DRAFT CIRCULAR FOR COMMENTS

CO.DPSS.POLC.No. S-**** / 02-14-003 / 2024-25

Date of Issue

All Payment System Providers and Payment System Participants (banks and non-banks)

Madam / Dear Sir,

Additional Factor of Authentication (AFA) for cross-border Card Not Present (CNP) transactions - DRAFT

The Reserve Bank of India (hereafter, the Bank) had mandated AFA for domestic card transactions, vide circular RBI / DPSS No. 1501 / 02.14.003 / 2008-2009 dated February 18, 2009 on “Credit/Debit Card transactions-Security Issues and Risk mitigation measures”, and DPSS.PD.CO. No.223/02.14.003/2011-2012 dated August 4, 2011 on “Security Issues and Risk mitigation measures related to Card Not Present (CNP) transactions” to provide an additional layer of security. The Bank’s Payments Vision 2025 envisaged a similar experience for cross-border card transactions.

2. Accordingly, it is now proposed to mandate AFA for cross-border Card Not Present (CNP) transactions as detailed below:

1. Card issuers shall register their BINs with card networks for AFA validation.

2. Card issuers shall validate AFA¹ for non-recurring² cross-border³ CNP transaction, whenever a request for AFA is raised by the overseas merchant or the overseas acquirer.

3. Card issuers shall put in place a risk-based mechanism for handling all cross-border transactions.

3. These directions are being issued in exercise of the powers conferred under Section 18 read with Section 10(2) of the Payment and Settlement Systems Act, 2007 (Act 51 of 2007) and shall come into force three months from the date of this circular.

Yours faithfully,

Chief General Manager-in-Charge