{"what_this_is":"The machine-readable twin of the BankPulse page for one RBI rulebook. Same points, same dates, same paragraph references as the page a person reads. RBI's own wording is not reproduced here: each point names the RBI paragraph, the character offset into the text BankPulse read and the sha256 of that text, so the claim can be checked against RBI's own document.","schema_version":1,"release_id":"d653cdb0a5","generated_at":"2026-09-15T00:33:59.117975+00:00","id":"md12898","title":"Reserve Bank of India (Authentication mechanisms for  digital payment transactions) Directions, 2025","document_kind":"Directions","page":"https://bankpulse.ai/rule/md12898","status":"In force","importance":{"code":"MR","label":"MUST READ","weight":"Must read","why":"Binding instrument, class not named: applies broadly","layer":"bankpulse_inference"},"applies_to":{"shown":"All regulated entities","class_code":"ALL","from":"the document's own title","layer":"bankpulse_inference"},"dates":{"prid":"md12898","mode":"four_dates_v1","published":{"label":"Published","value":"Sep 25, 2025","stated":true,"why":"The day RBI put this document out."},"effective":{"label":"Starts to apply","value":"","stated":false,"why":"Not stated separately in this document. Read the rule itself before you assume a start date."},"transition":{"label":"Time to get ready","value":"","stated":false,"why":"Cannot be worked out until the day it starts to apply is known."},"deadline":{"label":"Last date to act","value":"April 01, 2026","stated":true,"why":"The day by which the work this rule asks for must be finished."},"sources":{"published":"doc_date in data/highlights/md12898.json","effective":"none held","transition":"none held","deadline":"data/date_kinds.json kind=compliance_deadline"}},"rbi_source":{"url":"https://rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=12898","document_date":"Sep 25, 2025","read_by_bankpulse":"2026-08-21 16:14:40 UTC","text_sha256":"c52360c2bb6d1a724b7c9d1976374103de99cbcd0fcffd750dcdf9cd1fbc9b21","word_count":1446,"standing_last_checked":"Standing checked on RBI’s Master Directions index, 15 September 2026, 5:58 am IST."},"counts":{"points_shown":29,"points_naming_an_rbi_paragraph":29,"points_stored":29,"actions":0,"amendments":0},"points":[{"n":1,"claim":"md12898-09891f3e","page_group":"Must know","stored_section":"WHO IT APPLIES TO","heading":"Two-factor rule for all payments","plain_english":"Every digital payment transaction in India needs two factors of authentication.","rbi_paragraph":"Para 1","rbi_char_offset":2327,"weight":"MUST KNOW","role":"Payments","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p1","layer":"bankpulse"},{"n":2,"claim":"md12898-0b50c63d","page_group":"Must know","stored_section":"WHAT CHANGES","heading":"Comply by April 2026","plain_english":"All payment providers and participants must comply with these rules by April 01, 2026.","rbi_paragraph":"Para 3","rbi_char_offset":3864,"weight":"MUST KNOW","role":"Compliance","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p2","layer":"bankpulse"},{"n":3,"claim":"md12898-97b516b3","page_group":"Must know","stored_section":"WHO IT APPLIES TO","heading":"Covers all payment system players","plain_english":"These rules cover every payment system provider and participant, banks and non-banks.","rbi_paragraph":"Para 4","rbi_char_offset":4109,"weight":"MUST KNOW","role":"Payments","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p3","layer":"bankpulse"},{"n":4,"claim":"md12898-a856dab6","page_group":"Must know","stored_section":"WHO IT APPLIES TO","heading":"Domestic transactions only, unless exempt","plain_english":"The rules apply to domestic digital payments, unless specifically exempted.","rbi_paragraph":"Para 4","rbi_char_offset":4233,"weight":"MUST KNOW","role":"Payments","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p4","layer":"bankpulse"},{"n":5,"claim":"md12898-c4cc70e7","page_group":"Must know","stored_section":"WHO SHOULD ACT","heading":"Minimum two authentication factors required","plain_english":"Every digital payment must use at least two separate authentication factors, unless exempted.","rbi_paragraph":"Para 6","rbi_char_offset":6269,"weight":"MUST KNOW","role":"Payments","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p5","layer":"bankpulse"},{"n":6,"claim":"md12898-b15172ec","page_group":"Must know","stored_section":"WHO SHOULD ACT","heading":"One factor must be dynamic","plain_english":"For most transactions, at least one authentication factor must be created fresh each time.","rbi_paragraph":"Para 6","rbi_char_offset":6782,"weight":"MUST KNOW","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p6","layer":"bankpulse"},{"n":7,"claim":"md12898-efd7efdb","page_group":"Must know","stored_section":"WHO SHOULD