Reserve Bank of India (Authentication mechanisms for digital payment transactions) Directions, 2025

What it does

The Directions, issued on 25 September 2025 under section 18 read with section 10(2) of the Payment and Settlement Systems Act, 2007, set the rule for authenticating a digital payment. Every domestic digital payment transaction must be authenticated by at least two distinct factors of authentication, unless it is exempted. A factor is a credential drawn from something the user has, knows or is, such as a password, a one time password sent by short message service, a personal identification number, card hardware, a software token or a biometric.

At least one of the two factors must be dynamically created or proven, which the Directions explain as a proof of possession sent with the transaction that is unique to that transaction. This applies to every transaction other than a card present one. The factors must also be independent, so that compromise of one does not affect the reliability of the other.

The two-factor norm is older than the Directions. Their introduction says that all digital payment transactions were already required to meet it, that no specific factor was mandated, and that the ecosystem had mostly adopted the one time password as the additional factor. The Directions set broad principles in order to let the ecosystem use other mechanisms.

Who it binds

All payment system providers and payment system participants, banks and non-banks alike, and all domestic digital payment transactions unless specifically exempted. The duty to make good a loss falls on the issuer, defined as the bank or non-bank that maintains the customer's account from which payment is made, such as a deposit account, a credit line or a prepaid instrument. A non-bank issuer of a prepaid instrument, and a lender whose credit line is the source of the payment, are issuers in the same way as a bank holding a savings account.

What moved out of it

Paragraph 11 and Annexure-2 repeal eight circulars issued between 18 February 2009 and 6 December 2016 on the security of card transactions. They include the circulars on card not present transactions, on interactive voice response transactions and on online alerts to the cardholder, and the circular of 6 December 2016 that relaxed the additional factor for payments up to INR 2,000 on card network authentication solutions.

What has changed, and when

All providers and participants had to comply by 1 April 2026, unless a provision said otherwise. The one provision that does is paragraph 10, on cross-border card payments, which carries 1 October 2026. By that date a card issuer had to put in place a mechanism to validate non-recurring overseas card not present payments where the overseas merchant or acquirer asks for authentication, and a risk-based mechanism for all of them.

What turns on it in practice

The firm's note on financial technology and payments states the effect for a business that takes or makes payments. The liability rule is the one with consequences. Paragraph 9 says that if any loss arises from a transaction effected without complying with the Directions, the issuer shall compensate the customer for the loss in full without demur. A step left out of a payment flow therefore puts a cost on the issuer.

The exemptions are a list in Annexure-1, and include small-value contactless card transactions, recurring transactions other than the first under the e-mandate framework, and certain prepaid instruments. The relaxation up to INR 5,000 for contactless card payments dates from a circular of 4 December 2020. Under the Digital Payments e-mandate framework of 21 April 2026, recurring transactions after registration may go without the additional factor up to INR 15,000, and up to INR 1,00,000 for insurance premiums, mutual fund subscriptions and credit card bill payments. A pre-transaction notification is required at least twenty-four hours before the debit.