<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/marketing-cms/m2p-blog/2025/12/rbi-mandate-blog-banner-2025-02.webp" alt="RBI April 2026 Mandate, Payment Authentication" title="" id="at2sv37qf" width="100%" height="253">India’s digital payments are scaling at record speed ₹14 lakh crore in monthly transactions reshaping how consumers and businesses interact. This rapid adoption, while fueling convenience and growth, also brings rising risks: fraud losses touched ₹36,000 crore in FY24–25, with SMS OTPs proving increasingly vulnerable. To restore trust, RBI’s new rules respond to this threat with a comprehensive approach emphasizing robust, adaptable authentication to a stronger security benchmark for the future of digital transactions.<blockquote class="block-node" id="0yzd5fdh1">The Reserve Bank of India (RBI) has introduced a landmark directive: dynamic, two factor authentications for all digital payment transactions, effective April 1, 2026. The goal is to move beyond the ‘OTP-only’ mindset and build a smarter, more resilient security layer that protects users without derailing convenience.</blockquote>Let’s dive into the new directives of RBI.<h2 class="heading-node" id="jmlsnp9fx">The New Framework: Balancing Security, Innovation, and Convenience</h2>The RBI's new directions are a deliberate attempt to harmonize three crucial aspects of digital finance: robust security, agile innovation, and seamless customer convenience. India has long relied on two-factor authentication (2FA), primarily through the ubiquitous SMS-based One-Time Password (OTP).The new framework strategically acknowledges this dependency while simultaneously expanding the definition of acceptable authentication methods, moving the payment industry toward more sophisticated and flexible solutions.<h3 class="heading-node" id="inxjalowt">1. Authentication Diversity: Beyond the OTP</h3>The guidelines officially sanction a diverse array of authentication factors, allowing financial institutions to move beyond legacy SMS-OTP and determine which factors best meet their operational and consumer needs. This expanded scope includes:<ul class="list-node" id="cws4xnuxe"><li>Knowledge: Passwords, passphrases, and PINs.</li><li>Possession: Card hardware or software tokens.</li><li>Inherence: Fingerprints or any biometric method (whether device-native or using Aadhaar).</li></ul><h3 class="heading-node" id="ovsv7tvqp">2. The Dynamic 2FA Mandate</h3>While the fundamental requirement for authenticating every digital payment transaction with two or more distinct factors remains, the RBI has introduced a critical stipulation for non-card-present (CNP) transactions: At least one authentication factor must be dynamic, meaning it is unique to the transaction in question.This creation of a Proof-of-Possession mechanism significantly enhances security potential, making it virtually impossible for fraudsters to reuse possession data from previous transactions.<h3 class="heading-node" id="vf8odmbpj">3. Risk-Based Intelligence Takes Center Stage</h3>One of the most transformative features of the new framework is the explicit encouragement of Risk-Based Authentication (RBA). Financial institutions now have the strategic ability to move beyond the minimum 2FA requirement when a higher-risk transaction is observed.Issuers are encouraged to evaluate transactions against a sophisticated set of behavioral and contextual parameters, including:<ul class="list-node" id="av5eevcio"><li>User behavior patterns and historical transaction profiles.</li><li>Transaction location.</li><li>Device-specific attributes and fingerprinting.</li></ul>This risk-based approach ensures minimal friction for low-risk transactions (e.g., through familiar devices or locations), while automatically escalating high-risk attempts to trigger additional verification steps. The RBI has even suggested platforms like Digi Locker as a probable channel for the notification and verification of high-risk transactions.<h3 class="heading-node" id="p8knchuts">4. Strengthening Cross-Border Transaction Security</h3>Recognizing the specific vulnerabilities in the global digital payment ecosystem, the RBI has focused on securing international digital commerce. Card issuers must validate the Additional Factor of Authentication in non-recurring, cross-border Card-Not-Present (CNP) transactions whenever overseas merchants or acquirers request it.Financial institutions have until October 1, 2026, to establish the necessary processes to address all cross-border CNP transactions. This includes registering Bank Identification Numbers (BINs) with card networks, a necessary step that balances the technical challenges of implementation with the imperative of maintaining seamless payment experiences for global customers.<h2 class="heading-node" id="o2zadw1ni">The Need for Intelligent Solutions</h2>With RBI setting the stage for smarter authentication, businesses need solutions that go beyond compliance, solutions that think, adapt, and protect in real time.That’s where M2P’s Risk-Based Authentication Platform comes in.<h3 class="heading-node" id="8xqz7hmeo">Introducing M2P’s Risk-Based Authentication Platform</h3>At M2P, our full-stack solution is designed for banks and financial institutions to go beyond compliance by enabling seamless, secure, and intelligent authentication experiences, starting with full adherence to RBI’s mandate across card-present, card-not-present (ACS/3DS), and non-card transactions. Our stack helps our partners to &nbsp;<ul class="list-node" id="vdq0jszij"><li>Comply with RBI’s mandate across card-present, card-not-present (ACS/3DS), and non-card transactions.</li><li>Orchestrate authentication flows based on transaction risk, user behavior, and device fingerprinting.</li><li>Support all authentication modes—PIN, OTP, biometrics, and behavioral biometrics.</li><li>Deliver consistent experiences across mobile, web, and backend channels</li><li>Integrate easily via SDKs and APIs.</li><li>Scale confidently with a transparent commercial model.</li></ul><h3 class="heading-node" id="2mjkqvvy4">Why does M2P Stands Out?</h3><ul class="list-node" id="rrmcpl2nv"><li>Proven expertise in adaptive authentication and risk-based decisioning.</li><li>Support for multiple authentication modes across knowledge, possession, and inherence.</li><li>Flexibility to define your authentication strategy.</li><li>Consistent customer experience across channels.</li><li>Transparent commercial model.</li></ul><h2 class="heading-node" id="5eghx9d60">Looking Ahead</h2>Leading banks and fintech businesses are partnering with us to not just meet regulatory deadlines but to go beyond compliance by delivering authentication solutions that are secure, seamless, and intelligent.Want to future-proof your authentication strategy using RBA?<a class="link" href="https://m2pfintech.com/contact-us/?activeKey=1&amp;utm_source=RBI%20New%20Directive%20for%20Payment%20Authentication&amp;utm_medium=Risk-Based%20Authentication%20Platform&amp;utm_campaign=RBI%20New%20Directive%20for%20Authentication%20Blog">Schedule a demo</a> with us.Follow us on&nbsp;<a class="link fui-Link ___1idfs5o f3rmtva f1ewtqcl fyind8e f1k6fduh f1w7gpdv fk6fouc fjoy568 figsok6 f1hu3pq6 f11qmguv f19f4twv f1tyq0we f1g0x7ka fhxju0i f1qch9an f1cnd47f fqv5qza f1vmzxwi f1o700av f13mvf36 f1cmlufx f9n3di6 f1ids18y f1tx3yz7 f1deo86v f1eh06m1 f1iescvh ftqa4ok f2hkw1w fhgqx19 f1olyrje f1p93eir f1h8hb77 f1x7u7e9 f10aw75t fsle3fq f17ae5zn" href="https://www.linkedin.com/company/m2pfintech/mycompany/" target="_blank" rel="noreferrer noopener">LinkedIn</a>&nbsp;and&nbsp;<a class="link fui-Link ___1idfs5o f3rmtva f1ewtqcl fyind8e f1k6fduh f1w7gpdv fk6fouc fjoy568 figsok6 f1hu3pq6 f11qmguv f19f4twv f1tyq0we f1g0x7ka fhxju0i f1qch9an f1cnd47f fqv5qza f1vmzxwi f1o700av f13mvf36 f1cmlufx f9n3di6 f1ids18y f1tx3yz7 f1deo86v f1eh06m1 f1iescvh ftqa4ok f2hkw1w fhgqx19 f1olyrje f1p93eir f1h8hb77 f1x7u7e9 f10aw75t fsle3fq f17ae5zn" href="https://twitter.com/m2pfintech" target="_blank" rel="noreferrer noopener">Twitter</a>&nbsp;for insightful fintech bytes curated for curious minds like you.Source<ol class="list-node" id="rtd28l8fa"><li>https://www.angelone.in/news/economy/upi-dominates-digital-payments-hits-84-share-in-fy25</li><li>https://vajiramandravi.com/current-affairs/surge-in-bank-fraud-value-despite-decline-in-cases-rbi-data-for-fy25/#:~:text=According%20to%20the%20RBI's%20Annual,or%20better%20internal%20control%20measures</li><li>Reserve Bank of India : Latest News Headlines, Videos and Photo Galleries on Reserve Bank of India | Business Standard</li><li>RBI Sets New Digital Payments Authentication Rules, Ends OTP-only Era From April 2026 - BW Businessworld</li><li>RBI mandates stronger two-factor authentication in new guidelines | Finance News - Business Standard</li></ol><hr>

