RBI (Authentication Mechanisms for Digital Payment Transactions) Directions, 2025

Reference

RBI/2025-26/79, CO.DPSS.POLC.No.S 668/02-14-015/2025-26

Issued

25 Sept 2025

Effective

In force · 1 Apr 2026; cross-border CNP validation, risk-based mechanism and BIN registration by 1 Oct 2026

Scope

≥ 2 factors from different categories; for non-card-present, ≥ 1 dynamic, transaction-unique factor; compromise of one factor must not weaken the other; risk-based step-up allowed, step-down below two factors not; issuer compensates customer "in full without demur" for loss on non-compliant txns; para 7 authentication/tokenisation services interoperable across all token requestors; Annex 1 exemptions: small-value contactless, recurring txns after the first under R05, PPI-MTS and gift PPIs, NETC, small-value offline, GDS/IATA travel on commercial cards; adhere to R23.

Key clauses

• para 7Authentication/tokenisation services interoperable across all token requestors, use cases and channels.
• Annex 1Exemptions: small-value contactless, recurring txns after the first under R05, PPI-MTS and gift PPIs, NETC, small-value offline, GDS/IATA travel on commercial cards.