RBI Authentication Directions 2025: What Merchants Need to Know (In Force Since April 2026)
Since 1 April 2026, every domestic digital payment in India has been governed by the Reserve Bank of India (Authentication Mechanisms for Digital Payment Transactions) Directions, 2025. Most coverage has been written for consumers, and a lot of it repeats one claim that is wrong: that SMS OTPs are going away. They are not.
This guide explains what the directions require, which payments are exempt, what changed for cross-border card payments on 1 October 2026, and what merchants, payment teams and developers should check in their own checkout and billing flows.
Quick answer: RBI’s 2025 authentication directions require at least two distinct factors for every domestic digital payment unless it is exempt, with at least one factor that is dynamic for anything other than a card-present payment. SMS OTP remains allowed. Issuers may add risk-based checks, must compensate customers in full for losses from non-compliant transactions, and since 1 October 2026 must be able to validate additional authentication on non-recurring cross-border card-not-present payments when the overseas merchant asks for it. Merchants are not named directly, but they feel the rules through 3D Secure challenges, new authentication methods and e-mandate limits.
What are the RBI authentication directions?
RBI issued the directions on 25 September 2025 (reference RBI/2025-26/79) under the Payment and Settlement Systems Act, 2007. They finalise two earlier drafts: a July 2024 proposal on alternative authentication methods and a February 2025 proposal on additional factor of authentication (AFA) for cross-border card-not-present payments.
The directions apply to all payment system providers and participants, banks and non-banks alike, and to all domestic digital payment transactions unless a specific exemption applies. Compliance was due by 1 April 2026, with a later date of 1 October 2026 for the cross-border provisions.
They also repeal eight older circulars on card-not-present security issued between 2009 and 2016, including the 2016 relaxation that allowed network-provided solutions without AFA for payments up to Rs 2,000. If your internal documentation still cites those circulars, it needs updating.
What does the two-factor rule actually require?
The core rule is simple: every digital payment must be authenticated by at least two distinct factors, unless exempted. RBI groups factors into three types, and issuers may let customers choose which factors they use.
| Factor type | Examples named by RBI |
|---|---|
| Something the user knows | Password, passphrase, PIN |
| Something the user has | Card hardware, software token, SMS OTP |
| Something the user is | Fingerprint or other biometrics, device-native or Aadhaar-based |
Two further conditions matter for online payments:
- For any transaction other than a card-present one, at least one factor must be dynamically created or proven. The proof sent with the transaction has to be unique to that transaction, so a static password plus a static PIN does not qualify.
- The factors must be independent, so that compromising one does not undermine the other. An OTP delivered to the same app that holds the password weakens this separation.
The July 2024 draft said one factor had to be generated after the payment was initiated. The final text uses the broader wording of a factor that is dynamically created or proven. That opens the door to passkeys and device-bound cryptographic credentials, which prove possession of a key for each transaction without sending a code over SMS.
Is SMS OTP being phased out?
No. RBI’s press release says the framework does not call for discontinuation of SMS-based OTP as an authentication factor. What the directions do is let issuers adopt other factors alongside it, such as device biometrics, passkeys and app-based approvals.
The practical change is that issuers now have regulatory cover to move customers away from SMS OTP where they choose to, and several have started. OTPs remain exposed to SIM swap attacks and to adversary-in-the-middle phishing, which relays a code in real time. Phishing-resistant methods such as passkeys address both.
Which payments are exempt from two-factor authentication?
The exemptions are listed in Annexure 1 of the directions. RBI notes that later additions or changes also apply, and the list has already grown once since September 2025.
| Exempt category | Key condition |
|---|---|
| Small-value contactless card payments | Up to Rs 5,000 per transaction; the customer can still choose contact mode |
| Recurring payments under the e-mandate framework | Registration and first debit need AFA; later debits up to Rs 15,000 can run without it (Rs 1 lakh for insurance premiums, mutual fund subscriptions and credit card bills) |
| Select prepaid instruments | Such as PPI-MTS (mass transit) and gift PPIs |
| NETC (FASTag) toll payments | Toll collection through the National Electronic Toll Collection system |
| Small-value offline payments | Within the limits of RBI’s offline payments framework |
| Travel bookings on commercial or corporate cards | Through global distribution systems or IATA channels |
| UPI Tap and Pay on NFC point-of-sale machines | Added by an RBI letter dated 2 September 2026 |
For subscription businesses, the e-mandate row is the one to watch. RBI consolidated its e-mandate rules into the Digital Payments: E-mandate Framework, 2026 on 21 April 2026. The limits are unchanged, and customers must still receive a pre-debit notice at least 24 hours before each charge. Our guide to securing recurring billing covers the operational side.
What are risk-based checks, and how could they affect checkout?
Paragraph 8 of the directions lets issuers evaluate transactions against behavioural and contextual signals, such as location, user patterns, device attributes and transaction history, and apply checks beyond the two-factor minimum where the risk is higher. RBI also suggests issuers could use DigiLocker to notify customers about high-risk transactions and collect confirmation.
For merchants this means challenge rates can vary more than before. An order that looks unusual to the issuer may face an extra step even when the customer has completed two factors. Three things reduce unnecessary friction:
- Send complete 3D Secure 2 data. Device information, account age, shipping address match and purchase history help the issuer approve low-risk payments without a challenge. Our guide to 3D Secure 2 and checkout friction explains which fields matter.
