RBI Enforces Mandatory 2FA for All Digital Transactions as New Banking and Financial Rules Take Effect from April 1, 2026

The move comes in response to the growing risks associated with OTP-based systems, which have become vulnerable to fraud techniques such as phishing and SIM swap scams.

Under the RBI’s new framework, every digital payment made through UPI, cards, or wallets must be verified using at least two independent factors. OTP will remain one component of authentication, but it must be combined with another independent verification step. This means one-time passwords alone will no longer suffice, and every transaction will require an additional verification layer such as a PIN, password, biometric authentication, or secure token. As a result, all payments will pass through two levels of security, making the process slightly longer but significantly safer.

To balance security with convenience, banks will adopt a risk-based approach. Transactions from trusted devices or routine small payments may remain quick and seamless, while large payments or those made from new devices may trigger additional verification steps.

Alongside these changes, the RBI has tightened accountability norms, placing greater responsibility on banks and payment platforms to ensure secure systems. In cases where fraud occurs due to system failures or lapses, institutions may be required to compensate users, potentially leading to faster grievance redressal. The rules are also expected to ensure quicker resolution of fraud-related complaints.

The National Payments Corporation of India has introduced several efficiency-focused limits under revised UPI operational rules. Users are now capped at 50 balance checks per app per day to prevent system overload. Account linking is limited to a maximum of 25 bank accounts per day on a single UPI app. Pending transaction status can be checked only three times, with a mandatory gap of 90 seconds between each attempt. Recurring payments such as EMIs and subscriptions will now be processed during non-peak hours, including before 10 AM or after 9:30 PM.

Additional banking and financial changes have also been implemented. Retailers such as HDFC Bank will now count UPI-based cardless withdrawals toward the monthly free transaction limit, after which a fee of Rs 23 plus taxes will apply. RuPay Platinum debit card holders will no longer have access to airport or train lounges from April 1. Similar two-factor authentication rules will also be extended to cross-border transactions, with full implementation required by October 1, 2026.

Beyond banking, Indian Railways has revised its ticket cancellation policy by reducing the refund window. Passengers cancelling tickets within eight hours of departure will no longer be eligible for refunds, compared to the earlier four-hour cutoff. Confirmed tickets cancelled within eight hours will receive no refund, cancellations made between eight and 24 hours before departure will incur a 50 percent penalty, cancellations between 24 and 72 hours will attract a 25 percent penalty, and cancellations made more than 72 hours in advance will receive a maximum refund subject to a flat deduction. Waitlisted and RAC ticket rules remain unchanged, allowing cancellation up to 30 minutes before departure.

Meanwhile, the National Highways Authority of India has increased the FASTag annual pass fee from Rs 3,000 to Rs 3,075 for the financial year 2026–27, effective April 1.

New PAN card rules have also come into force. Aadhaar-only applications are now invalid, and applicants must provide additional proof of birth, such as a birth certificate or passport. The name on the PAN card must match Aadhaar records, and new category-specific forms, Form 93 to Form 96, have been made mandatory.

These sweeping changes mark a decisive shift toward tighter digital security, enhanced institutional accountability, and stricter regulatory oversight across India’s financial and transactional ecosystem, directly impacting millions of users nationwide.