New rules for authenticating payments beyond SMS OTP to kick-in from April 2026

Mumbai announced on Thursday, September 25th (PTI), a reserve bank, beyond an SMS -based password, and announced that new rules on digital payments that allow more ways to comply with two -factor identity (2FA) will enter into force on April 1.

Authentication factors can be “something that the user possesses”, “something that the user knows” or “something with the user”, and Central Bank, SMS -based OTP, Passfrase, Pin, Card Hardware, Software Sign, Fingerprint, or another type of biometry.

India is one of the markets in the world that insists on 2FA, and the financial sector players rely on SMS -based warnings to carry out transactions.

The RBI has initiated its aspects of 2025 (authentication mechanisms for digital payment transactions) and clearly stated that 2FA will continue to be compulsory and that SMS OTP can be used.

The Central Bank first announced the movement in February 2024 to enable the payment ecosystem to benefit from technological developments in order to implement alternative authentication mechanisms.

New rules indicate that at least one of the authentication factors are dynamically formed or proven;

In addition, the system must be intact, where compromising one factor does not affect the reliability of the other.

In addition, RBI, risk management perspective, financial system stakeholders, processing place, user behavior patterns, device properties, past processing profile and so on. Such as behavioral /contextual parameters can also determine the evaluation process, he said.

“Based on the perceived risk associated with the transaction, additional controls can be done beyond a minimum two -factor authentication. Exporters can investigate using DiGilocker as a platform for notification and approval for high -risk transactions.” He said.

The Central Bank said that if any loss from the procedures affected without complying with these instructions arises, the exporter would compensate for full harm without demur.

Furthermore, card exporters ask the exporters to put a mechanism in order to verify the non -border card (CNP) transactions that are increased by a overseas merchant or overseas purchasing of a overseas trader or overseas since October 1, 2026.