Reserve Bank of India rules have mandated that all digital payment transactions in India are required to meet the norm of two factors of authentication — impacting users of major platforms like PhonePe, Google Pay and Paytm.
RBI has said that all Payment System Providers and Payment System Participants, including banks and non-bank entities, shall ensure compliance with these directions by April 01, 2026, unless indicated otherwise for any specific provision.
These directions shall be applicable to all Payment System Providers and Payment System Participants (banks and non-banks). These directions apply to all domestic digital payment transactions, unless specifically exempted otherwise.
“While no specific factor was mandated for authentication, the digital payments ecosystem has primarily adopted SMS-based One Time Password (OTP) as the additional factor,” reads the RBI circular.
The central bank has made two-factor authentication (2FA) mandatory for all digital payments, including those made through UPI, debit and credit cards, and mobile wallets.
RBI has said that it shall be ensured that for digital payment transactions, other than card present transactions, at least one of the factors of authentication is dynamically created or proven, i.e., the proof of possession of the factor, being sent as part of the transaction, is unique to that transaction.
The factor of authentication shall be such that compromise of one factor does not affect reliability of the other.
RBI added that the directions outlined above are not applicable to cross-border digital payment transactions. However, card issuers shall, by October 01, 2026, put in place a mechanism to validate non-recurring, cross-border card not present (CNP) transactions, where request for authentication is raised by an overseas merchant or overseas acquirer. To ensure compliance, card issuers shall register their Bank Identification Numbers (BINs) with card networks.
From April 1, 2026, making digital payments in India is set to become more secure, but slightly more time-consuming, as the Reserve Bank of India (RBI) rolls out new rules for online transactions.
