The Reserve Bank of India has issued final directions requiring two-factor authentication (2FA) for all domestic digital payment transactions starting April 1, 2026. The framework allows banks, card issuers, and payment providers to use a range of authentication methods, including biometrics, device tokens, passphrases, and one-time passwords.
For non-card-present transactions, at least one dynamic factor must be applied, meaning each transaction must be verified with a unique challenge such as a biometric match, cryptographic key, or code.
The policy replaces earlier circulars and follows draft consultations released in 2024 and 2025. One-time passwords remain an acceptable option under the rules but are no longer required as the sole method of verification. Providers may also apply additional checks beyond the minimum requirement where real-time systems indicate elevated risk. These can include device binding, behavioral analytics, or app-based prompts.
For consumers, the new rules mean transactions on UPI, wallets, and cards will continue to require verification but not always through a texted code. In-app prompts, device-based tokens, or biometric checks may be used instead. Limited exemptions are permitted under the directions, including small-value contactless transactions, recurring e-mandate debits, and certain prepaid or offline payments. Higher-value or flagged transactions may require additional steps.
For payment providers, the requirements will involve updating systems to accommodate multiple authentication factors and risk-based checks. The changes also connect with broader developments in India’s payments and identity infrastructure, including Aadhaar face authentication access for private applications and the continued role of OTP within Aadhaar’s multi-method framework.
Sources: Reuters, The Economic Times, Moneylife, YourStory, Fortune India, Medianama (PDF)
–
By Cass Kennedy
