RBI Mandatory 2FA, April 2026: UPI, Card and Wallet Readiness

The 1 April 2026 deadline is not a new principle. RBI has required two-factor authentication on card-not-present transactions since the 2009 circular on securing card payments. What changes on 1 April 2026 is scope expansion and exemption removal. The Reserve Bank has folded the 2FA / AFA requirement into the broader Master Direction on Digital Payment Security Controls and explicitly extended it to every Payment System Operator (PSO) regulated under the Payment and Settlement Systems Act, 2007.

The practical effect: low-value contactless card transactions below INR 5,000, recurring e-mandates above the previous INR 15,000 OTP threshold, UPI small-value PIN-less flows, and tokenised in-app payments must now demonstrate a documented second factor (something the customer has, knows, or is) that is cryptographically distinct from the first factor and logged in a tamper-evident audit trail. RBI has clarified that "dynamic" factors qualify only if they meet four tests: independence from the primary credential, single-use validity, replay resistance, and binding to the specific transaction (amount, payee, and timestamp).

Static OTPs delivered over SMS continue to qualify under the mandate, but are explicitly flagged as a transitional control. Entities are expected to publish migration roadmaps to cryptographic device-bound factors (FIDO2, secure-enclave keys, or RBI-approved soft tokens) in their FY26 board cyber reports. CISOs who plan to leave SMS-OTP as their only second factor past 2026 should expect direct supervisory questions during the next inspection cycle. The mandate's intent is clear: SMS is a stopgap, not a destination.

The mandate cuts across every digital payment channel a regulated entity touches. We map it across four buckets when we scope a readiness audit. UPI: The NPCI UPI 2.0+ flow already enforces device binding plus UPI PIN. The new requirement extends to UPI Lite, UPI on Credit Line, and UPI International, where pre-funded wallets or pre-authorised credit lines previously allowed PIN-less debits up to defined caps. From April 2026, the cap-based exemption stands only if the device binding plus behavioural-biometric signal is itself logged as an independent factor.

Cards: Card-present (POS / contactless) transactions over INR 5,000 already require PIN. Below that, NFC tap-and-pay must now carry a cryptographic device attestation (EMV ARQC validation logged) as the second factor. Card-not-present requires 3-D Secure 2.x with risk-based AFA, and the issuer's RBA engine itself becomes in-scope for VAPT. Wallets and PPIs: Closed-loop and semi-closed wallets must enforce AFA at load, transfer, and redemption. The previous small-value PPI carve-out is removed.

Cross-channel: Any transaction that originates on one rail and settles on another (UPI-funded wallet load, card-to-UPI mandate, etc.) must carry the AFA artefact end-to-end. This is where most PAs and PGs fail their first audit. The cross-channel piece is the one most regulated entities underestimate. RBI's NPCI-aligned guidance is explicit: the authentication artefact must travel with the transaction object, not just exist in the originating system's logs. If your PG offloads tokenisation to a third-party vault, the AFA evidence chain has to be reconstructable from your records alone during a supervisory review.

The 2FA mandate does not sit in isolation. It interlocks with two other RBI instruments that are already in force and will be tested together during the next inspection. The Master Direction on IT Governance, Risk, Controls and Assurance Practices (effective 1 April 2024 for commercial banks and NBFCs in the upper layer) requires that authentication controls be (a) approved by the IT Strategy Committee of the board, (b) tested annually by an independent auditor, and (c) covered by a documented change-management process. A 2FA rollout that bypasses the IT Strategy Committee minutes is a finding in itself, even if the technical control is sound. We have seen this trip up two NBFC clients in their 2025 inspection cycle.

The Cyber Crisis Management Plan (CCMP), mandated by the Indian Computer Emergency Response Team (CERT-In) and folded into RBI's cyber resilience framework, requires that authentication-system outages be classified as a Tier-1 cyber incident and reported to CERT-In within 6 hours of detection. That timeline was established under the CERT-In April 2022 directions. Your CCMP playbook must include a 2FA-system-failure runbook with named owners, fallback authentication procedures, customer-communication templates, and the CERT-In incident reporting workflow. During our tabletop exercises, this is the runbook most often missing.

