RBI’s Authentication Directions, 2025: what they ask, and what they do not
Issued on 25 September 2025 and in force since 1 April 2026, the directions set two factors as the floor for every digital payment and let issuers add risk-based checks above it. SMS OTP is not banned. The room to act is in the checks beyond the floor.
In this guide
Read this firstOur reading of the directions, not legal advice. Quote the clause from RBI’s own text before relying on it. DeepID supports compliance and never guarantees it.
At a glance
- Issuer
- Reserve Bank of India
- Issued
- 25 September 2025
- In force
- 1 April 2026
- Reference
- RBI/2025-26/79
The Authentication Mechanisms for Digital Payment Transactions Directions, 2025 were issued on 25 September 2025 and came into force on 1 April 2026.1 They replace the earlier approach of naming a factor with a set of principles that any factor must meet.
What the directions ask
- Every digital payment is authenticated with two distinct factors, one of them created for that transaction.
- Issuers may add risk-based checks beyond the two factors, scaled to the fraud risk of the transaction. Location, the customer’s behaviour, the device and the transaction history may all count.
- SMS OTP remains a valid factor. Newer factors are encouraged.
- For non-recurring cross-border card-not-present transactions, the issuer validates the additional factor when the overseas merchant or acquirer asks for it.
- The approach is principle-based and technology-neutral.
- Where a payment was not authenticated as the directions require and the customer loses money, the issuer repays the loss in full.
The press release and the directions themselves are the sources for this list.12
What they do not say
- “SMS OTP is banned.” It is not. SMS OTP remains a valid factor under the directions. Newer factors are encouraged, not required.
- “Risk-based checks are mandatory.” They are allowed above the floor, not required. The choice, and the evidence for it, sit with the issuer.
- “Use this technology.” The directions are principle-based and technology-neutral. No vendor, factor or product is named or approved.
- “Login is enough.” The directions concern digital payment transactions. A check at sign-in alone leaves the payee and the payment unread.
What it means for a bank
The floor is easy to meet. Most Indian banks already run two factors. The room to act is in what the directions allow above it. A risk-based check at the new payee and at the payment can tell a customer acting freely from one being talked through a transfer on a call, which two factors at login never will.
From 1 January 2027 the amended customer-liability framework applies, and as reported the customer’s liability is zero where the bank was negligent.34 A record of which checks ran, what they read and what the customer was shown becomes the bank’s evidence. The two sets of directions read together ask a bank to authenticate well, to add risk-based checks where the risk calls for them, and to show what it did.
There is a third direction of travel. RBI’s April 2026 discussion paper floats a one-hour hold on digital payments of ₹10,000 or more. It is not final.5 It shows the fallback when nobody can tell which session is at risk: friction for everyone.
How DeepID supports it
Each thing the directions ask for, the control behind it and the module that runs it. The routes to a number are the network check, the SIM check, Aadhaar consent and a one-time code; UPI registration already binds the app to the device and needs an active SIM.6 Aadhaar face authentication is a mainstream factor, with 28.29 crore face authentications recorded in November 2025.7
| The directions ask for | The control | Module |
|---|---|---|
| Two factors for every digital payment | The bound SIM and the registered device as possession factors, confirmed by the network with nothing to type. | SIM and device binding |
| Risk-based checks beyond two factors | One decision at login, new payee and payment, from the device, the owner’s behaviour, the call and screen state and the payee graph. | One decision, with reasons |
| Newer factors encouraged | The network check and the SIM check before any code, and Aadhaar face authentication with consent at high-risk moments. | Silent network verification |
| SMS OTP still valid | A one-time code kept as the last fallback, for when the network cannot confirm the number. | Silent network verification |
| Evidence of what was checked | Reason codes and the message the customer saw, logged on every decision and sent to your FRM. | One decision, with reasons |
DeepID supports compliance and never guarantees it, and it claims no regulator approval.
Related pages
- The RBI readiness check: eight controls, and the rule each one touches.
- RBI’s 2027 liability framework: why the evidence matters from next year.
- Silent network verification: the factors above the floor, in the product.
Sources
Secondary sources are news or trade reporting of a rule or figure. Check the regulator’s own text before relying on them. Nothing in this guide is legal advice.
- RBI (opens in a new tab), Sep 2025Press release: directions on authentication mechanisms for digital payment transactions
- RBI (opens in a new tab), Sep 2025Authentication Mechanisms for Digital Payment Transactions Directions, 2025
- RBI (opens in a new tab), Jun 2026Press release: amendment directions on the review of the framework of limiting customer liability in digital transactions, effective 1 January 2027
- MediaNama (opens in a new tab), Jun 2026, press reportRBI’s final amendment directions on limiting customer liability in digital transactions, in effect from 2027
- The Paypers (opens in a new tab), Apr 2026, press reportRBI proposes transaction delays and senior-citizen protections to combat digital payment fraud
- NPCI (opens in a new tab), as of Oct 2026UPI user onboarding: product overview
- UIDAI (opens in a new tab), Dec 2025231 crore Aadhaar authentication transactions in November 2025