Updated 3 November 2026. A summary for business owners and product teams, not legal advice. Read the directions on the RBI website and follow your bank or payment aggregator's integration notes.
Short answer: under the RBI's Authentication Mechanisms for Digital Payment Transactions Directions, 2025, every digital payment from 1 April 2026 needs at least two authentication factors, and one of them must be dynamic (unique to that transaction). SMS OTP is still allowed, but banks may use biometrics, app-based tokens and risk-based checks instead of or on top of it. Small-value contactless payments, recurring e-mandates after the first payment and a few other cases are exempt. Most of the work sits with banks and payment providers, but apps and websites still need to handle the new flows smoothly.
What the RBI directions say
The RBI issued the final directions on 25 September 2025, as reported by MediaNama and Business Standard. The key points:
- Two factors for every digital payment from 1 April 2026, unless a specific exemption applies.
- One factor must be dynamic, generated or proven uniquely for each transaction.
- Factors must be independent, so that one being compromised does not weaken the other.
- No single prescribed method. Factors can be something you know (PIN, password), something you have (card, phone, software token, OTP) or something you are (fingerprint, face, Aadhaar-based biometric).
- SMS OTP is not banned. It remains a valid factor.
Risk-based checks
Issuers are expected to look at behaviour and context such as location, device, transaction history and usage patterns, and may ask for extra checks on unusual payments. MediaNama reports that the RBI also encouraged the use of DigiLocker to notify customers and confirm high-risk transactions.
For a business, this means a customer may sometimes face an extra step even on a familiar flow. Your checkout should handle that without losing the order.
Exemptions
According to MediaNama, these are exempt from the two-factor rule:
- Small-value contactless card payments.
- Recurring payments under the e-mandate framework, after the first transaction.
- Certain prepaid instruments such as gift cards and PPI money transfer services.
- NETC payments such as FASTag tolls.
- Small-value offline digital payments.
- Some corporate card travel bookings made through GDS or IATA channels.
Cross-border card payments
The rules do not automatically cover every foreign transaction. By 1 October 2026, card issuers had to be able to validate an additional factor on non-recurring card-not-present payments when an overseas merchant or acquirer asks for it, and to use a risk-based approach for all such payments. If you sell to foreign customers, check your payment provider's 3-D Secure support.
Who is responsible if things go wrong
MediaNama reports that issuers must check their authentication methods before rolling them out and must fully compensate a customer who loses money because the directions were not followed. The directions also tie in with the DPDP Act, so customer data used for authentication must be handled lawfully.
What this means for apps, websites and online stores
If you collect payments through a payment gateway or aggregator, the bank and gateway handle the actual authentication. Your job is to make sure the experience does not break. A practical checklist:
- Use the latest SDKs from your payment gateway, UPI intent flow and card tokenisation provider. Old SDKs may not support newer authentication screens.
- Handle extra challenges. Test what happens when the bank asks for an additional step, a biometric prompt or a delayed confirmation. The order should stay "pending" and be reconciled by webhook, not marked failed too early.
- Use webhooks for final status. Do not rely only on the redirect back to your site, since users often close the tab after authenticating.
- Prefer e-mandates for subscriptions. After the first authenticated payment, recurring debits under the e-mandate framework are exempt, which keeps renewals smooth.
- Do not store card data. Use tokenisation through your provider.
- Secure your own login too. The RBI rules are about payments, but customers expect similar protection on accounts that store addresses and order history. Add OTP or app-based login and device checks. Our cyber security team can review this.
- Explain the step to customers. A short line on the checkout page ("your bank may ask you to confirm with a PIN or fingerprint") reduces drop-offs.
How we can help
Nextinera builds e-commerce stores, mobile apps and payment integrations with tokenised cards, UPI intent, e-mandates and webhook-based reconciliation. Book a free call to review your checkout.