Adapting to RBI’s New Mandate: How M2P’s RBA Platform Enables Intelligent Payment Authentication

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2025/04/RBI-guidelines-banner.webp" alt="RBI’s Lending Against Gold Collateral Directions 2025: Key Guidelines and Impacts Explained" title="" width="100%" height="253">The Reserve Bank of India (RBI) has released the Draft Directives 2025 on Lending Against Gold Collateral, bringing a much-needed regulatory reset to a sector that’s long operated in silos.&nbsp;Applicable to all regulated entities (REs), including commercial banks, cooperative banks, and NBFCs, these guidelines aim to standardize gold loan practices, tighten controls, and ensure borrower protection. With the gold loan market continuing to expand, particularly in rural and semi-urban India, this framework focuses on improving underwriting, valuation, collateral safety, and end-use transparency.&nbsp;<h2 class="heading-node" id="vrr5rtsz3" style="text-align: justify">Background: Current State of Gold Lending</h2>RBI’s review uncovered widespread irregularities and recurring issues in gold loan practices. Lenders increasingly relied on third-party agents, often valuing gold without the borrower present. Due diligence was inadequate, and end-use monitoring, especially for high-value or income-generating loans, was inconsistent or missing. Recovery practices also lacked transparency, with many borrowers not properly informed during gold auctions.&nbsp;&nbsp;Additionally, the enforcement of the 75% Loan-to-Value (LTV) cap was uneven, and risk weights were incorrectly applied. These gaps highlighted the need for a unified regulatory framework, one that ensures borrower protection, operational discipline, and standardization across the gold loan ecosystem.<h2 class="heading-node" id="bqnbvf39j" style="text-align: justify">Key Proposals in the RBI's Draft Guidelines</h2><ol class="list-node" id="jg10nqvve"><li>Standardized Gold ValuationLenders must use a transparent and uniform method for valuing pledged gold, with valuation done by certified personnel and subject to periodic audits.</li><li>Loan-to-Value (LTV) Cap and TenureThe draft reiterates the LTV cap of 75%, ensuring responsible lending. For bullet repayment loans (where the entire principal is repaid at maturity), the maximum tenure is proposed at 12 months.&nbsp;</li><li>Auction and Recovery NormsIn the event of a default, auctions must be conducted in a transparent manner, with adequate borrower notification. Any surplus amount post-auction must be refunded to the borrower.&nbsp;</li><li>Disclosure and DocumentationLenders must clearly disclose the terms, interest rates, processing fees, and auction terms to borrowers upfront. Loan sanction letters should include the weight, purity, and valuation of gold accepted.&nbsp;</li><li>KYC and Purity ChecksMandatory KYC compliance and enhanced due diligence for high-value loans. Purity checks must be documented and auditable.&nbsp;</li><li>Role of NBFCs and BanksThe guidelines apply uniformly across banks and NBFCs, with specific emphasis on curbing some of the lending practices followed by banks and gold-loan NBFCs.</li></ol><h2 class="heading-node" id="9q769ync5" style="text-align: justify">Impact on Borrowers and Lenders</h2>For Borrowers&nbsp;<ol class="list-node" id="gwaig6zsm"><li>Enhanced Transparency: Borrowers will benefit from clearer loan terms and standardized practices across lenders, ensuring consistent treatment.&nbsp;</li><li>End-use Monitoring: Lenders will verify the end-use of funds for income-generating loans and high-value consumption loans, preventing misuse.&nbsp;</li><li>Secure Collateral Handling: Collateral must be stored securely, and lenders face penalties for delays in returning collateral after repayment.&nbsp;</li><li>Prompt Collateral Return: Collateral must be returned within 7 working days after full repayment, with a ₹5,000/day penalty for delays.&nbsp;</li></ol>For Lenders&nbsp;<ol class="list-node" id="yuer044c1"><li>Enhanced Risk Management: Lenders must implement stricter risk management policies, including single-borrower and sectoral caps on gold loan portfolios. This includes monitoring the end-use of funds, especially for income-generating loans.&nbsp;</li><li>Standardized Gold Valuation: Lenders must establish uniform procedures for assessing the weight and purity of gold collateral, ensuring transparency and consistency across all branches.