The Reserve Bank of India (RBI) Governor Sanjay Malhotra announced the launch of the exclusive ‘bank.in’ Internet domain for Indian banks as part of its initiative to tackle the rising instances of fraud in digital payments.
This initiative aims to mitigate cybersecurity threats and malicious activities, such as phishing, while streamlining secure financial services and enhancing trust in digital banking and payment services.
The Institute for Development and Research in Banking Technology (IDRBT) will serve as the exclusive registrar, with actual registrations beginning in April 2025. Detailed guidelines for banks will be issued separately. Additionally, plans are underway to introduce an exclusive domain, ‘fin.in,’ for other non-bank entities in the financial sector, as stated by the RBI Governor.
To further bolster security, the RBI is mandating the implementation of Additional Factor of Authentication (AFA) in cross-border, card-not-present transactions, mirroring the current security measures for domestic digital payments.
The introduction of AFA for digital payments has significantly improved transaction safety, instilling confidence among customers in adopting digital payments. While this requirement is currently mandatory for domestic transactions, the RBI proposes extending AFA to international online transactions using cards issued in India. This will provide an additional security layer for transactions where the overseas merchant supports AFA. A draft circular will be issued shortly for stakeholder feedback, according to an RBI statement.
The RBI’s AFA guidelines necessitate an extra layer of authentication for most digital payments, aiming to enhance security. Issuers can adopt a risk-based approach to determine the appropriate AFA for each transaction, considering factors like transaction value, origination channel, and the risk profiles of the customer and beneficiary.
