Blog

The Reserve Bank of India has released new directions on authentication mechanisms for digital payment transactions, 2025, aimed at strengthening the security of India’s rapidly expanding digital payments ecosystem. Under the updated framework, all digital payment transactions must be authenticated using at least two separate factors, such as passwords, PINs, biometrics, or device‑based tokens, moving beyond reliance on SMS‑based OTPs. At least one factor must be dynamic for transactions where the card is not physically present, enhancing protection against fraud.

These directions apply to all payment system participants, including banks and fintechs, and will come into effect from April 1, 2026. Issuers are required to ensure the robustness of authentication systems and may adopt risk‑based approaches for higher‑risk transactions, improving security without compromising user convenience.