Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 08 OCTOBER 2025

RBI (Authentication Mechanisms For Digital Payment Transactions) Directions, 2025: Balancing Privacy And Security In Digital Payment

Khaitan & Co.
Khaitan & Co.
Contributor
Khaitan & Co.

Khaitan & Co.

Founded in 1911, Khaitan & Co is a heritage law firm that has been a trusted adviser to leading...

View firm profile
Explore more from Khaitan & Co.

On 25 September 2025, the Reserve Bank of India (RBI) issued the ‘Authentication Mechanisms for Digital Payment Transactions Directions, 2025' (Directions)...

IndiaTechnology
Harsh Walia
Harsh Walia
Rupendra Gautam
Rupendra Gautam
Sanskriti Shrivastava
Sanskriti Shrivastava
Author LinkedIn connections

Introduction

On 25 September 2025, the Reserve Bank of India (RBI) issued the 'Authentication Mechanisms for Digital Payment Transactions Directions, 2025' (Directions) with the objective of strengthening security of digital payments by leveraging technological advancements beyond conventional SMS-based OTPs.

The Directions build upon the announcements made in the RBI's Statements on Developmental and Regulatory Policies from February 2024 and February 2025 (collectively, "Statements"), which underscore measures to enhance the resilience and security of payment systems.

While the Directions retain the core intent of the Statements, including the adoption of a principles-based framework and the classification of authentication factors, they also introduce several key additions that will have a material impact on practical implementation.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this document does not necessarily reflect the views / position of Khaitan & Co but remain solely those of the author(s). For any further queries or follow up, please contact Khaitan & Co at [email protected].

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

Use Of Artificial Intelligence (AI) In Courts

On June 3, 2026, the Supreme Court of India’s AI Committee released preliminary draft of the Regulations for Use of Artificial Intelligence (AI) in Courts, 2026 (“The Draft”). This marks a shift from scattered experiments with AI tools for translation, transcription, research and case management. With over 93,000 pending matters as of March 2026, the guidelines aim to ease processes for officials and citizens. AI could help reduce backlogs through automated cause-list preparation, transcription, research, and defect scrutiny, but its use also raises serious concerns.
IndiaTechnology
S.S. Rana & Co.
S.S. Rana & Co.
Article

Fintech In India: An Overview Of The Current Regulatory Landscape

India's fintech market is one of the fastest growing in the world, and it shows no sign of slowing down. Estimates put the market at about USD 145 billion at the end of 2025, growing at a compound annual rate of 30.55% to reach roughly USD 550 billion by 2030. India's fintech adoption rate is around 87%, reportedly the highest anywhere and well above the global average of roughly 64% to 67%. Add the world's second-largest digital population and the runway looks long.
IndiaTechnology
Legitpro Law
Legitpro Law
Article

CERT-In’s New AI-Vulnerability Guidelines: A Quick-Reference For OEMs, Tech Vendors And In-House Counsel

Cybersecurity regulation in India has, until now, largely spoken to the entity that suffers the breach. The 2022 CERT-In Directions issued under Section 70B of the Information Technology Act, 2000 fixed a six-hour reporting clock on the organisation that detects an incident. The new Guidelines flip the lens onto the entity upstream of that breach, the OEM or technology provider that built the product in the first place. For the first time, vendors supplying software, firmware, cloud platforms, or APIs into India carry direct, time-bound, and independently verifiable obligations of their own and not obligations that are merely passed through a customer contract, but obligations CERT-In itself may enforce.
IndiaTechnology
S.S. Rana & Co.
S.S. Rana & Co.
Article

Ministry Of Labour And Employment Operationalises The Provisions On Payment Of Statutory Bonus

On 25 August 2026, the Ministry of Labour and Employment issued two notifications (Notifications) under the Code on Wages, 2019 (Wage Code), thereby operationalising specified provisions relating to payment of statutory bonus for establishments for which the appropriate government is the Central Government. The Wage Code consolidates the legislative framework governing wages and related employee entitlements, including the regime previously governed by the Payment of Bonus Act, 1965.
IndiaEmployment and HR
Khaitan & Co.
Khaitan & Co.
Article

Supreme Court Clarifies Applicability Of SARFAESI Remedies For A Secured Creditor Who Acquires An NPA From A Non-notified NBFC

In Kotak Mahindra Bank Limited v Trupti Sanjay Mehta and Others, 2026 INSC 943 (Kotak Mahindra), the Hon’ble Supreme Court of India considered whether a bank as defined under Section 2(1)(c) of the Securitisation and Reconstruction of Financial Assets and Enforcement of Security Interest Act, 2002 (SARFAESI Act) could invoke the provisions of the SARFAESI Act to recover a secured debt acquired from an entity which was not covered under the ambit of the SARFAESI Act at the time of disbursement of the loan.
IndiaFinance and Banking
Khaitan & Co.
Khaitan & Co.
Article

Punjab And Haryana High Court Strikes Down JAO - FAO Retrospective Amendment As Unconstitutional

The Hon’ble Punjab and Haryana High Court (HC) in Jyoti Sareen vs. UOI & Others (CWP No. 15791-2024 (O&M)) (Order) held the retrospective amendments carried out vide the Finance Act, 2026, with respect to the powers of the Jurisdictional Assessing Officer (JAO) to issue a reopening notice under section 148 (Reopening Notice) of the Income-tax Act, 1961 (IT Act), as unconstitutional, being violative of the ‘doctrine of separation of powers’ and thus violative of Article 14 of the Constitution of India.
IndiaGovernment, Public Sector
Khaitan & Co.
Khaitan & Co.
Article

DOT Notifies Telecom Network Authorisation Rules, 2026: What Has Changed?

On 20 July 2026, the Department of Telecommunications (DoT) notified the Telecommunications (Authorisation for Telecommunication Network) Rules, 2026 (Rules). The Rules operationalise Section 3(1)(b) of the Telecommunications Act, 2023 and establish a framework for six categories of telecommunication network authorisations: infrastructure provider (IP) (formerly, IP-I), digital connectivity infrastructure provider (DCIP), internet exchange point (IXP) provider, satellite earth station gateway (SESG) provider, cloud-hosted telecommunication network (CTN) provider and mobile number portability (MNP) provider.
IndiaMedia, Telecoms, IT, Entertainment
Khaitan & Co.
Khaitan & Co.