For payments leadership, the practical takeaway: treat the 2FA programme as one workstream inside a tri-control delivery (authentication mandate, IT Governance Master Direction evidence, and CCMP runbook). Splitting them across three different vendors or three different internal teams is how compliance gaps open. Our compliance audit practice sequences these three so the same evidence pack satisfies all three inspectors.

Not every "second factor" qualifies. Here is the pass/fail matrix we apply during readiness reviews. The most common failure pattern we see in PA/PG audits is the "two-knowledge-factors masquerading as 2FA" trap. For instance, a card PAN entry plus a CVV (both static knowledge factors) being counted as AFA on legacy gateway endpoints. This pattern was a contributing factor in several mid-2020s card-data breaches across South and Southeast Asia, including incidents tracked under CVE classifications related to 3-D Secure 1.0 deprecation.

RBI inspectors look for it specifically, so if your code path still treats PAN+CVV as two factors, fix it before scoping a VAPT. The pattern table sets out which controls pass, which fail outright, and which (SMS OTP) survive only as a transitional control with a documented migration roadmap.

A 2FA readiness VAPT engagement is not a generic application pentest. The scope must be channel-aware and evidence-driven. Here is the scoping template our offensive engineering team uses for regulated payment entities. Authentication flow mapping: document every transaction-initiation path across web, mobile, IVR, USSD, and partner API. Map each path to the second factor it invokes. Any path with no documented factor is a finding before testing even starts.

Independence testing verifies that compromise of factor 1 cannot derive factor 2. Common attacks tested: SIM-swap simulation against OTP delivery, mailbox-compromise replay against email OTP, session-fixation against app-push approval, and credential-stuffing chained with OTP-bypass. Replay and timing tests follow OWASP ASVS v4.0.3 section 2.7 (out-of-band verifier requirements) and NIST SP 800-63B AAL2 baselines. MITRE ATT&CK alignment maps findings to T1110.003, T1556.006, T1621 and T1539.

3-D Secure 2.x deep test: for card issuers and acquirers, the RBA engine itself is in-scope. We test the challenge / frictionless decision logic for bypass via header manipulation, device-ID spoofing, and adversarial scoring inputs. Cross-channel evidence chain: pick five real production transactions (anonymised) and ask the entity to reconstruct the AFA evidence from logs alone. If they cannot, the audit fails the cross-channel test. Plan for a 4-6 week engagement window for a mid-sized PA/PG, 6-10 weeks for a Tier-1 bank, and budget for at least one retest cycle. Penetration testing engagements that start later than mid-January 2026 leave no buffer for fixes before the deadline.

Use the following gap analysis template to convert the mandate into a tracked programme. Each row is owned by a named individual, has a target evidence artefact, and is reviewed weekly at the steering committee. If you started this programme in mid-2026, you are on schedule. If you are starting now in June 2026, the runway is compressed. Most regulated entities we are onboarding in Q2 FY27 are running VAPT in parallel with remediation rather than sequentially. That works only with a tightly-scoped engagement and a steering committee that meets weekly.

The cost of missing the 1 April 2026 deadline is not theoretical. RBI's enforcement playbook in recent years includes three escalating tiers, and we have seen all three applied during the FY24 and FY25 inspection cycles. Tier 1 is monetary penalties under Section 30 of the Payment and Settlement Systems Act, 2007: penalties of up to INR 10 lakh per contravention (or twice the amount involved, whichever is higher) with continuing penalties of up to INR 25,000 per day for ongoing non-compliance. For a PA processing 50,000+ daily transactions, this scales fast.

Tier 2 is business restrictions: RBI has, in multiple recent cases, ordered named PAs and card networks to stop onboarding new customers until specific cyber and authentication findings are closed. The 2022 supervisory action against a global card network (restored after remediation in 2023) and the 2023-24 PA onboarding freezes are the public examples. Revenue impact: a halted onboarding pipeline at a growth-stage PA can wipe 30-60% of forecast quarter revenue.

