RBI orders two-factor, dynamic auth for digital payments by Apr 2026

The Reserve Bank of India on Thursday issued new directions to strengthen authentication for digital payment transactions, mandating two-factor authentication with at least one dynamic factor and requiring payment providers to comply by April 1, 2026. The Authentication Mechanisms for Digital Payment Transactions Directions, 2025 cover all payment system providers and participants, including banks and nonbank entities, and include specific additional requirements for certain crossborder card transactions to be implemented by October 1, 2026.

Under the new framework, every domestic digital payment must be protected by at least two distinct authentication factors drawn from the categories of something the user knows, something the user has, and something the user is. The RBI requires that, for transactions other than card-present payments, at least one factor be dynamically created or proven and unique to that transaction, to reduce reuse and interception risks that have accompanied widespread reliance on SMS-based one-time passwords.

The directions also embed a risk-based approach. Issuers are required to evaluate transactions using behavioral and contextual parameters such as...