What changed
RBI extended the mandatory additional authentication requirement to all CNP transactions previously listed in its December 31, 2010 circular, with a compliance deadline of May 1, 2012. Previously, only certain CNP transactions (excluding IVR) were covered from August 2009, and IVR was added from February 2011. Now, no CNP transaction category is exempt.
What it means for you
Banks must ensure every online card transaction without the card's physical presence uses a second authentication factor (like OTP or password) by May 2012. Failure to do so makes the issuer bank liable for any customer losses from unauthorized transactions. This tightens security for cardholders but requires banks to upgrade systems and coordinate with payment networks.
What you must do
- Audit all CNP transaction categories to ensure additional authentication is in place for those listed in the December 31, 2010 circular by May 1, 2012.
- Update IT systems and merchant agreements to support additional factor authentication for IVR and other CNP transactions.
- Prepare a customer complaint and reimbursement mechanism for losses arising from non-compliant transactions after the deadline.
- Coordinate with card payment networks to implement the required authentication solutions.
Who it affects
All scheduled commercial banks including RRBs, Urban co-operative banks, State and district central co-operative banks, Authorised card payment networks, Card-issuing banks
What is the deadline for implementing additional authentication for all CNP transactions?
The deadline is May 1, 2012. All CNP transactions listed in the December 31, 2010 circular must have an additional factor of authentication by this date.
What happens if a bank processes a CNP transaction without additional authentication after the deadline?
If a customer complains about a loss from such a transaction, the issuer bank must reimburse the customer without any objection.
Does this circular apply to IVR transactions?
Yes, IVR transactions were already covered from February 1, 2011, and this circular confirms they are included in the mandatory additional authentication requirement.