RBI's New Payment Authentication Rules: What Changes Beyond SMS OTP

This is general information, not legal or financial advice. The Directions are addressed mainly to banks and payment providers, so confirm details with your gateway or bank.

Many shoppers think the Reserve Bank of India is "removing SMS OTP". That is not what the rules say. What changed is broader: a framework that expects stronger, more flexible authentication, with SMS OTP allowed to remain as one option. Here is what is confirmed, and what it means if you run an online business.

What RBI issued and when

RBI press release 2025-2026/1165, dated 25 September 2025, announced the Reserve Bank of India (Authentication Mechanisms for Digital Payment Transactions) Directions, 2025. Compliance is required by 1 April 2026 unless a specific direction says otherwise. The Directions followed drafts of 31 July 2024, on alternatives to existing authentication, and 7 February 2025, on an extra authentication factor for cross-border card-not-present payments. RBI took public comments into account in the final text.

As of November 2026 the main date has passed, so the framework applies to banks, card issuers and payment providers. News reports on 4 April 2026 described the change as having begun, with some payments needing an extra step such as a device approval or biometric check.

What the framework says, in plain terms

• At least two factors. A law firm's summary of the Directions says each digital payment needs at least two different authentication factors, designed so that one failing does not weaken the other. An authentication factor is something you know, have or are: a PIN, a phone or a fingerprint.
• A dynamic element for online payments. For card-not-present transactions, at least one factor should be dynamic, such as a one-time code tied to that payment, or something that can be proved, such as biometrics. The meaning of "capable of being proven" is not fully defined, according to that analysis.
• SMS OTP is allowed. RBI's press release states the framework does not call for discontinuing SMS-based OTP as an authentication factor. It encourages new factors that use technology advances.
• Risk-based checks. Issuers may add checks beyond the minimum, depending on the fraud risk of each transaction. An unusual amount or location can trigger more questions.
• Some exemptions. The same summary lists small-value contactless card payments, recurring payments under the e-mandate framework and gift prepaid instruments. Check the Directions for the exact conditions.
• Cross-border card-not-present payments. RBI says card issuers must validate an additional factor for non-recurring cross-border payments when an overseas merchant or acquirer asks. The law firm's note gives 1 October 2026 for certain issuer obligations on these payments.

What this means for merchants and apps

The duties are placed on banks, issuers and payment system providers, not directly on a shop owner. The commercial effect still reaches you, because your checkout depends on how your customers' banks and your gateway run authentication.

• Your gateway does most of the work. If you use a hosted or embedded checkout from a provider such as those in our gateway comparison, the authentication screens come from the provider and the bank. Do not build your own OTP screen for card payments.
• Expect a slightly longer step for some customers. A UPI PIN plus a biometric check, or a device prompt, may appear on riskier payments. Test your checkout on a mid-range Android phone and on a weak connection.
• Customers in smaller towns may need help. Commentators have noted possible friction where connectivity is poor. A clear message such as "Approve the payment in your bank app" reduces abandoned carts.
• Overseas buyers. If you sell to customers abroad, your acquirer may ask for extra authentication on card payments from certain issuers. Ask your provider how this affects international orders.

Your own login OTP is a different matter

The Directions concern payment authentication. The OTP you send to log customers into your own app or website is your design choice. Even so, SMS codes can be intercepted or phished, so many teams offer an alternative, such as an app-based prompt. Our glossary explains OTP verification. If you use SMS for sign-in, keep rate limits and expiry times tight.

A short checklist for owners

1. Confirm with your gateway that you are on its current checkout version.
2. Ask what changed for card, UPI and wallet flows after 1 April 2026 and whether any failure codes are new.
3. Test payments end to end on Android, iPhone and a desktop browser, including a failed authentication.
4. Make sure your order page handles "payment pending" and "payment failed" clearly.
5. Check recurring-payment setups against the e-mandate rules with your provider.
6. Review support scripts so staff can explain the extra step to customers.
7. If you sell abroad, ask about cross-border card-not-present handling.

How we build for it

At VS Tech Builders we integrate gateways using their current hosted or embedded checkout and handle pending and failed states in the order flow, for both online stores and Android apps. If a payment step has started failing more often than before, tell us and we will look at the logs and gateway settings. See the tech news hub for related changes.

Sources

Checked on 3 November 2026. Technology changes quickly; always confirm details with the official source before you act on them.

• RBI issues Directions on Framework on Authentication Mechanisms for Digital Payment Transactions — Reserve Bank of India
• RBI Authentication Mechanisms for Digital Payments Transactions Directions — Khaitan & Co
• RBI's mandatory 2FA rule kicks in: what changes for your digital payments now — Business Today

Frequently asked questions

Has RBI banned SMS OTP for online payments?

No. RBI's press release of 25 September 2025 says the Directions do not call for discontinuation of SMS-based OTP as an authentication factor. The framework requires at least two factors and encourages newer options such as device-based approval or biometrics. SMS OTP can still be one of the factors where a bank supports it.

When did the RBI authentication Directions take effect?

Compliance was required by 1 April 2026, unless a specific direction says otherwise. A law firm's summary gives 1 October 2026 for certain card issuer obligations on cross-border card-not-present payments. As this is a summary, check the Directions on rbi.org.in for the exact date of each provision.

Do merchants have to change their checkout because of these rules?

The obligations are placed on banks, card issuers and payment system providers rather than directly on merchants. If you use your gateway's hosted or embedded checkout, the provider manages the authentication screens. You should still test your payment flows and make sure failed or pending payments are handled clearly. Confirm details with your gateway.

Will customers see more verification steps?

Some will. Issuers may apply risk-based checks beyond the two-factor minimum, so a larger or unusual payment may ask for an extra approval, such as a biometric or app prompt. Business Today reported in April 2026 that payments may take slightly longer, so clear on-screen guidance at checkout helps.