RBI makes two-factor authentication mandatory for digital payments; norms to apply from 1 April 2026
RBI has issued new directions for stronger authentication in digital payments, requiring at least two factors with one dynamic element. Payment ecosystem players must comply by 1 April 2026, as India pushes for safer, more resilient digital transactions.
A new security baseline for digital payments
The Reserve Bank of India (RBI) has issued directions to strengthen authentication in digital payment transactions, mandating two-factor authentication across the payment ecosystem. The framework, under the RBI’s Authentication Mechanisms for Digital Payment Transactions Directions, 2025, will come into effect from 1 April 2026 for domestic digital payments.
The intent is to reduce fraud risk in a high-usage environment where payments increasingly happen via apps, wallets, cards and other digital rails. RBI’s approach does not position the change as a single technology upgrade; instead, it sets a minimum standard that payment system providers and participants must meet, regardless of platform, device, or channel.
What ‘two factors’ means in practice
As per the directions reported, transactions will need at least two distinct authentication factors, and at least one factor must be dynamic—unique to the transaction—so it cannot be easily reused by attackers. The shift reflects a recognition that threats evolve quickly and that relying on a single familiar method can create systemic vulnerabilities.
While SMS OTPs have been a common second factor for years, the broader ecosystem has been moving toward alternatives like app-based authentication, device-native biometrics and token-based methods. The RBI’s rules are designed to let technology choices evolve while still enforcing a secure minimum standard.
Why the deadline matters
The compliance date—1 April 2026—creates a hard milestone for banks, non-bank entities, and payment operators to update their flows, user journeys and risk controls. For merchants and consumer apps, it can mean changes in checkout screens and additional verification steps, especially for transactions that are flagged as higher risk.
For users, the main impact should be a higher likelihood of step-up checks in certain cases, particularly as providers integrate contextual signals and risk-based decisioning. The broader promise is improved trust: if digital payments feel safer and disputes are resolved faster, adoption and usage can remain strong without compromising security.