&nbsp;</li><li>Operational Adjustments: Lenders need to adapt their systems to manage LTV ratios in real-time, track multiple loans, and enforce auction protocols efficiently to avoid non-compliance penalties.</li><li>Financial Implications: Non-compliance could result in financial penalties, provisioning burdens, or reputational damage. The introduction of a uniform 75% LTV ratio may also impact NBFCs that previously used higher ratios, leading to stock price declines for some gold loan companies.</li></ol><h2 class="heading-node" id="07g847hhk" style="text-align: justify">How Finflux by M2P LMS Enables Effortless Compliance &amp; Lending Efficiency</h2><ol class="list-node" id="jh8hrcjxv"><li>Smart LTV Monitoring and Alerts: Finflux by M2P’s LMS is built to automatically calculate and monitor LTV ratios&nbsp;and customizable purity adjustment logic. Breach alerts and auto-flagging ensure lenders stay within RBI thresholds.</li><li>Automated Valuation Workflows: Gold purity inputs, market rate APIs, and gemstone exclusions are all baked into the valuation module, ensuring fair and compliant gold pricing for every loan.&nbsp;</li><li>Bullet Loan Controls: Finflux’s LMS allows lenders to configure product rules based on tenure, loan amount, and end-use. This makes it easy to ensure that bullet repayment loans are capped as per regulatory guidelines.&nbsp;</li><li>Borrower Due Diligence &amp; Documentation: Built-in KYC workflows, end-use declarations, and support for digital documentation allow lenders to maintain audit-ready records without the paperwork headache.&nbsp;</li><li>Renewal &amp; Top-Up Governance: The LMS mandates fresh appraisals, formal requests, and borrower eligibility checks before allowing renewals or top-ups, fully aligned with the latest RBI rules.&nbsp;</li><li>Unclaimed Collateral Tracking: Automated reminders and borrower/legal heir tagging ensure that no gold sits idle beyond two years without follow-up.&nbsp;</li><li>Granular Reporting &amp; Disclosures: Generate RBI-compliant reports covering loan books, LTV ratios, NPAs, and silver/gold collateral split, ensuring accurate disclosures and audit readiness.</li></ol><h2 class="heading-node" id="c9forklek" style="text-align: justify">Future-Ready Lending Begins with the Right Infrastructure</h2>As regulators push for greater accountability and transparency, lenders must embrace intelligent systems that can adapt to compliance, not just support lending.&nbsp; &nbsp; At Finflux by M2P, we’re building the tools that help lenders not just comply but grow responsibly. Whether you’re a bank, NBFC, or cooperative institution, our LMS is engineered to help you navigate the complexities of gold-backed lending with speed, clarity, and confidence.&nbsp; &nbsp; Want to see how Finflux by M2P can future proof your gold loan operations?<a class="link" href="https://m2pfintech.com/contact-us/?utm_source=lending_blog">Get in touch</a> with us today.<a class="link fui-Link ___1idfs5o f3rmtva f1ewtqcl fyind8e f1k6fduh f1w7gpdv fk6fouc fjoy568 figsok6 f1hu3pq6 f11qmguv f19f4twv f1tyq0we f1g0x7ka fhxju0i f1qch9an f1cnd47f fqv5qza f1vmzxwi f1o700av f13mvf36 f1cmlufx f9n3di6 f1ids18y f1tx3yz7 f1deo86v f1eh06m1 f1iescvh ftqa4ok f2hkw1w fhgqx19 f1olyrje f1p93eir f1h8hb77 f1x7u7e9 f10aw75t fsle3fq f17ae5zn" href="https://m2pfintech.com/newsletter/" target="_blank" rel="noreferrer noopener">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link fui-Link ___1idfs5o f3rmtva f1ewtqcl fyind8e f1k6fduh f1w7gpdv fk6fouc fjoy568 figsok6 f1hu3pq6 f11qmguv f19f4twv f1tyq0we f1g0x7ka fhxju0i f1qch9an f1cnd47f fqv5qza f1vmzxwi f1o700av f13mvf36 f1cmlufx f9n3di6 f1ids18y f1tx3yz7 f1deo86v f1eh06m1 f1iescvh ftqa4ok f2hkw1w fhgqx19 f1olyrje f1p93eir f1h8hb77 f1x7u7e9 f10aw75t fsle3fq f17ae5zn" href="https://www.linkedin.com/company/m2pfintech/mycompany/" target="_blank" rel="noreferrer noopener">LinkedIn</a>&nbsp;and&nbsp;<a class="link fui-Link ___1idfs5o f3rmtva f1ewtqcl fyind8e f1k6fduh f1w7gpdv fk6fouc fjoy568 figsok6 f1hu3pq6 f11qmguv f19f4twv f1tyq0we f1g0x7ka fhxju0i f1qch9an f1cnd47f fqv5qza f1vmzxwi f1o700av f13mvf36 f1cmlufx f9n3di6 f1ids18y f1tx3yz7 f1deo86v f1eh06m1 f1iescvh ftqa4ok f2hkw1w fhgqx19 f1olyrje f1p93eir f1h8hb77 f1x7u7e9 f10aw75t fsle3fq f17ae5zn" href="https://twitter.com/m2pfintech" target="_blank" rel="noreferrer noopener">Twitter</a>&nbsp;for insightful fintech bytes curated for curious minds like you.

