The two-factor rule for a domestic digital payment now runs under one set of Directions, with one factor dynamic and the issuer bearing any loss on a payment that does not comply

The Reserve Bank of India (Authentication mechanisms for digital payment transactions) Directions, 2025, issued on 25 September 2025, required every payment system provider and participant, bank or non-bank, to comply by 1 April 2026. A domestic digital payment needs at least two distinct factors of authentication unless it is exempted, and at least one of them must be dynamic unless the card is physically used at the point of transaction. Card issuers had until 1 October 2026 to put in place a mechanism to validate non-recurring overseas card not present payments where the overseas merchant or acquirer asks for authentication, and a risk-based mechanism for all of them. Where a loss arises from a transaction effected without complying, the issuer compensates the customer in full.

What changed, and from when?

The two-factor norm is older than the Directions. Their own introduction says that all digital payment transactions in India are already required to meet it, that no specific factor was mandated, and that the ecosystem primarily adopted the one time password sent by short message service (SMS) as the additional factor. The Directions were announced in the Reserve Bank's Statement on Developmental and Regulatory Policies of 8 February 2024, to let the payments ecosystem use alternative authentication mechanisms, and they set broad principles rather than a prescribed factor. The cross-border provisions follow the Statement of 7 February 2025.

The Directions are issued under section 18 read with section 10(2) of the Payment and Settlement Systems Act, 2007 (Act 51 of 2007). Paragraph 3 fixes the date: all payment system providers and payment system participants "shall ensure compliance with these directions by April 01, 2026, unless indicated otherwise for any specific provision herein". The one provision that indicates otherwise is paragraph 10, on cross-border card payments, which carries 1 October 2026.

Paragraph 11 and Annexure-2 repeal eight circulars issued between 18 February 2009 and 6 December 2016 on the security of card transactions. They include the circulars on card not present transactions, on interactive voice response transactions and on online alerts to the cardholder. The last in the list is the circular of 6 December 2016 titled as a relaxation in the additional factor of authentication for payments up to INR 2,000 for card network provided authentication solutions.

Who does it bind?

Paragraph 4 applies the Directions to all payment system providers and payment system participants, banks and non-banks, and to all domestic digital payment transactions "unless specifically exempted otherwise". A digital payment transaction has the meaning of electronic funds transfer in the 2007 Act.

The duty to make good a loss falls on the issuer, and the definition is wide: "a bank or a non-bank that maintains the customer's account from which payment is made, such as a deposit account or a credit line or a prepaid instrument". A non-bank issuer of a prepaid instrument, and a lender whose credit line is the source of the payment, are issuers for this purpose in the same way as a bank holding a savings account.

What does the text require?

Paragraph 6 sets three principles.

Two factors. Paragraph 6(a) requires every digital payment transaction to be "authenticated by at least two distinct factors of authentication", unless exempted. A factor is a credential drawn from something the user has, knows or is. The definition lists, among others, a password, an SMS-based one time password, a passphrase, a personal identification number (PIN), card hardware, a software token, a fingerprint, and any other biometric, whether device native or Aadhaar based. The note to paragraph 6(a) lets issuers, at their discretion, offer customers a choice.

One dynamic factor. Paragraph 6(b) applies to every transaction other than a card present one. At least one factor must be "dynamically created or proven", which the paragraph explains as a proof of possession, sent with the transaction, that "is unique to that transaction". A static PIN or password can be one of the two factors. In a payment other than a card present one, the other factor has to be dynamic.

Independence. Paragraph 6(c) requires that "compromise of one factor does not affect reliability of the other".

Three further paragraphs complete the scheme. Paragraph 7 requires providers and participants to offer authentication or tokenisation services accessible to "all the applications / token requestors functioning in that operating environment", and the note defines operating environment to include device hardware and the operating system. Paragraph 8 lets an issuer test transactions against behavioural and contextual parameters and add checks beyond two factors where the risk warrants, and says issuers may explore DigiLocker as a platform for notification and confirmation of high-risk transactions. Paragraph 9 makes the issuer responsible for the robustness of the mechanism before deployment, requires adherence to the Digital Personal Data Protection Act, 2023, and states the liability rule: "If any loss arises out of transactions effected without complying with these directions, the issuer shall compensate the customer for the loss in full without demur."

One related rule sits in a different instrument. Paragraph 10(e) of the Reserve Bank of India (Regulation of Payment Aggregators) Directions, 2025, of 15 September 2025, bars a payment aggregator from offering the automated teller machine (ATM) PIN as a factor of authentication for card not present transactions.

Which payments are exempt?

Annexure-1, as it now appears on the Reserve Bank's website, lists seven exemptions from paragraph 6(a), and states that later additions or modifications also apply:

• small-value contactless card transactions;
• recurring transactions, other than the first, under the e-mandate framework;
• select prepaid payment instruments, such as those for mass transit systems and gift instruments;
• National Electronic Toll Collection transactions;
• small value digital payments in offline mode;
• travel bookings through commercial or corporate cards;
• tap and pay payments over the Unified Payments Interface on point of sale machines enabled for near field communication, under a letter of 2 September 2026 to the National Payments Corporation of India.

