RBI CIRCULAR

Reserve Bank of India (Authentication mechanisms for digital payment transactions) Directions, 2025

- 

1. Introduction

All digital payment transactions in India are required to meet the norm of two factors of authentication. While no specific factor was mandated for authentication, the digital payments ecosystem has primarily adopted SMS-based One Time Password (OTP) as the additional factor.

As announced in Statement on Developmental and Regulatory Policies dated February 08, 2024, in order to enable the payments ecosystem to leverage the technological advancements for implementing alternative authentication mechanisms, it has been decided to publish Reserve Bank of India (Authentication mechanisms for digital payment transactions) Directions, 2025 (hereinafter referred to as “Directions”). The directions provide the broad principles which shall be complied with by all the participants in the payment chain, while using a form of authentication.

While these directions are applicable only to domestic transactions, in order to provide a similar level of safety for online international transactions undertaken using cards issued in India, the directions also incorporate necessary instructions for specific cross-border card transactions, in line with the Statement on Developmental and Regulatory Policies dated February 07, 2025.

These directions are issued under Section 18 read with Section 10(2) of the Payment and Settlement Systems (PSS) Act, 2007 (Act 51 of 2007).

2. Short title

These directions shall be called Reserve Bank of India (Authentication mechanisms for digital payment transactions) Directions, 2025

3. Effective Date

All Payment System Providers and Payment System Participants, including banks and non-bank entities, shall ensure compliance with these directions by April 01, 2026, unless indicated otherwise for any specific provision herein.

4. Applicability