The Reserve Bank of India (RBI) has issued the Authentication Mechanisms for Digital Payment Transactions Directions, 2025. The framework, which comes into effect from April 1, 2026, will apply to all payment providers, including banks and fintech companies.
Currently, most digital payments in India rely on SMS-based one-time passwords. The new rules expand the options by allowing authentication through biometrics, device-based tokens, and passphrases. Every transaction will need at least two separate authentication factors, one of which must be dynamic and unique to that specific transaction.
The guidelines place strong emphasis on interoperability, requiring authentication and tokenisation services to work across all apps and channels. Issuers will also be allowed to apply additional checks based on risk factors such as unusual device use or irregular transaction patterns.
The RBI has made issuers responsible for the strength of their authentication systems. Any loss caused by non-compliance will have to be fully compensated to the customer. The new framework also requires adherence to the Digital Personal Data Protection Act, 2023.
For cross-border transactions, Indian card issuers must set up systems to validate non-recurring card-not-present transactions by October 1, 2026. They will also be required to carry out risk-based checks on all such transactions and register their Bank Identification Numbers with card networks.
Certain exemptions from two-factor authentication will remain, including small offline payments, recurring e-mandates, and transit-related transactions. At the same time, several earlier circulars on card security have been withdrawn, bringing all requirements under a single set of rules.
Commenting on the development, Vishwas Patel, Chair of the Payments Council of India and Joint Managing Director of Infibeam Avenues, said: “…. The clarity and flexibility provided will enable issuers and payment players to embrace next-generation tools like biometrics, tokenisation, and contextual risk checks. By keeping security at the core, the RBI has paved the way for a safer, simpler, and more inclusive digital payments experience for both consumers and businesses.”
Also read: Viksit Workforce for a Viksit Bharat
Do Follow: The Mainstream formerly known as CIO News LinkedIn Account | The Mainstream formerly known as CIO News Facebook | The Mainstream formerly known as CIO News Youtube | The Mainstream formerly known as CIO News Twitter |The Mainstream formerly known as CIO News Whatsapp Channel | The Mainstream formerly known as CIO News Instagram
About us:
The Mainstream formerly known as CIO News is a premier platform dedicated to delivering latest news, updates, and insights from the tech industry. With its strong foundation of intellectual property and thought leadership, the platform is well-positioned to stay ahead of the curve and lead conversations about how technology shapes our world. From its early days as CIO News to its rebranding as The Mainstream on November 28, 2024, it has been expanding its global reach, targeting key markets in the Middle East & Africa, ASEAN, the USA, and the UK. The Mainstream is a vision to put technology at the center of every conversation, inspiring professionals and organizations to embrace the future of tech.
