Rbi's Mandatory Two‑factor Authentication for Digital Payments: India Compliance Guide (2026)

Updated: May 11, 2026

The Reserve Bank of India’s Authentication Mechanisms for Digital Payment Transactions Directions, issued on 25 September 2025, have fundamentally reset the security baseline for every domestic digital payment channel, UPI, cards, wallets and net‑banking alike. Under these directions, RBI two factor authentication India requirements became enforceable on 1 April 2026, mandating a minimum of two distinct authentication factors for every covered transaction and rendering single‑OTP flows non‑compliant in most scenarios. In parallel, the RBI’s new banking rules for April 2026 introduced a digital fraud compensation framework that shifts liability squarely onto issuers and payment system participants who fail to meet the prescribed security standards.

This guide provides the operational compliance playbook that general counsel, compliance heads, CTOs and vendor‑procurement leads at banks and fintechs need to navigate these changes, covering checklists, contract clause templates, liability matrices and regulatory‑reporting timelines.

Executive Summary and Key Compliance Decisions for RBI Two Factor Authentication India

The April 2026 package imposes three categories of obligation on regulated entities. First, every domestic digital payment must be authenticated using at least two factors drawn from separate categories, something the customer knows, something the customer has, or something the customer is. Second, authentication must be dynamically linked to the specific transaction, meaning static credentials alone no longer suffice. Third, banks and payment system participants bear primary liability for fraud losses where the mandated authentication was not correctly applied.

For compliance and legal teams, the immediate decisions are:

• System architecture. Confirm that every payment channel deploys two independent factors that meet RBI’s category definitions, with transaction‑binding for the second factor.
• Vendor and merchant contracts. Amend agreements with payment service providers (PSPs), payment aggregators (PAs) and merchants to allocate AFA compliance for banks, indemnify against authentication failures, and embed change‑control mechanisms for future RBI updates.
• Fraud compensation policy. Implement an internal claims‑handling process, including evidence standards, investigation timelines and provisional credit mechanisms, aligned with the digital fraud compensation framework India requirements.
• Board and governance. Obtain board or committee ratification of updated authentication and fraud‑compensation policies and designate a senior compliance officer as the RBI point of contact.

Quick Compliance Checklist: 30‑Day, 90‑Day and 6‑Month Milestones

• 30–60 days (by June 2026). Complete gap analysis of all payment flows; issue contract amendment notices to PSPs, PAs and merchants; update customer‑facing disclosures.
• 90 days (by July 2026). Deploy transaction‑linked dynamic authentication across all production channels; complete SIT/UAT cycles; file first compliance report with internal audit.
• 6 months (by October 2026). Conduct post‑deployment penetration testing and third‑party audit; reconcile fraud‑compensation claims data; submit board report on AFA performance metrics.

What the April 2026 RBI Package Requires

The Authentication Mechanisms for Digital Payment Transactions Directions, 2025, issued under RBI circular reference CO.DPSS.POLC.No.S‑668/02‑14‑015/2025‑2026, apply to all domestic digital payment transactions processed through systems authorised under the Payment and Settlement Systems Act, 2007. The directions require every regulated entity, banks, non‑banking financial companies (NBFCs), prepaid payment instrument (PPI) issuers, and authorised payment system operators, to authenticate digital payment transactions using a minimum of two distinct factors before authorising the transaction.

The first factor must consist of customer credentials (typically something the user knows, such as a PIN or password). The second factor must come from a different category: either “something the user has” (such as a registered device, hardware token or possession‑based OTP) or “something the user is” (biometric verification). Critically, the second factor must be dynamically generated or verified in a manner linked to the specific transaction, amount, payee, and timestamp, rather than being a reusable static credential.

The compliance deadline was 1 April 2026. Entities that had not implemented compliant two‑factor authentication by that date face supervisory action under the Payment and Settlement Systems Act, 2007, and may bear enhanced liability for fraud losses occurring on non‑compliant channels.

Scope and Applicability: Who Is In and Who Is Out

The directions apply broadly across the digital payment ecosystem in India:

• Banks and NBFCs, all scheduled commercial banks, small finance banks, regional rural banks, cooperative banks, and NBFCs issuing payment instruments.
• Payment system operators, UPI ecosystem participants (NPCI, remitter and beneficiary banks, third‑party application providers), card networks operating domestically, and PPI issuers.
• PSPs and payment aggregators, entities that facilitate the transaction chain bear responsibility for ensuring the authentication occurs before settlement, even if they do not themselves issue the authentication challenge.
• Merchants, while not directly regulated, merchants accepting digital payments must integrate with compliant payment flows. Banks and PAs must contractually require merchant cooperation on authentication redirects.

Cross‑border inbound transactions (where the issuer is outside India) are excluded from the AFA mandate, though industry observers expect RBI to extend similar requirements to such transactions in future revisions.