Navigating RBI’s 2025 Gold Loan Directives with our Comprehensive Loan Management System

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/01/EDO-suite-Banner-1.webp" alt="M2P Fintech" title="" width="100%" height="612">Does your organization collect or store Aadhaar numbers?&nbsp;&nbsp;Then you are at high risk.&nbsp;&nbsp;With identity thefts, data breaches, and cyber fraudsters on the rise, businesses are vulnerable to financial and reputational damage. While conducting <a class="link" href="https://m2pfintech.com/blog/know-your-customer-kyc-the-need-for-authentication/" target="_blank" rel="noopener">digital KYCs</a> that involve Aadhaar card verification, the risk of data exposure and misuse of customer/employee information by fraudulent entities is even greater. These privacy concerns and security breaches cost businesses billions in losses.&nbsp;Thus, it is imperative for organizations to follow strict security protocols for Aadhaar card verification. Complying with the Aadhaar masking mandates of regulators such as UIDAI, RBI, SEBI, and IRDAI, is vital to protect Aadhaar data.&nbsp;<h2 class="heading-node" id="ah6szvxl9" style="text-align: justify">What is Aadhaar Masking?</h2>Aadhaar masking is a critical security directive issued by the UIDAI and regulatory bodies to protect Aadhaar data and prevent identity fraud and data scams. According to this mandate, the first 8 digits of your Aadhaar card number must be replaced by asterisks and appear as “XXXX-XXXX”, while the last 4 digits shall remain as it is. Aadhaar card masking serves as an extra layer of protection to conceal and protect sensitive information.&nbsp;&nbsp;<h2 class="heading-node" id="wnfhl36ra" style="text-align: justify">How Aadhaar Masking Came into Prevalence?&nbsp;</h2>According to the <a class="link" href="https://uidai.gov.in/images/news/Judgement_26-Sep-2018.pdf" target="_blank" rel="noopener">Supreme Court of India’s judgment in 2018</a> on Aadhaar privacy concerns, “No entity, including a requesting entity, which is in possession of the Aadhaar number of an Aadhaar number holder, shall make public any database or record containing the Aadhaar numbers of individuals, unless the Aadhaar numbers have been redacted or blacked out through appropriate means, both in print and electronic form.”&nbsp;&nbsp;The UIDAI stipulated that no entity could save Aadhaar numbers in their database in any form (physical or virtual). However, the entity can and must mask the first 8 digits before storing any physical or virtual copy of the Aadhaar cards.&nbsp;Apart from the above regulators, the <a class="link" href="https://www.lifeinscouncil.org/component/cir_020_29.01.2019.PDF" target="_blank" rel="noopener">IRDAI,</a> <a class="link" href="https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=11566" target="_blank" rel="noopener">RBI,</a> <a class="link" href="https://www.sebi.gov.in/legal/circulars/apr-2020/clarification-on-know-your-client-kyc-process-and-use-of-technology-for-kyc_46565.html" target="_blank" rel="noopener">SEBI,</a> and The Ministry of Finance also came out with their mandates to cloak the Aadhaar numbers. &nbsp;<h2 class="heading-node" id="lmvf8p2ze" style="text-align: justify">Why Aadhaar Masking?&nbsp;</h2>Following the regulations and judgments, the regulated entities in India must use only masked Aadhaar numbers in their existing databases and can accept only masked Aadhaar cards going forward. This could be the only way to reduce identity theft while ensuring compliance and data safety.&nbsp;<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/01/EDO-suite-masking-1.webp" alt="M2P Fintech" title="" width="100%" height="612">Organizations that fail to mask Aadhaar cards will face severe consequences in the form of penalties, reputational damage, additional audits, imprisonment, and/or even complete shutdown. Hence, being agile and staying up to date with regulatory requirements is crucial.&nbsp;&nbsp;<h2 class="heading-node" id="jev9xd6hg" style="text-align: justify">How can Businesses Optimize and Automate Aadhaar Masking?&nbsp;</h2>Businesses today find it challenging to address the operational aspects of compliance and data handling. Masking large chunks of Aadhaar card data accurately requires immense manpower, time, and cost. There is also a huge dependency on humans and could be prone to errors.&nbsp;Using a robust Aadhaar masking tool is a great way to optimize the process and drive efficiencies.&nbsp;Our EDO Suite helps businesses automate the task of Aadhaar masking in no time while ensuring accuracy and zero errors.&nbsp;&nbsp;<h2 class="heading-node" id="lnv5j9vro" style="text-align: justify">What is EDO Suite?