RBI readiness check for bank apps
Eight controls Indian banks are asked about, from SIM binding to the reasons that reach the FRM. Mark the ones your bank runs today; each gap shows the rule it touches, with its date, status and source, and the DeepID module that supports it. A gap is not a breach.
In this guide
The check
Mark each control “In place” or “Gap”. Nothing is scored, counted or sent anywhere; the check runs in your browser. The full register below carries the same facts for reading without it.
- Not marked
SIM binding
The account works only from the SIM it was registered on.
- Not marked
Device binding
One registered phone per customer, checked in every session.
- Not marked
Factors beyond SMS OTP
SMS codes can be phished, forwarded or read by APK malware.
- Not marked
Risk-based checks at payee and payment
Checks at the new payee and the payment, not only at login.
- Not marked
Cooling period after a new device or payee
Lower limits for a while after a new phone, SIM or payee.
- Not marked
Scam signals in the session
An active call, a shared screen or a dictated payee while money moves.
- Not marked
Mule detection
Spotting accounts that receive stolen money and pass it on.
- Not marked
Reasons sent to the FRM
Every hold, step-up or allow arrives with its reasons.
Nothing is submitted or counted. The check runs in your browser, and a gap is not a breach.
How the check is built
Each control is something an Indian bank is asked about by a regulator, a payments body or an auditor. Each is mapped to the rule it touches most directly, with its date, its status and a public source, and to the DeepID module that supports it.
The status matters. Five of the rules are in force, one applies from 1 January 2027, one is a discussion paper that is not final, and one is an initiative banks are asked to adopt rather than a direction. A gap against a proposal is a question for your roadmap, not a finding.
The full register
| Control | Rule it touches | Status | DeepID module |
|---|---|---|---|
| SIM bindingThe account works only from the SIM it was registered on. | UPI device and SIM bindingUPI onboarding needs an active SIM linked to the bank account.NPCI (UPI user onboarding: product overview, opens in a new tab), as of Oct 2026 | In force | SIM and device binding |
| Device bindingOne registered phone per customer, checked in every session. | UPI device bindingUPI onboarding binds the app to the device.NPCI (UPI user onboarding: product overview, opens in a new tab), as of Oct 2026 | In force | Device intelligence |
| Factors beyond SMS OTPSMS codes can be phished, forwarded or read by APK malware. | Authentication Directions, 2025SMS OTP remains valid; newer factors are encouraged.RBI (Press release: directions on authentication mechanisms for digital payment transactions, opens in a new tab), Sep 2025 | In force | Silent network verification |
| Risk-based checks at payee and paymentChecks at the new payee and the payment, not only at login. | Authentication Directions, 2025Issuers may add risk-based checks beyond two factors.RBI (Press release: directions on authentication mechanisms for digital payment transactions, opens in a new tab), Sep 2025 | In force | One decision, with reasons |
| Cooling period after a new device or payeeLower limits for a while after a new phone, SIM or payee. | Discussion paper on payment safeguardsFloats a one-hour hold on payments of ₹10,000 or more. A proposal, not a rule.The Paypers (RBI proposes transaction delays and senior-citizen protections to combat digital payment fraud, opens in a new tab), Apr 2026, press report | Proposal | SIM and device binding |
| Scam signals in the sessionAn active call, a shared screen or a dictated payee while money moves. | Amendment directions on customer liabilityZero customer liability where the bank was negligent, as reported.RBI (Press release: amendment directions on the review of the framework of limiting customer liability in digital transactions, effective 1 January 2027, opens in a new tab), Jun 2026; MediaNama (RBI’s final amendment directions on limiting customer liability in digital transactions, in effect from 2027, opens in a new tab), Jun 2026, press report | Applies later | Scam signals |
| Mule detectionSpotting accounts that receive stolen money and pass it on. | MuleHunter.AI adoptionBanks are asked to adopt RBIH’s mule-detection model. An initiative, not a direction.Outlook Business (Finance Ministry asks banks to use MuleHunter.AI to check digital fraud, opens in a new tab), Dec 2024, press report | Guidance or initiative | Payee and mule graph |
| Reasons sent to the FRMEvery hold, step-up or allow arrives with its reasons. | Customer-liability circular, 2017The burden of proving customer liability lies with the bank.RBI (Customer protection: limiting liability of customers in unauthorised electronic banking transactions, opens in a new tab), Jul 2017 | In force | One decision, with reasons |
DeepID supports compliance with these rules. It never guarantees it, and claims no regulator approval.
What to do with a gap
- Read the rule’s own text first. The sources above link to the regulator where a primary text exists, and mark the rest as secondary.
- For a control in force, decide what your record of a decision must show: the signals, the action, the reasons and the message the customer saw.
- For the control that applies from 1 January 2027, see what changes for banks and the checklist for the weeks before.
- Bring the gaps to a demo with the journey you would start with, or begin with a free retrospective on your own closed cases.
Sources
Secondary sources are news or trade reporting of a rule or figure. Check the regulator’s own text before relying on them. Nothing in this guide is legal advice.
- NPCI (opens in a new tab), as of Oct 2026UPI user onboarding: product overview
- RBI (opens in a new tab), Sep 2025Press release: directions on authentication mechanisms for digital payment transactions
- The Paypers (opens in a new tab), Apr 2026, press reportRBI proposes transaction delays and senior-citizen protections to combat digital payment fraud
- RBI (opens in a new tab), Jun 2026Press release: amendment directions on the review of the framework of limiting customer liability in digital transactions, effective 1 January 2027
- MediaNama (opens in a new tab), Jun 2026, press reportRBI’s final amendment directions on limiting customer liability in digital transactions, in effect from 2027
- Outlook Business (opens in a new tab), Dec 2024, press reportFinance Ministry asks banks to use MuleHunter.AI to check digital fraud
- RBI (opens in a new tab), Jul 2017Customer protection: limiting liability of customers in unauthorised electronic banking transactions