Exemptions and the E‑Mandate / Recurring Payment Carve‑Out

The RBI has not removed two‑factor authentication, contrary to some consumer‑press headlines. What has changed is that the updated e‑mandate framework permits recurring transactions, such as SIP debits, insurance premiums and subscription payments, to be processed without Additional Factor Authentication (AFA) at the time of each recurring debit, provided the transaction amount does not exceed ₹15,000 per transaction and the customer has given a one‑time authenticated e‑mandate registration. The initial mandate registration itself must use full two‑factor authentication. Fintech compliance India teams should map all recurring‑payment product flows against this threshold and ensure the e‑mandate registration capture includes compliant AFA.

Accepted Authentication Factors and Technical Options Under RBI Two Factor Authentication India Rules

The RBI’s directions organise acceptable authentication into three factor categories. Each digital payment must use factors from at least two of these categories. The following table summarises the practical options:

A single OTP delivered to a registered mobile number counts as “something the user has” only when combined with a separate first factor (e.g., a PIN or password). OTP alone, without a distinct first factor from another category, is no longer sufficient to satisfy the directions for most transaction types. The RBI’s emphasis on transaction‑linked dynamic authentication means that the second factor should be cryptographically bound to the transaction parameters (amount, payee, timestamp), reducing the risk of replay attacks and social‑engineering interception.

UPI Two Factor Authentication: Channel‑Specific Requirements

UPI transactions have historically relied on a combination of device binding (registered mobile) and UPI PIN. Under the new directions, this combination remains compliant, device binding constitutes “something the user has” and UPI PIN constitutes “something the user knows.” Third‑party application providers (TPAPs) must ensure their onboarding flows include robust device‑binding verification and that UPI PIN entry is rendered in a secure, isolated environment. For UPI Lite (small‑value offline transactions), the RBI has permitted relaxed authentication subject to per‑transaction and cumulative‑balance caps.

Card, Wallet and Net‑Banking Flows

For card‑not‑present (CNP) transactions, the historical 3D Secure + OTP model must now include a first factor (such as a card PIN, password or in‑app authentication) before the OTP is triggered. PPI (wallet) issuers must implement two‑factor authentication for all outward fund transfers and merchant payments above the small‑value thresholds specified in PPI master directions. Net‑banking platforms must move beyond single‑password access, pairing passwords with device‑registered tokens or biometric challenges for transaction approval.

Operational Compliance Checklist for AFA Compliance for Banks and Fintechs

The following checklist translates the regulatory text into concrete operational tasks. Compliance leads should adapt timelines based on institutional scale, but the structure applies to all entities within scope.

Policy and Governance Changes

Board‑level or management‑committee ratification is the first governance step. Institutions should update their IT security policy, digital payment policy and fraud management policy to expressly reference the Authentication Directions. The designated compliance officer should be notified to the RBI as the point of contact for supervisory queries relating to AFA implementation.

Technology and Testing

Engineering teams must map every payment flow, customer‑initiated and merchant‑initiated, and identify where authentication occurs in the transaction lifecycle. Each flow requires a documented authentication matrix showing which two factors are applied and how the second factor is bound to the transaction. System integration testing (SIT) and user acceptance testing (UAT) should simulate both compliant and non‑compliant scenarios, including fallback paths for authentication failures (e.g., biometric sensor failure routing to OTP + PIN).

Monitoring, Logging and Incident Response

The directions implicitly require that authentication events be logged with sufficient granularity to support fraud investigations and regulatory audits. Logs should capture: timestamp, factor type used, transaction reference, device identifier, IP address (where applicable), and authentication outcome. Incident response playbooks should be updated to include scenarios where authentication is bypassed, spoofed or fails silently.

Vendor Contracts for Two Factor Authentication: Merchant and PSP Management

Contractual infrastructure is the enforcement layer for AFA compliance. Every agreement between a bank or NBFC and its PSPs, payment aggregators, technology vendors and acquiring merchants must be reviewed and, in most cases, amended to reflect the Authentication Directions. The key contractual priorities are: allocation of liability for authentication failures, mandatory security standards, change‑control provisions that allow the bank to require upgrades when RBI issues new guidance, and audit rights.

Sample Vendor Contract Clauses

The following illustrative clauses are intended as starting points. Legal teams should adapt language to their institution’s contracting standards and risk appetite.

Merchant Agreements and Consumer Disclosure Language

Banks and PAs acting as acquirers should update merchant onboarding agreements to require merchants to support authentication redirects (e.g., 3DS 2.0 challenges, in‑app authentication callbacks) without friction‑reducing workarounds that bypass the second factor. Consumer disclosures should clearly explain: what two‑factor authentication is, why an additional step may appear during checkout, how to report failed or suspicious authentication prompts, and the customer’s rights under the fraud compensation framework. This disclosure language serves a dual purpose, consumer protection and a liability defence if a dispute arises over whether the customer was adequately informed.