&nbsp;</h2>Powered by AI and ML, EDO Suite is an efficient Aadhaar masking tool that intelligently detects and masks Aadhaar data instantly. It enables your organization to be 100% compliant with UIDAI and RBI regulations without any hassles.&nbsp;&nbsp;EDO suite’s instant masking feature covers up the first 8 digits, revealing only the last 4 instantaneously. It is capable of analyzing and masking only valid Aadhaar numbers from a group of random numbers.&nbsp;To ensure over 98.3% accuracy, the EDO suite employs the Verhoeff algorithm.&nbsp; A checksum formula for error detection, the Verhoeff algorithm is used to eliminate errors in data entry and validate Aadhaar numbers.&nbsp;&nbsp;EDO can be deployed entirely in-house at a very low cost, with no intervention or reliance on third-party algorithms. Till date, we have processed more than 10 crore Aadhaar numbers in multiple formats.&nbsp;<h2 class="heading-node" id="nb1rdh0io" style="text-align: justify">Key Components of EDO&nbsp;</h2><img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/01/EDO-suite-masking-2-1.webp" alt="M2P Fintech" title="" width="100%" height="612">EDO Scan&nbsp;A smart tool that can scan the entire computer or server and mask all Aadhaar cards to provide detailed scan reports. This is primarily used for ‘Legacy Data Masking’.&nbsp;&nbsp;EDO Lens&nbsp;A camera SDK that can be integrated into any customer onboarding mobile solution and the Aadhaar number will be masked in real-time while capturing the document.&nbsp;EDO Connect&nbsp;Powerful APIs where an entity can send an Aadhaar image, and EDO Connect will return a masked Aadhaar.&nbsp;<h2 class="heading-node" id="tfbc1m9vh" style="text-align: justify">How Does EDO Work?&nbsp;</h2>EDO provides two primary services.&nbsp;<ul class="list-node" id="73uyxx4vs"><li>Legacy Data Masking&nbsp;&nbsp;</li><li>New Data Masking&nbsp;</li></ul>Legacy Data Masking&nbsp;Legacy data is consumer data that companies have already collected in the database since the issuance of the Aadhaar cards in 2010. EDO helps in masking those legacy data in a matter of seconds.<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/01/EDO-suite-masking-3.webp" alt="M2P Fintech" title="" width="100%" height="612">New Data Masking&nbsp;The new data is the real-time consumer data that is collected and added to the database. New Aadhaar data being added to the database can also be masked before storage.&nbsp;&nbsp;<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2023/01/EDO-suite-masking-4.webp" alt="M2P Fintech" title="" width="100%" height="612"><h2 class="heading-node" id="h237hl4pi" style="text-align: justify">Aadhaar Masking Made Quick, Simple, and Convenient</h2>EDO caters to a business’s Aadhaar masking needs with simple, transparent pricing, and best-in-class technology. It is well-suited for both on-premise and cloud model.&nbsp;&nbsp;Features and Benefits&nbsp;1. Supports multi-format masking &nbsp;<ul class="list-node" id="p5pg7p1v9"><li>First eight digits of the Aadhaar with a red strip and ‘XXXX-XXXX' in excel sheets&nbsp;</li><li>Multiple Aadhaar numbers on the same page/image&nbsp;</li><li>Aadhaar numbers in different formats/files&nbsp;&nbsp;&nbsp;</li><li>Only Aadhaar numbers in an image with a foreign object. For e.g., an Aadhaar card with a mouse/pen&nbsp;</li></ul>2. Won't mask non-Aadhaar numbers&nbsp;3. Seamless masking with multiple options<ul class="list-node" id="trs6hfopa"><li>Full Detection - Scans the entire system&nbsp;</li><li>Choose Folder – Scans only a specific folder&nbsp;&nbsp;&nbsp;&nbsp;</li></ul><ul class="list-node" id="469pjy9v3"><li>Instant Masking - Masks any single image&nbsp;</li><li>Auto Scan - Sets the time for automatic masking of the entire system or a specific folder&nbsp;</li></ul>4. Detects and masks the selected files in order to thoroughly analyze dupes, non-Aadhaar numbers, and formats&nbsp;5. The detection results are made available as downloadable reports&nbsp;6. Cancels non-Aadhaar data and provides date, scan IDs, time stamps, and status (canceled/completed)&nbsp;Ready to mask Aadhaar in an instant, the right way?&nbsp;&nbsp;Connect with our expert team at <a class="link" href="mailto:business@m2pfintech.com">business@m2pfintech.com</a>.&nbsp;We’ll be glad to reach out and get you the best-in-class Aadhaar masking solutions right away!&nbsp;<a class="link" href="https://m2pfintech.com/newsletter/" target="_blank" rel="noopener">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/" target="_blank" rel="noopener">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech" target="_blank" rel="noopener">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

