cross-border CNP: issuers must be able to validate non-recurring cross-border card-not-present transactions when the merchant or acquirer asks
Practical implications
For issuers and wallet providers
- Map every payment journey (cards, UPI, net banking, wallets) to the factors it uses today, and flag any journey that relies only on SMS OTP
- Prioritise device binding with in-app cryptographic signing or push approval. It is stronger and cheaper than SMS over time
- Document your risk-based authentication logic, because auditors will ask how step-up decisions are made
For payment aggregators and merchants
- Expect more frictionless-but-risk-scored flows and more step-up challenges on risky transactions. Test conversion impact early
- Make sure your checkout handles issuer step-up gracefully, including timeouts and retries
For security teams
- Threat-model the new factors: device binding can be undermined by rooted devices, overlay malware and screen sharing
- Log authentication decisions in enough detail to reconstruct a disputed transaction, and keep them for at least 180 days in India per CERT-In
Bottom line
The directions reward investment in strong, app-based authentication and penalise inaction through liability. Treat them as a security upgrade programme, not a checkbox.
This article is a practitioner’s summary, not legal advice. Refer to the RBI directions for the authoritative text.
Leave a Reply