ACT","heading":"Factors must not depend together","plain_english":"If one factor is broken, the other one must still work on its own.","rbi_paragraph":"Para 6","rbi_char_offset":6987,"weight":"MUST KNOW","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p7","layer":"bankpulse"},{"n":8,"claim":"md12898-11263ac3","page_group":"Must know","stored_section":"WHO SHOULD ACT","heading":"Issuer pays for non-compliance losses","plain_english":"If a loss happens because the issuer broke these rules, it must repay the customer in full.","rbi_paragraph":"Para 9","rbi_char_offset":8408,"weight":"MUST KNOW","role":"Compliance","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p8","layer":"bankpulse"},{"n":9,"claim":"md12898-1335f29d","page_group":"Must know","stored_section":"WHO IT APPLIES TO","heading":"Cross-border card deals excluded","plain_english":"These directions do not apply to cross-border digital payment transactions.","rbi_paragraph":"Para 10","rbi_char_offset":8700,"weight":"MUST KNOW","role":"Card issuer","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p9","layer":"bankpulse"},{"n":10,"claim":"md12898-21daf9e8","page_group":"Must know","stored_section":"WHAT CHANGES","heading":"A ₹2,000 exemption is repealed","plain_english":"RBI has repealed the old rule letting small card payments under ₹2,000 skip extra checks.","rbi_paragraph":"Para 11","rbi_char_offset":11908,"weight":"MUST KNOW","role":"Card issuer","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p10","layer":"bankpulse"},{"n":1,"claim":"md12898-eb4930e6","page_group":"Do it","stored_section":"WHO SHOULD ACT","heading":"Issuers may offer factor choice","plain_english":"Issuers may let customers choose which authentication factors to use.","rbi_paragraph":"Para 6","rbi_char_offset":6509,"weight":"DO IT","role":"Payments","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p11","layer":"bankpulse"},{"n":2,"claim":"md12898-9a5eab5a","page_group":"Do it","stored_section":"WHO SHOULD ACT","heading":"Open access to authentication tools","plain_english":"Providers must make their authentication or tokenisation service open to every application.","rbi_paragraph":"Para 7","rbi_char_offset":7136,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p12","layer":"bankpulse"},{"n":3,"claim":"md12898-fb5198b1","page_group":"Do it","stored_section":"WHO SHOULD ACT","heading":"Issuers may weigh transaction risk","plain_english":"Issuers may check transactions against risk signals like location and device details.","rbi_paragraph":"Para 8","rbi_char_offset":7752,"weight":"DO IT","role":"Risk","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p13","layer":"bankpulse"},{"n":4,"claim":"md12898-ca6e96ad","page_group":"Do it","stored_section":"WHO SHOULD ACT","heading":"DigiLocker may flag risky payments","plain_english":"Issuers may use DigiLocker to notify and confirm high-risk transactions.","rbi_paragraph":"Para 8","rbi_char_offset":8155,"weight":"DO IT","role":"Risk","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p14","layer":"bankpulse"},{"n":5,"claim":"md12898-1c06cb28","page_group":"Do it","stored_section":"WHO SHOULD ACT","heading":"Issuer must test its system","plain_english":"The issuer must check its login system is sound before using it.","rbi_paragraph":"Para 9","rbi_char_offset":8305,"weight":"DO IT","role":"Technology","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p15","layer":"bankpulse"},{"n":6,"claim":"md12898-45e5f82a","page_group":"Do it","stored_section":"WHO SHOULD ACT","heading":"Follow the data protection law","plain_english":"Issuers must follow the Digital Personal Data Protection Act, 2023.","rbi_paragraph":"Para 9","rbi_char_offset":8574,"weight":"DO IT","role":"Compliance","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p16","layer":"bankpulse"},{"n":7,"claim":"md12898-e281bd1e","page_group":"Do it","stored_section":"WHO SHOULD ACT","heading":"Validate cross-border card requests soon","plain_english":"By October 01, 2026, card issuers must set up checks for one-time cross-border card payments.","rbi_paragraph":"Para 10","rbi_char_offset":8804,"weight":"DO IT","role":"Card issuer","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p17","layer":"bankpulse"},{"n":8,"claim":"md12898-f57990a0","page_group":"Do it","stored_section":"WHO SHOULD ACT","heading":"Register card numbers with networks","plain_english":"Card issuers must register their BINs with card networks.","rbi_paragraph":"Para 10","rbi_char_offset":9036,"weight":"DO IT","role":"Card issuer","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p18","layer":"bankpulse"},{"n":9,"claim":"md12898-d601eb3e","page_group":"Do it","stored_section":"WHO SHOULD ACT","heading":"Second cross-border risk check","plain_english":"By October 01, 2026, card issuers must also add