Mask Aadhaar in an Instant, the Right Way

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/09/banner_1_1.webp" alt="M2P Fintech" title="" width="100%" height="253">Reserve Bank of India (RBI) released the latest Digital Lending (DL) guidelines on September 2nd, 2022. This notification confirmed the implementation of the recommendations specified in Annex-1 of the RBI press release**, published a few weeks ago.&nbsp;Before deep diving into these guidelines, let us understand the RBI’s role as a regulator in the Indian economy. &nbsp;<h2 class="heading-node" id="xttnnf4sw">Brief history of RBI</h2>A book by Dr. B. R. Ambedkar sparked the idea of setting up a central banking institution for India. Subsequently, on April 1, 1935, RBI started its operations based on the RBI act of 1934. The act provides the statutory basis for the functioning of the bank. Yet, RBI remained a private institution till it was nationalized in 1949. Since then, RBI has been regulating, moderating, and monitoring the financial aspects of the country’s fiscal and economic position.The primary functions of RBI include the following.<ul class="list-node" id="z3s3llbmp"><li>Monetary Authority – Implementing and monitoring monetary policies</li><li>Currency issuance – Producing, managing, issuing, and exchanging quality currency notes and coins</li><li>Regulator &amp; Financial administrator – License issuance, bank mergers, branch expansion, and liquidity of assets</li><li>Managing foreign exchange – Maintaining Rupee value outside India, managing Indian FOREX reserves, and helping foreign trade payments</li></ul>Other than these, RBI’s role also includes stabilizing India’s financial reserves. They work with players such as financial institutions, regulatory bodies, fintechs, and government agencies to ensure the smooth flow of financial services.&nbsp;To summarize, all private and public banks are monitored by RBI to build trust and safety among their users.&nbsp;In the last eight years, fintechs, online/mobile banking, and other technological advancements have modernized the financial ecosystem worldwide. Digital transformation in financial services is on a rapid growth spurt. And in recent years, digital lending has been a prominent topic in the industry with its share of pros and cons. &nbsp;<h2 class="heading-node" id="ti82051sp">So, what is digital lending?&nbsp;</h2><blockquote class="block-node" id="p26pelwhr">According to RBI reports, Digital Lending (DL) is “A remote and automated lending process, majorly using seamless digital technologies in customer acquisition, credit assessment, loan approval, disbursement, recovery, and associated customer service.”&nbsp;</blockquote>Now that the definition clearly states what constitutes digital lending, let's see who the players are and their roles in the DL realm.&nbsp;<h2 class="heading-node" id="dklhgur4h">Key players in the DL arena</h2><ul class="list-node" id="ibj6ivuxn"><li>Borrower- End customer who is the recipient of the loan amount.</li><li>Lenders- Traditional players include Non-Banking Financial Companies (NBFCs) and Banks. They can be further divided into:<ul class="list-node" id="vt0pd5crw"><li>Balance sheet lenders- Those who have a record of the loan in their books</li><li>Marketplace lenders- Those who connect borrowers and balance sheet lenders</li></ul></li><li>Lending Service Providers (LSPs)- They are the fintechs that carry out one or more of the lender’s activities like acquiring potential borrowers, disbursement, and collection among several others. LSPs could either be in or out of the regulatory purview of the financial regulator.&nbsp;</li><li>Fringe lenders: They are shadow and unlicensed lenders who do not come under the purview of any registered entity. Monitoring these lenders is difficult as they do not have a proper identity trail.&nbsp;</li></ul>The key players listed above contribute to the remarkable growth of the industry.&nbsp;<h2 class="heading-node" id="ir07p6kz3">Steady growth prospects</h2>The pandemic era witnessed phenomenal growth in online transactions. There was a significant rise in digital lending platforms and applications. As a result, applying for and borrowing money from a digital lender got simplified, thus giving rise to thousands of Digital Lending Applications (DLAs).&nbsp;Digital Lending (DL) recorded one of the highest growth in India, from $9bn in 2012 to around $110 bn in 2019. &nbsp;By 2023, the value of the digital lending industry is expected to reach $350 Bn dollars.&nbsp;<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/09/inner-image_1-copy-2.webp" alt="M2P Fintech" title="" width="100%" height="253">When we talk about DL, First Loss Default Guarantee (FLDG) is the term we hear quite often. It is one of the many triggers of RBI's DL regulation.Let's get a quick glimpse into what FLDG is.<h2 class="heading-node" id="e7ha4q7hp">What is FLDG?</h2>We'll start with a simple example. In trading communities, family businesses are carried on from one generation to the next. When entrepreneurs emerge in these situations, loans are given to them based on the family's credibility. The reason is that if they do not make a payment, the lender can recover it from the borrower’s family.Likewise, in the case of First Loss Default Guarantee (FLDG), whenever a borrower defaults, a third party (fintech, in this case) comes in to compensate the lender. This mechanism is FLDG.&nbsp;Here's how FLDG works.<ul class="list-node" id="9gs2tjgn2"><li>Typically, fintechs partner with financial institutions by proposing to widen their customer base by targeting a particular customer segment</li><li>They zero in on that niche and turn them into leads using different marketing strategies</li><li>NBFCs agree to take on these loans on their books with a threshold of guaranteed interest</li><li>This guaranteed interest will be backed by the FLDG arrangement between the lender (NBFC) and LSP (fintech)</li></ul>Few NBFCs were renting out their licenses through FLDG. This enabled LSPs to build a proxy portfolio which some industry experts claim to be a risk to the lending system.&nbsp;<h2 class="heading-node" id="111xwkfi9">Need for RBI Working Group</h2>While FLDG contributed to the industry's increasing volume, several unregulated entities came into the picture. They exploited customer data and resorted to illicit collection activities. Many borrowers faced serious trouble as they were unaware of the real nature of these entities. An alarming rise in customer complaints resulting from the actions of the unregulated entities placed digital lending on RBI’s radar.