What changed
RBI issued a clarification on October 25, 2010, regarding the scope of the additional authentication mandate for card-not-present transactions. It confirmed that the mandate covers all transactions using Indian-issued cards on merchant sites where no foreign exchange outflow occurs, even if the payment gateway is overseas. Foreign-issued cards used on Indian merchant sites remain exempt from this requirement.
What it means for you
Banks must ensure that all online and IVR transactions using Indian-issued cards on domestic merchant sites include an additional authentication factor not visible on the card. Linking to an overseas payment gateway does not exempt these transactions. This strengthens security for domestic e-commerce while keeping cross-border card usage rules clear.
What you must do
- Verify that your systems enforce additional authentication for all Indian-issued card transactions on domestic merchant sites, regardless of payment gateway location.
- Update compliance procedures to exclude foreign-issued cards from this mandate when used on Indian merchant sites.
- Communicate the clarification to your merchant acquiring teams and payment gateway partners to avoid misinterpretation.
- Monitor transaction flows to ensure no relaxation is granted based solely on overseas gateway links.
Who it affects
All scheduled commercial banks including RRBs, Urban co-operative banks, State co-operative banks, District central co-operative banks, Authorised card payment networks
Does the additional authentication mandate apply to Indian cards used on foreign websites?
The mandate applies to Indian-issued cards used on merchant sites where no foreign exchange outflow is involved. For transactions on foreign websites involving forex outflow, the mandate is not addressed in this circular; banks should refer to other RBI guidelines.
Are foreign-issued cards used on Indian merchant sites exempt from this mandate?
Yes, the mandate is not applicable for cards issued outside India when used on Indian merchant sites, as per this clarification.
What is the effective date for IVR transactions under this mandate?
The mandate was extended to IVR transactions effective January 1, 2011, as per a previous RBI circular dated April 23, 2010.