The Reserve Bank of India (RBI) has introduced the Authentication Mechanisms for Digital Payment Transactions Directions, 2025, a unified framework that will come into effect from April 1, 2026. The rules apply to all payment providers, including banks, card issuers, and fintech firms.
Currently, digital transactions in India depend largely on SMS-based OTPs. The new framework expands the scope of authentication, allowing the use of biometrics, device-based tokens, and passphrases. Every transaction must involve at least two distinct authentication factors, with one being dynamic and unique to that transaction.
A key emphasis is interoperability, ensuring that tokenisation and authentication services function seamlessly across apps and payment channels. Issuers will also be allowed to deploy risk-based checks, such as additional verification for unusual device use or suspicious transaction patterns.
Responsibility for securing transactions now rests firmly with issuers. If a lapse in compliance results in customer loss, the issuer must provide full compensation. The framework also mandates strict adherence to the Digital Personal Data Protection Act, 2023.
For cross-border card transactions, Indian issuers must, by October 1, 2026, establish validation mechanisms for non-recurring “card-not-present” payments. They are also required to implement risk-based monitoring and register their Bank Identification Numbers (BINs) with card networks.
Some exemptions from two-factor authentication remain, such as for offline small-value payments, recurring e-mandates, and transit-related transactions. Older RBI circulars on card security have been withdrawn, consolidating all norms under this single framework.
According to Vishwas Patel, Chair of the Payments Council of India, the clarity provided by the new guidelines will enable adoption of next-generation tools like biometrics, tokenisation, and contextual checks, ensuring that India’s digital payment ecosystem becomes more secure, seamless, and inclusive.
Stay curious. Stay ambitious. Stay connected with StartupStoryindia.
