The RBI's 2025 authentication directions, for developers
What the RBI's Authentication Mechanisms for Digital Payment Transactions Directions, 2025 ask of apps from 1 April 2026, and the alternatives to SMS OTP they name.
On 25 September 2025 the Reserve Bank of India issued the Authentication Mechanisms for Digital Payment Transactions Directions, 2025. Payment companies had until 1 April 2026 to comply. The headline for developers: SMS OTP is no longer the default answer, and the RBI names the alternatives it wants explored.
What the directions say
- Two factors for every digital payment. All digital payment transactions must be authenticated by at least two distinct factors.
- No single method is required. Earlier practice leaned on SMS OTP. The 2025 directions do not name one method, which lets banks and payment companies choose.
- Risk-based checks are encouraged. Signals like behavioural biometrics, location and payment history, digital tokens and in-app notifications are listed as alternatives to explore.
- The reason is the rise of phishing, vishing (fraud calls) and smishing (fraud SMS), which all work by getting the user to hand over an OTP.
Who it applies to
Payment system providers and participants: banks and non-bank payment companies, including wallets, card issuers and payment aggregators. An app that signs users in but does not move money is not covered, though the same methods protect its users too.
What banks have built
- SBI Authenticator: approvals by prompt, QR codes, and app-based OTP instead of SMS.
- Axis Bank in-app OTP: time-based codes made inside the app instead of sent by SMS.
Both move the second factor into an app the customer already trusts.
The alternatives, for a developer
| Method | What it is | Phishable |
|---|---|---|
| In-app push approval | The app shows the payment and asks for a biometric; the phone signs it | No, with number matching |
| Passkeys and device biometrics | A key bound to the device and your domain | No |
| In-app or authenticator codes | Time-based codes made in the app | Yes, but no SIM swap |
| Risk-based checks | Device, location and history decide when to ask for more | Not a factor by itself |
| SMS OTP | A code by SMS | Yes |
Building it
SignOps Approve is in-app notification approval: the customer’s trusted phone shows the amount and payee, the user matches a number and confirms with Face ID or a fingerprint, and your server gets a signed answer. Passkeys cover device-bound sign-in. Whether a particular flow meets the directions is for your compliance team to confirm.
Sources: RBI: Authentication Mechanisms for Digital Payment Transactions Directions, 2025, Entrepreneur India: RBI’s new rules move beyond SMS OTPs, Khaitan & Co on the directions, Business Standard: Axis Bank in-app OTP.