The April 2026 deadline will require banks and fintechs to invest heavily in system overhauls
The Reserve Bank of India (RBI) has unveiled sweeping new guidelines for digital payment security, mandating dynamic two-factor authentication (2FA) for all transactions to curb widespread fraud risks, particularly those associated with traditional SMS-based one-time passwords (OTPs).
The new regulations, set to take effect on 1 April 2026, require that at least one of the two credentials used for every domestic and cross-border transaction must be uniquely generated, forcing a significant technological upgrade across India’s financial sector.
The move marks a definitive shift away from the current system, where the combination of a static PIN and an SMS OTP has proven vulnerable to scams like SIM swap fraud.
Biometrics & Tokens Preferred Over SMS OTPs
The central bank’s new framework actively promotes more robust alternatives to SMS OTPs, encouraging providers to adopt:
Biometrics: Leveraging unique physical traits for authentication.
Hardware/Software Tokens: Generating time-sensitive, dynamic passcodes.
Risk-Based Authentication (RBA): Systems that adapt security levels based on transactional risk.
Utkarsh Bhatnagar, a partner at Cyril Amarchand Mangaldas, noted that the change “brings greater clarity and consistency” to payment security, with dynamic 2FA as the “central feature.”
The preference for biometrics is strongly supported by experts. Smrithi Nair, partner at Juris Corp, highlighted that biometrics are “inherently secure” as they rely on unique physical traits that are extremely difficult to replicate or steal.
Industry Scramble for Compliance
The April 2026 deadline will require banks and fintechs to invest heavily in system overhauls. Rohit Jain, managing partner at Singhania & Co, stated that the direction encourages the shift toward more secure options like on-device biometrics and software tokens tied to the user’s physical device.
Fintechs, in particular, will need to develop solutions that are interoperable across various devices and applications.
Sanjay Tripathy, CEO & co-founder of BRISKPE, confirmed that the RBI’s mandate will not only boost trust but also mitigate risks through diverse authentication methods, offering a system that is ultimately more secure, seamless, and user-friendly for customers.
The new rules for cross-border payments will be particularly stringent, requiring an additional factor of authentication to further strengthen security for international transactions.