The letter of 2 September 2026 is not among the texts read for this note; what is stated about this exemption is its entry in Annexure-1 and nothing more.

Two of these carry figures. The circular of 4 December 2020 on contactless card payments raised the per transaction limit for relaxation of the additional factor from INR 2,000 to INR 5,000, from 1 January 2021, and left the cardholder's choice between contact and contactless mode in place. The Digital Payments - E-mandate Framework, 2026, of 21 April 2026, which repealed eight earlier e-mandate instructions and took effect immediately, requires the additional factor at registration and on the first transaction. After that, paragraph 8 allows recurring transactions without it up to INR 15,000 per transaction, and up to INR 1,00,000 per transaction for insurance premiums, mutual fund subscriptions and credit card bill payments. Paragraph 6 of the Framework requires a pre-transaction notification at least twenty-four hours before the debit.

How do the dates and figures work?

From issue on 25 September 2025, the domestic rules allowed 188 days to 1 April 2026. The cross-border obligation allowed 371 days to 1 October 2026, or 183 days beyond the domestic date.

An illustration. The cardholder, the amounts and the dates below are hypothetical. The rules are the ones cited in this note.

One cardholder, October 2026
  Contactless tap, INR 4,500                 under INR 5,000,
                                             second factor not required
  Contactless tap at a shop, INR 6,200       above the limit, two
                                             factors
  Streaming renewal on e-mandate, INR 649    recurring and under
                                             INR 15,000, second factor
                                             not required
  Insurance premium on e-mandate,
    INR 82,000                               under INR 1,00,000 for
                                             premiums, second factor
                                             not required
  Software renewal on e-mandate,
    INR 18,000                               over INR 15,000, second
                                             factor each time
  Domestic online purchase, INR 1,500        two factors, one dynamic;
                                             the INR 2,000 card network
                                             relaxation is repealed
  Overseas website, one-off purchase, card not present,
    INR 9,000, request raised by the
    overseas acquirer on 20 October 2026     paragraph 10 mechanism to
                                             have been in place since
                                             1 October 2026

A loss
  Domestic online debit authorised on a
    static password alone                    INR 48,000
  Compensation by the issuer, paragraph 9    INR 48,000, in full

The last line is the arithmetic of paragraph 9 read on its own terms, and assumes the whole INR 48,000 is the loss. The text does not scale the compensation to the customer's conduct, cap it, or set a period within which it is to be claimed. It ties the obligation to a loss arising out of a transaction effected without complying with the Directions.

What does it mean, and for whom?

For a bank or non-bank issuer, the cost of a mechanism that does not meet the Directions falls on the issuer. The duty to ensure robustness and integrity attaches before deployment, and the compensation duty attaches to any loss from a transaction that does not comply.

For a payment aggregator, the Authentication Directions apply to the extent the aggregator is a payment system provider or participant, and its own Directions separately close off the ATM PIN as a factor for card not present payments.

For the makers of operating systems, wallets and applications, paragraph 7 is the provision with the widest reach. An authentication or tokenisation service offered in an operating environment is to be accessible to all applications and token requestors in that environment, for all use cases, channels and token storage mechanisms, with those terms read as in the Reserve Bank's directions on tokenisation of card transactions of 8 January 2019.

For an Indian card issuer whose cardholders buy from overseas merchants, paragraph 10 sets two duties from 1 October 2026: a mechanism to validate non-recurring cross-border card not present transactions where the overseas merchant or acquirer raises a request for authentication, with the issuer's Bank Identification Numbers registered with the card networks, and a risk-based mechanism for handling all cross-border card not present transactions.

What remains unsettled?

Four points.

When the repeal took effect. Paragraph 11 repeals the circulars in Annexure-2 without a date of its own, while paragraph 3 sets 1 April 2026 for compliance. The text does not say whether the 2016 relaxation for card network solutions fell away on 25 September 2025 or survived until 1 April 2026.

Whether paragraph 9 reaches cross-border payments. Paragraph 10 opens by saying that "the directions outlined above are not applicable to cross-border digital payment transactions", and then imposes its own duties on card issuers. The compensation rule in paragraph 9 speaks of a transaction "effected without complying with these directions". Whether a failure to maintain the paragraph 10 mechanism is such a transaction is not answered by the text.

How paragraph 9 sits with the Reserve Bank's instructions on limiting a customer's liability for unauthorised transactions. The E-mandate Framework applies those instructions to recurring payments in paragraph 9(b). The Authentication Directions do not mention them, and say nothing on whether the full compensation they require operates alongside those instructions or displaces them.

What paragraph 6(b) demands of a factor. "Unique to that transaction" is ordinarily met by a one time password generated for that transaction. Whether a device-bound biometric that unlocks a stored key meets it depends on how the proof sent with the transaction is generated, and the Directions leave that to the issuer's own assessment of robustness under paragraph 9.