RBI Draft Directions On AFA For Cross-Border CNP Transactions

Card Not Present (CNP) transactions occur where card details are provided without physically presenting the card at the point of sale, while offering convenience in the age of e-commerce, CNP transactions also present unique security challenges.
To safeguard such transactions, the Reserve Bank of India (RBI) has previously implemented security measures for domestic CNP transactions, through circulars issued in 2009[1] and 2011.[2]
Looking ahead, the RBI’s Payments Vision 2025 emphasizes the need for a similar level of security for cross-border card transactions. Thus, on February 7, 2025, the RBI released draft directions on Additional Factor of Authentication (AFA) for cross-border CNP transactions.[3] These draft directions aim to bolster the security of international online payments, reduce the incidence of fraud, and enhance trust in cross-border e-commerce.
Table of Contents
Key Provisions
The key provisions under the directions are as follows:

Impact Analysis
There are three key stakeholders at play once the directions are applicable. They are as follows:

This shift in security protocols is likely to have a positive impact on cross-border transactions. Strengthening payment security can help businesses expand their market presence while minimizing losses due to fraud. In turn, this would create a more stable and predictable business environment, fostering increased participation in international online commerce.
Conclusion
The proposed draft directions reinforce India’s dedication to securing international e-commerce transactions. They introduce mandatory AFA for non-recurring cross-border CNP transactions when requested by merchants or acquirers. Additionally, they require card issuers to register their BINs with card networks and implement risk-based mechanisms to manage such transactions effectively.
[1] https://www.rbi.org.in/scripts/FS_Notification.aspx?Id=4844&fn=9&Mode=0.
[2] https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=6657&Mode=0.
[3] https://www.rbi.org.in/scripts/bs_viewcontent.aspx?Id=4600.
King Stubb & Kasiva,
Advocates & Attorneys
New Delhi | Mumbai | Bangalore | Chennai | Hyderabad | Mangalore | Pune | Kochi
Tel: +91 11 41032969 | Email: info@ksandk.com
By entering the email address you agree to our Privacy Policy.