Tier 3 is licence implications: for PSOs operating under PSS Act authorisation, persistent non-compliance feeds into the periodic authorisation review. Authorisations have been allowed to lapse where cyber findings remained open across two inspection cycles. Beyond RBI, there is parallel exposure under the Digital Personal Data Protection Act (DPDPA) 2023. The Data Protection Board can levy penalties of up to INR 250 crore for failure to take reasonable security safeguards, and an authentication bypass that leaks transaction data is precisely the failure mode the DPDPA targets. The cheapest defensive control here is finishing the readiness programme on time.

Does the 1 April 2026 RBI 2FA mandate apply to UPI Lite and low-value contactless card payments? Yes. The previous cap-based exemptions for UPI Lite and contactless card transactions below INR 5,000 are removed in their old form. The transactions can still be PIN-less for the customer, but the entity must log an independent second factor, typically device binding plus a cryptographic attestation, and produce it on demand during a supervisory review.

Is SMS-OTP still acceptable as a second factor after April 2026? SMS-OTP continues to qualify as a transitional control, but RBI expects regulated entities to publish a migration roadmap to cryptographic device-bound factors (FIDO2, secure-enclave keys, or RBI-approved soft tokens) in their FY26 board cyber report. CISOs planning to leave SMS-OTP as their only second factor should expect supervisory questions and document their SIM-swap risk treatment.

How does the mandate interact with the RBI IT Governance Master Direction? The IT Governance Master Direction (in force since 1 April 2024 for commercial banks and upper-layer NBFCs) requires that authentication controls be approved by the IT Strategy Committee of the board, tested annually by an independent auditor, and covered by a documented change-management process. The 2FA rollout must therefore be evidenced not just in technical logs but in board minutes and auditor reports.

What VAPT scope is needed to demonstrate 2FA coverage to an RBI inspector? At minimum, an authentication flow map across every channel, independence testing against SIM-swap and mailbox-compromise vectors, replay and timing tests against OWASP ASVS v4.0.3 and NIST SP 800-63B AAL2, MITRE ATT&CK-mapped findings, and a cross-channel evidence chain test on five real production transactions. The report should include a board brief plus a technical report mapped to OWASP, CWE, MITRE ATT&CK, and the RBI Cyber Security Framework.

What happens if a Payment Aggregator or Payment Gateway misses the 1 April 2026 deadline? Exposure is tiered: monetary penalties of up to INR 10 lakh per contravention plus INR 25,000 per day under Section 30 of the PSS Act, business restrictions such as onboarding freezes (already applied to named PAs and card networks in 2022-24), and at the extreme end licence-authorisation implications during the next review cycle. DPDPA exposure of up to INR 250 crore applies in parallel for failure of reasonable security safeguards.

How long does a 2FA readiness VAPT engagement take? Plan for 4-6 weeks for a mid-sized PA/PG, 6-10 weeks for a Tier-1 bank, plus at least one retest cycle. Engagements that start later than mid-January 2026 leave no buffer for remediation; entities starting in mid-2026 typically run VAPT in parallel with remediation under a tightly-scoped steering committee.

Where does the Cyber Crisis Management Plan fit into 2FA readiness? The CCMP, aligned to the CERT-In 6-hour incident reporting timeline from the April 2022 directions, must include a 2FA-system-failure runbook with named owners, fallback authentication procedures, customer communication templates, and the CERT-In reporting workflow. Authentication-system outages are Tier-1 cyber incidents and the runbook is tested in tabletop exercises ahead of inspection.

Ready to lock in your 2FA readiness audit before the April 2026 deadline? Our CERT-In empanelled team has run 1,200+ engagements including dozens of RBI-regulated payment stacks, and we ship the dual board-brief plus technical report aligned to the RBI Cyber Security Framework, OWASP, and MITRE ATT&CK. Start with our VAPT services page or reach the founders directly. Engagements booked before October 2026 leave room for retest closure before the deadline.

]]>