- Track challenge and decline rates by issuer. A sudden change at one bank usually points to a new risk rule on its side, not a problem with your checkout.
- Keep tokenised card flows healthy. Network tokens carry cryptograms and lifecycle updates that issuers treat as lower risk than raw card numbers.
What changed for cross-border card-not-present payments on 1 October 2026?
The general two-factor rule applies only to domestic transactions. Paragraph 10 adds two specific duties for cross-border card-not-present payments, defined as payments made with an Indian-issued card to a merchant acquired by an overseas acquirer, which cause a foreign exchange outflow.
- By 1 October 2026, card issuers must be able to validate non-recurring cross-border card-not-present transactions when the overseas merchant or acquirer raises an authentication request. To do this, issuers have to register their card BINs with the card networks.
- By the same date, issuers must have a risk-based mechanism for handling all cross-border card-not-present transactions, including recurring ones.
Before this, many Indian cards could not complete a 3D Secure challenge requested by a foreign merchant, which led to declines. The new rule closes that gap for one-off purchases.
Who notices the change:
- Indian cardholders paying overseas merchants, who will see more authentication prompts on one-time international purchases.
- Indian businesses that bill Indian customers through a foreign entity or acquirer, for example a SaaS company with an overseas billing setup. Where that acquirer requests 3D Secure, Indian issuers will now validate it.
- Indian merchants acquired in India are not affected by paragraph 10, since their transactions with Indian cards are domestic. Inbound payments from foreign cards follow the issuing country’s rules.
Who is liable when a non-compliant payment causes a loss?
The directions are direct on this point. Paragraph 9 says that if any loss arises from a transaction carried out without complying with the directions, the issuer must compensate the customer in full without demur. Issuers must also confirm their authentication mechanism is robust before deploying it, and comply with the Digital Personal Data Protection Act, 2023.
This clause is between the issuer and its customer. It does not rewrite card network chargeback rules, and it does not cover losses where the customer completed valid authentication but was tricked into approving the payment. Merchants should still expect disputes on fraud claims and keep authentication results with each order as evidence.
What should merchants and payment teams do now?
The directions are addressed to issuers and payment system operators, but merchants depend on those parties for every approval. A practical review covers eight points:
- Confirm with your payment aggregator which authentication methods its checkout supports beyond OTP, such as biometric passkeys or app approvals, and whether they are enabled for your account.
- Check that your integration uses 3D Secure 2 and passes the full data set, not a minimal request.
- Review e-mandate flows: AFA at registration and first debit, the Rs 15,000 and Rs 1 lakh limits, and 24-hour pre-debit notices.
- Do not offer ATM PIN as a factor for card-not-present payments. RBI’s 2025 payment aggregator directions prohibit it.
- Use tokenised cards for repeat customers instead of storing card data, which merchants have not been allowed to do since 1 October 2022. See our guide to saved-card payments and tokenisation in India.
- If you bill through an overseas entity, test international checkout with Indian cards after 1 October 2026 and watch decline codes.
- Update customer support scripts. Customers may contact you when their bank introduces a new prompt, and your team should be able to explain that it comes from the issuer.
- Store authentication outcomes (3D Secure result, ECI value and transaction ID) with each order so you can respond to disputes.
How are banks rolling out new authentication methods?
Adoption has moved faster in 2026 than in earlier years. In March 2026, a payment aggregator announced biometric passkey authentication for cards with Mastercard and Visa. In September 2026, Visa payment passkeys went live for IDFC FIRST Bank cardholders, and five public sector banks (Union Bank of India, Central Bank of India, Bank of Maharashtra, Indian Overseas Bank and Indian Bank) began moving from SMS OTP to FIDO-based authentication.
The pattern is that the issuer decides the factor and the merchant inherits the experience. A merchant cannot force a customer onto a passkey, but a checkout that supports 3D Secure 2 fully will present whatever method the issuer offers without extra work.
Frequently asked questions
When did the RBI authentication directions come into force?
The general requirements apply from 1 April 2026. The cross-border card-not-present provisions in paragraph 10 apply from 1 October 2026.
Do the directions ban SMS OTP?
No. SMS OTP remains a valid factor. The directions allow issuers to use other factors, including biometrics, passkeys and software tokens, alongside or instead of it.
Do merchants have to change anything to comply?
The obligations sit mainly with issuers and payment system operators. Merchants should check that their gateway supports 3D Secure 2 fully, that e-mandate flows follow the 2026 framework, and that they do not store card data.
Are recurring subscription payments exempt?
Recurring debits after the first one are exempt if they run under the e-mandate framework and stay within its limits: Rs 15,000 per transaction, or Rs 1 lakh for insurance premiums, mutual fund subscriptions and credit card bill payments. Registration and the first debit still need AFA.
Is a contactless card payment over Rs 5,000 exempt?
No. The contactless exemption covers payments up to Rs 5,000. Above that, the payment needs a second factor, usually the card PIN.
What is the difference between AFA and 2FA?
In RBI usage, AFA (additional factor of authentication) refers to the factor added on top of the card details, and two-factor authentication describes the overall requirement. The 2025 directions frame the rule as at least two distinct factors.
Who pays if a transaction was processed without proper authentication?
Under paragraph 9, the issuer must compensate the customer in full for any loss from a transaction processed without complying with the directions.
Do the rules apply to foreign cards used at Indian merchants?
No. The directions cover payments by Indian-issued instruments. Authentication for foreign cards depends on the issuing country’s rules and the card network.