Reserve Bank of India (Authentication Mechanisms for Digital Payment Transactions) Directions, 2025
AI / PRIVACY / CYBER RELEVANCE
Core RBI payment-security control; it expressly ties authentication and risk-based profiling to DPDP Act compliance.
AI: ModeratePrivacy: HighCybersecurity: Very High
READ FIRST
- Paras 4 and 6(a), Annexure-1 - domestic scope, two distinct factors and exemptions
- Para 6(b)-(c) - dynamic factor except for card-present transactions, and factor independence
- Para 7 - open access to authentication and tokenisation
- Para 8 - risk-based additional checks
- Para 9(b)-(c) - full compensation for non-compliant losses and DPDP adherence
- Para 10(a) - non-recurring cross-border CNP validation when overseas merchant or acquirer requests authentication, plus BIN registration
- Para 10(b) - risk-based mechanism for all cross-border CNP transactions
- Para 3 - domestic compliance by 1 April 2026, cross-border provisions by 1 October 2026
PURVIEW
Sets principles for domestic digital payment authentication, with the exemptions in Annexure-1. Paragraph 6 requires at least two distinct factors, independence of factors, and a transaction-unique dynamic factor except for card-present transactions. Paragraph 7 requires open access to authentication and tokenisation services. Paragraph 8 permits risk-based additional checks using behavioural and contextual signals and exploration of DigiLocker for high-risk confirmations. Paragraph 9 requires robust deployment, full compensation for losses from non-compliant transactions and adherence to the DPDP Act, 2023. The domestic requirements do not generally apply to cross-border payments. Under paragraph 10(a), by 1 October 2026 card issuers must validate non-recurring cross-border card-not-present transactions where an overseas merchant or acquirer raises an authentication request, and register BINs with card networks. Paragraph 10(b) separately requires a risk-based mechanism for all cross-border CNP transactions by that date. Annexure-2 lists repealed circulars.
Classification and legal status. Directions RBI/2025-26/79, CO.DPSS.POLC.No. S 668/02-14-015/2025-2026 dated 25 September 2025; compliance due by 1 April 2026, and cross-border card provisions by 1 October 2026.