a risk-based check for cross-border card payments.","rbi_paragraph":"Para 10","rbi_char_offset":9156,"weight":"DO IT","role":"Card issuer","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p19","layer":"bankpulse"},{"n":1,"claim":"md12898-0ab9be71","page_group":"Background","stored_section":"THE CORE IDEA","heading":"Legal basis for these rules","plain_english":"RBI issues these rules under Sections 18 and 10(2) of the PSS Act, 2007.","rbi_paragraph":"Para 1","rbi_char_offset":3557,"weight":"BACKGROUND","role":"Compliance","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p20","layer":"bankpulse"},{"n":2,"claim":"md12898-8384c76a","page_group":"Background","stored_section":"THE CORE IDEA","heading":"What authentication means","plain_english":"RBI says authentication means checking who sent the payment order.","rbi_paragraph":"Para 5","rbi_char_offset":4487,"weight":"BACKGROUND","role":"Payments","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p21","layer":"bankpulse"},{"n":3,"claim":"md12898-011ccf43","page_group":"Background","stored_section":"THE CORE IDEA","heading":"What a CNP transaction is","plain_english":"A CNP transaction is one where the card is not physically present.","rbi_paragraph":"Para 5","rbi_char_offset":4637,"weight":"BACKGROUND","role":"Payments","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p22","layer":"bankpulse"},{"n":4,"claim":"md12898-27c23ade","page_group":"Background","stored_section":"THE CORE IDEA","heading":"What card-present means","plain_english":"A card-present transaction is done by physically using the card at the transaction point.","rbi_paragraph":"Para 5","rbi_char_offset":4788,"weight":"BACKGROUND","role":"Payments","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p23","layer":"bankpulse"},{"n":5,"claim":"md12898-4dec434e","page_group":"Background","stored_section":"THE CORE IDEA","heading":"What cross-border CNP means","plain_english":"A cross-border CNP transaction is an Indian card used to pay an overseas merchant.","rbi_paragraph":"Para 5","rbi_char_offset":4915,"weight":"BACKGROUND","role":"Card issuer","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p24","layer":"bankpulse"},{"n":6,"claim":"md12898-1b638341","page_group":"Background","stored_section":"THE CORE IDEA","heading":"What a factor is","plain_english":"A factor of authentication is a credential used to confirm the customer.","rbi_paragraph":"Para 5","rbi_char_offset":5296,"weight":"BACKGROUND","role":"Payments","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p25","layer":"bankpulse"},{"n":7,"claim":"md12898-04b26ebb","page_group":"Background","stored_section":"THE CORE IDEA","heading":"Who counts as issuer","plain_english":"The issuer is the bank or non-bank that holds the customer's account.","rbi_paragraph":"Para 5","rbi_char_offset":5670,"weight":"BACKGROUND","role":"Payments","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p26","layer":"bankpulse"},{"n":8,"claim":"md12898-5e1fff0b","page_group":"Background","stored_section":"THE CORE IDEA","heading":"Undefined terms follow PSS Act","plain_english":"Any word not defined here takes its meaning from the PSS Act, 2007.","rbi_paragraph":"Para 5","rbi_char_offset":5829,"weight":"BACKGROUND","role":"Compliance","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p27","layer":"bankpulse"},{"n":9,"claim":"md12898-a67d9b14","page_group":"Background","stored_section":"WHO SHOULD ACT","heading":"Extra checks allowed for risk","plain_english":"Riskier transactions may get checks beyond the minimum two-factor authentication.","rbi_paragraph":"Para 8","rbi_char_offset":8011,"weight":"BACKGROUND","role":"Risk","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p28","layer":"bankpulse"},{"n":10,"claim":"md12898-45e71897","page_group":"Background","stored_section":"WHAT CHANGES","heading":"Old card-security circulars are repealed","plain_english":"This rule replaces a list of older card-security circulars listed in Annexure-2.","rbi_paragraph":"Para 11","rbi_char_offset":9301,"weight":"BACKGROUND","role":"Compliance","team":null,"products_covered":[],"products_excluded":[],"bankpulse_example":null,"anchor":"https://bankpulse.ai/rule/md12898#p29","layer":"bankpulse"}],"actions":[],"amendments":[],"layers":{"rbi_source":"Facts taken from RBI's own document.","bankpulse":"BankPulse's plain-English summary of RBI's document.","bankpulse_inference":"BankPulse's own inference, not stated by RBI."},"rbi_wording_not_included":"By design. BankPulse never republishes RBI's exact sentences. Use rbi_paragraph with rbi_source.url to read RBI's own words.","terms":"BankPulse's plain-English summaries are BankPulse's own work. The underlying regulation is the Reserve Bank of India's. Always check the RBI document named in rbi_source before acting."}