Digital Fraud Compensation Framework India: Liability, Claims and Dispute Handling

The digital fraud compensation framework introduced alongside the AFA mandate creates a structured liability regime. Where a customer suffers a loss due to an unauthorised digital payment transaction, the issuing bank or PPI issuer bears the initial liability unless it can demonstrate that the customer was at fault (e.g., shared credentials voluntarily, delayed reporting beyond the prescribed window). The framework operates as follows:

• Customer reporting window. The customer must notify the bank within a prescribed period (typically three working days from the date of the unauthorised transaction). If the customer reports within this window and was not negligent, the bank bears full liability.
• Investigation timeline. The bank must complete its investigation within a defined period (typically 90 days) and credit the disputed amount on a provisional basis within 10 working days of receiving the complaint if the complaint is not resolved within that initial period.
• Liability gradation. Where the fraud results from a third‑party breach (not attributable to bank or customer negligence), the bank bears the loss. Where the customer’s negligence contributed (e.g., sharing OTP with a fraudster), liability may be shared or shifted to the customer, subject to the bank demonstrating that compliant authentication was in place at the time of the transaction.

Triage and Evidence Checklist for Claims

Compliance teams should establish a structured triage process for every fraud claim:

• Step 1, Log receipt. Record the claim, customer notification timestamp, and channel used to report.
• Step 2, Authentication evidence pull. Extract the authentication log for the disputed transaction (factors used, device ID, IP, timestamp, transaction binding reference).
• Step 3, Fault determination. Assess whether compliant two‑factor authentication was applied; identify any system errors, vendor failures or customer‑side compromises.
• Step 4, Provisional credit decision. If the investigation cannot be completed within the initial resolution window, issue provisional credit and continue the investigation.
• Step 5, Final resolution and reporting. Close the claim, notify the customer, and log the outcome for regulatory reporting and internal audit.

Regulatory Interactions, Reporting and Enforcement Risk

Non‑compliance with the Authentication Directions exposes entities to supervisory action under the Payment and Settlement Systems Act, 2007, which includes the power to impose monetary penalties, issue directions to cease and desist, and revoke authorisations. The practical enforcement risk extends beyond penalties: a bank or fintech that cannot demonstrate compliant two‑factor authentication at the time of a disputed transaction will face an uphill battle in any fraud‑compensation dispute and before the RBI Ombudsman.

Entities must reconcile their AFA obligations with related regulatory frameworks, the Information Technology Act, 2000 (for data security and breach notification), the Digital Personal Data Protection Act, 2023 (for biometric and device data processing), and consumer protection legislation (for transparency and fair treatment). A fintech compliance India programme should treat AFA as one component of an integrated compliance architecture rather than a standalone project.

When to Notify RBI Versus Internal Escalation

Routine authentication failures (individual transaction declines, customer lockouts) are handled internally. Notification to RBI is required when: a systemic authentication failure affects multiple customers or channels; a security breach compromises the integrity of the authentication mechanism itself; or a pattern of fraud suggests that the authentication system has been circumvented. The notification should be directed to the Department of Payment and Settlement Systems (DPSS) through the entity’s designated compliance officer, with a preliminary incident report followed by a detailed root‑cause analysis.

Implementation Timeline and Case Examples

The following phased timeline consolidates the regulatory milestones and operational deadlines discussed above:

Hypothetical scenario: A mid‑sized private bank processes a ₹50,000 card‑not‑present transaction using only a single OTP (no first‑factor PIN or password). The customer disputes the transaction, reporting within two days that they did not authorise it. Because the bank’s authentication was non‑compliant, only one factor was used, the bank bears full liability under the fraud compensation framework and cannot shift responsibility to the customer. Industry observers expect that the bank would also face potential supervisory scrutiny if the issue reflects a systemic configuration error rather than an isolated incident. Had the bank deployed compliant two‑factor authentication, the liability analysis would shift to whether the customer was negligent (e. g.

, shared both PIN and OTP with a fraudster), providing the bank with a viable defence.

Next Steps

The RBI two factor authentication India mandate and the accompanying fraud compensation framework are now in force. Institutions that have not completed full compliance face immediate liability and supervisory risk. For banks, NBFCs and fintechs seeking specialist assistance, including compliance audits, contract‑revision packages and operational workshops, Global Law Experts’ India lawyer directory connects you with Banking & Finance practitioners experienced in RBI regulatory compliance.

Sources

1. Reserve Bank of India, Authentication Mechanisms for Digital Payment Transactions Directions
2. KPMG India, RBI Authentication Mechanisms for Digital Payment Transactions Directions, 2025
3. IBM Think, Strengthening Digital Payment Security with RBI’s New Authentication Directions
4. Moneycontrol, RBI’s New 2FA Rules Kick In April 1: Know What Changes for Users
5. Wultra, India’s Shift to Dynamic Authentication: Understanding the RBI’s New 2FA Rules
6. Findoc, RBI’s April 2026 Banking Rules Reshape Indian Finance