&nbsp;To address and streamline the same, RBI set up a Working Group (WG) to understand the risks and set up necessary controls in the DL industry.&nbsp;<h2 class="heading-node" id="fcp9tkbk8">What did the Working Group find out?</h2>On January 13, 2021, RBI set up a WG consisting of thirty-six stakeholders. The purpose was to study the DL industry and its activities in detail and to implement the right regulatory approach.The WG surveyed and studied the industry and presented a report (containing two annexures) to RBI on November 18, 2021.&nbsp;The report’s findings were based on the following pillars.<ul class="list-node" id="motjl864k"><li>Discussions with the stakeholders</li><li>Survey and data analysis</li><li>Review of extant regulatory / Supervisory framework and industry practices</li><li>Review of global practices and literature</li></ul>After considering the recommendations, RBI officially announced the implementation of the DL guidelines on September 2, 2022.<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/09/inner-image_1-copy.webp" alt="M2P Fintech" title="" id="f425sz7ha" width="100%" height="253"><h2 class="heading-node" id="6avlwzuzi">&nbsp;DL guidelines implemented</h2><h3 class="heading-node" id="9x0k6ukoy">Annexure – I</h3>The following recommendations were accepted by RBI for immediate implementation.<h3 class="heading-node" id="xwx0cvy12">Customer Protection</h3><ul class="list-node" id="tsdlck58x"><li>Loan disbursals and payments should be between the borrower’s bank account and the lenders without any third-party pool account involved</li></ul><ul class="list-node" id="r68myhycc"><li>Regulated Entities (REs) should directly pay the fees and charges to the Lending Service Providers (LSPs) instead of charging the borrower directly</li></ul><ul class="list-node" id="29mxi1vhz"><li>Before the execution of the loan contract, the borrower must be given a standard Key Fact Statement (KFS)</li></ul><ul class="list-node" id="23dbqwzho"><li>Contents of KFS – Annual Percentage Rate (APR), Recovery method, Grievance addressal, cooling-off/ look-up period&nbsp;</li></ul><ul class="list-node" id="avc3zqm4a"><li>Any change in credit limit must require the borrower’s explicit consent</li></ul><ul class="list-node" id="ty03qxa1h"><li>Borrowers must be given the option of exiting digital loans during the cooling-off period by paying the principal and the applicable APR without any penalty</li></ul><ul class="list-node" id="mciab4cid"><li>All borrower’s complaints should be resolved by a RE and LSPs engaged nodal grievance redressal officer</li></ul><ul class="list-node" id="hve36i3x7"><li>The borrower can escalate it to the RBI if the complaint is not resolved within 30 days</li></ul><h3 class="heading-node" id="dd7ts6i9g">Technology and Data</h3><ul class="list-node" id="h4tyt70ye"><li>Data collection should be done with the borrowers' explicit consent with audit trails &nbsp;</li><li>DLAs should collect only specific data of the borrowers pertaining to <a class="link" href="https://m2pfintech.com/blog/crack-the-kyc-jigsaw-ease-onboarding-compliance/">Know your Customer (KYC)</a> and onboarding</li><li>Borrowers must be provided with consent to accept, deny, or delete the data collected by the DLAs/LSPs</li></ul><h3 class="heading-node" id="6kpyid9pl">Legal and Regulatory</h3><ul class="list-node" id="27yjfnlrz"><li>Any lending sourced through DLAs (of the RE or the LSP employed by RE) must be disclosed to Credit Information Companies (CICs) by REs</li><li>If REs are using the FLDG model, they shall adhere to the provisions of the <a class="link" href="https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=12165">Master Direction – Reserve Bank of India (Securitisation of Standard Assets) Directions, 2021, dated September 24, 2021</a></li></ul><h2 class="heading-node" id="t9hkboftc">WG recommendations accepted in principle</h2><h3 class="heading-node" id="3r58jerkf">Annexure – II</h3>The following recommendations were accepted in principle but require further examination.&nbsp;<h3 class="heading-node" id="tga9u9bap">Customer Protection</h3><ul class="list-node" id="bwn63txc9"><li>Any time a RE or LSP looks at or asks for credit information from a CIC, the borrower will be notified by email or text message&nbsp;</li></ul><h3 class="heading-node" id="nn4390fg9">Technology and Data</h3><ul class="list-node" id="3xoi0979d"><li>Banks will keep an eye on accounts often used from a different or overseas IP address that doesn't match the account holder's KYC profile&nbsp;</li></ul><ul class="list-node" id="nd7vb0o1c"><li>Baseline technology standards to be laid down by RBI primarily include secure application logic and an auditable log for every user action</li><li>REs should ensure that the underwriting algorithms are well-researched and auditable enough to point out discrimination factors&nbsp;</li><li>Artificial Intelligence (AI) used by digital lenders should be ethical and focus on protecting customer interests, security, and privacy</li></ul><h3 class="heading-node" id="28bmw3gy5">Legal and Regulatory Framework</h3><ul class="list-node" id="oktvcvrxo"><li>A Self-Regulatory Organization (SRO) to be set up which will focus on framing a code of conduct for recovery and a model standardized LSP agreement for Balance Sheet Lenders</li></ul><ul class="list-node" id="age2sbmui"><li>While the recommendation concerning FLDG is still under examination, REs must ensure financial products involving third-party compensation for defaulters should comply with the Master Direction – Reserve Bank of India (Securitization of Standard Assets) Directions</li></ul><h2 class="heading-node" id="qu1um5gxv">Conclusion</h2>The latest guidelines emphasize the importance of protecting borrowers by curbing the misuse of digital lending apps. The REs are given time until November 30, 2022, to develop systems and processes that are compliant with the ruling.Undoubtedly, fintech-led digital lending will certainly undergo changes. The larger perspective is to protect the customers and the economy from unscrupulous practices and uphold the trust of the banking system.&nbsp;Reference**: <a class="link" href="https://rbidocs.rbi.org.in/rdocs/PublicationReport/Pdfs/DIGITALLENDINGF6A90CA76A9B4B3E84AA0EBD24B307F1.PDF">Annexure 1 of RBI press release</a>Want to know more about digital lending? Write to us at&nbsp;<a class="link au lg" href="mailto:business@m2pfintech.com" target="_blank" rel="noopener ugc nofollow">business@m2pfintech.com</a>.<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

