RBI: New rules for authenticating payments other than SMS OTP will be implemented from April 2026, RBI announced

India is one of the world's leading markets in emphasizing 2FA. Financial sector players have relied on SMS-based alerts to process transactions. The RBI will implement additional transaction authentication methods in the coming year. Let's learn more about them.

New rules on digital payments, which allow more ways to comply with two-factor authentication (2FA) beyond SMS-based one-time passwords, will come into effect from April 1, the Reserve Bank of India announced on Thursday.

The central bank said the basis for authentication could be "something the user has," "something the user knows," or "something the user is." This could include, among other things, passwords, SMS-based OTPs, passphrases, PINs, card hardware, software tokens, fingerprints, or any other form of biometrics (device-native or Aadhaar-based). India is one of the markets globally that emphasizes 2FA. Under this, financial sector players have been relying on SMS-based alerts to execute transactions.

The RBI has launched the (Authentication Mechanism for Digital Payment Transactions) Directions, 2025. It clarified that 2FA will remain mandatory and SMS OTP can also be used.

The central bank had first announced the move in February 2024 to enable the payments ecosystem to leverage technological advancements to implement alternative authentication mechanisms.

The RBI said that from a risk management perspective, financial system stakeholders can identify transactions for evaluation based on the location of the transaction, user behaviour patterns, device characteristics, historical transaction profile, etc. The central bank said that if any loss occurs due to a transaction carried out without following these instructions, the issuer will have to fully compensate the customer for the loss without any objection. It has also asked card issuers to put in place a mechanism to validate non-recurring, cross-border Card Not Present (CNP) transactions. Under this, authorisation request will be made by the overseas merchant or overseas acquirer from October 1, 2026.

PC:AmarUjala