RBI’s New Digital Lending Guidelines – Will it be a Game Changer?

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/Artboard-1-copy-8-7.webp" alt="M2P Fintech" title="" width="100%" height="253">The Reserve Bank of India (RBI) has promulgated new directives for credit and debit card issuance and conduct for 2022. The new guidelines are intended to protect the interests of retail customers. These norms are effective from July 1st, 2022.The directions on credit cards apply to all Scheduled Banks and all Non-Banking Financial Companies (NBFCs) operating in India. Yes, RBI has now opened a window for NBFCs to issue credit cards with prior approval from the regulator. Let us be clear here that the new regulations on credit cards do not apply to Payments Banks and State/District Central Cooperative Banks. On the other hand, the rules concerning debit cards apply to every bank operating in India.According to the new guidelines, commercial banks with a net worth of over Rs 100 crore can issue credit cards, either independently or by integrating with other card-issuing banks/NBFCs. Regional rural banks (RRBs) are now authorized to issue credit cards by partnering with their sponsor bank or other banks. Non-banking financial companies (NBFCs) can issue debit cards, credit cards, charge cards, or other similar products virtually or physically only after obtaining approval from the RBI.<h2 class="heading-node" id="0d03" style="text-align: justify">Key directives on credit cards</h2><ol class="list-node" id="3lsobeyqe"><li>RBI strictly prohibits banks from issuing unsolicited loans and cards or upgrading an existing loan/card without explicit consent from the customer/cardholder. Furthermore, upon nonadherence, banks or the card-issuers shall not only reverse charges but also pay a penalty of twice the value of the charges.</li><li>If the unsolicited cards are misused before reaching the customer, the card issuers shall be solely responsible for the losses incurred due to the misuse.</li><li>Written consent from the customer is required to issue or upgrade a credit card. Banks can accept digital consent if the customer cannot provide written consent; however, RBI must be notified.</li><li>When a cardholder raises a dispute on a transaction as ‘fraud,’ the card issuers must not charge on the transaction until the issue is settled.</li><li>Card issuers shall quote different Annualized Percentage Rates (APR) on credit cards for retail purchases, cash advances, balance transfers, and late payments or non-payment of the minimum amount due.</li><li>The card issuers should not impose any hidden charges while issuing credit cards. For example, EMI conversion with interest shall not be disguised as no-cost or zero-interest EMI.</li><li>For the closure of existing credit cards, the card issuers must honor the request within seven working days, subject to payment of all dues by the cardholder. If the issuer fails to complete the process within the given time frame, Rs.500/day penalty shall be imposed.</li><li>With respect to recovering debts, card issuers and their agents must not resort to intimidation or harassment. The lenders shall adhere to the fair practices code and avoid any verbal or physical harassment against any person, publicly humiliating and/or intruding upon the privacy of the customer’s family members and friends.</li><li>The card issuers shall limit the disclosure of customer information to the DSAs/DMAs/recovery agents. Card issuers must release only information that the agents require to discharge their duties and abstain from disclosing additional personal information. Also, the card issuers should ensure that customer information is not misused during credit card marketing.</li><li>Card issuers can report a credit card account as “past due” to CIBIL, CRIF, or others only if the amount remains unpaid for more than three days.</li></ol><h2 class="heading-node" id="e739" style="text-align: justify">Key directives on debit cards</h2><ol class="list-node" id="70pzbghi7"><li>Banks shall only issue debit cards to customers holding savings/current accounts. Issuance of debit cards to cash credit/loan account holders is prohibited.</li><li>Banks shall not force customers to avail the debit card. If a customer does not want a debit card, he/she cannot be denied other services from the bank. The debit card issuance should not be linked to the availment of other benefits from the bank.</li><li>Banks should develop a comprehensive debit card issuance policy and get approval from their boards and RBI. Subsequently, banks must roll out the debit cards per this policy.</li><li>Banks must provide options for disabling/blocking the form factor via internet/mobile banking, IVR, SMS, and/or other modes.</li><li>In place of plastic debit cards, Scheduled Commercial Banks can issue other form factors after obtaining explicit consent from the customer.</li></ol>In addition to the above regulations, RBI states, “It will not preclude the banks from linking the overdraft facility provided along with Pradhan Mantri Jan Dhan Yojana accounts with a debit card.”<h2 class="heading-node" id="b31d" style="text-align: justify">Directives for Co-branded cards</h2><ol class="list-node" id="9heafrx6i"><li>Co-branded debit/credit cards should indicate that they have been issued according to the co-branding arrangement.</li><li>A co-branding partner shall not market the card as its product. In addition, the card issuer’s name must be explicit on the cards.</li><li>The co-branding arrangement should be in accord with the card issuer’s board-approved policy.</li><li>Card issuers are accountable for the acts of the co-branding partner.</li></ol>For co-branding agreement between banks and NBFCs for credit cards, RBI states, “NBFCs, which desire to enter into a co-branding arrangement for issue of credit cards with a card-issuer, shall also be guided by the Guidelines on the issue of Co-Branded Credit Cards contained in the respective Master Directions applicable to NBFCs, as amended from time to time.”For more clarity on credit card and debit card issuance, write to us at&nbsp;<a class="link au mr" href="mailto:business@m2pfintech.com" target="_blank" rel="noopener ugc nofollow">business@m2pfintech.com</a>.<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

M2P Blog

Tag: "Rbi (5)"

Adapting to RBI’s New Mandate: How M2P’s RBA Platform Enables Intelligent Payment Authentication

Navigating RBI’s 2025 Gold Loan Directives with our Comprehensive Loan Management System

Mask Aadhaar in an Instant, the Right Way

RBI’s New Digital Lending Guidelines – Will it be a Game Changer?

RBI’s New Directives for Credit/Debit Card Issuance

Ready to Build the Future of Fintech?

Get Started