Additional Factor of Authentication (AFA) for cross-border Card Not Present (CNP) transactions – Draft Directions

## Report on Reserve Bank of India Draft Directions on Additional Factor of Authentication (AFA) for Cross-Border Card Not Present (CNP) Transactions **1. Executive Summary:** This report analyzes the Reserve Bank of India's (RBI) draft directions concerning Additional Factor of Authentication (AFA) for cross-border Card Not Present (CNP) transactions. The core purpose of this new policy, as inferred from the announcement, is to enhance the security of cross-border CNP transactions. The key provision mandates card issuers to validate AFA for non-recurring cross-border CNP transactions when requested by the overseas merchant or acquirer. This report details the policy's objectives, rationale, key provisions, target audience, implementation aspects, and expected outcomes based solely on the provided press release. **2. Introduction:** This report aims to provide an overview and analysis of the Reserve Bank of India's (RBI) draft directions on Additional Factor of Authentication (AFA) for cross-border Card Not Present (CNP) transactions, based on the press release dated February 7, 2025. **3. Policy Overview:** * This is a **New Policy**. * **Core Objective(s):** As inferred from the text, the core objective of this policy is to enhance the security of cross-border Card Not Present (CNP) transactions by mandating Additional Factor of Authentication (AFA) validation by card issuers. **4. Background and Rationale:** * Since this is a new policy, it addresses a potential vulnerability or perceived risk in the existing system. The policy likely aims to reduce fraud and enhance consumer confidence in cross-border CNP transactions. The absence of AFA requirements for some cross-border transactions could expose cardholders to increased risk of unauthorized transactions. This policy aims to mitigate that risk. **5. Key Provisions / Changes:** * The primary provision of this policy is that **card issuers are required to validate Additional Factor of Authentication (AFA) for non-recurring cross-border CNP transactions** whenever a request for AFA is raised by the overseas merchant or the overseas acquirer. * This establishes a new mandatory validation step by card issuers for a specific type of transaction. This is a requirement where potentially none existed before, increasing the security of CNP transactions. **6. Target Audience and Stakeholders:** Based on the text, the primary target audience and stakeholders directly affected by this policy are: * **Card Issuers:** They are responsible for implementing and validating the AFA. * **Overseas Merchants and Acquirers:** They are involved in requesting AFA for transactions. * **Cardholders (Consumers):** While not explicitly mentioned, they are indirectly affected as the intended beneficiaries of the increased security. **7. Implementation Aspects (Inferred):** * **Responsible Agency/Bodies:** The Reserve Bank of India (RBI), specifically the Department of Payment and Settlement Systems, is responsible for overseeing the implementation of these directions. The Chief General Manager-in-Charge of this department is the point of contact for feedback. * **Timelines/Procedures:** * The press release specifies a deadline of **March 10, 2025**, for submitting comments and feedback on the draft directions. This implies that the RBI is in the consultation phase and the final directions may be subject to change based on the feedback received. * The policy implies card issuers will need to establish systems for receiving and validating AFA requests from overseas merchants and acquirers. * The procedure requires the overseas merchant or acquirer to initiate a request for AFA. **8. Expected Outcomes / Impact of Changes:** The likely intended outcomes of this policy are: * **Increased Security:** AFA validation should reduce the incidence of fraudulent cross-border CNP transactions. * **Enhanced Consumer Confidence:** Increased security may lead to greater consumer confidence in using cards for cross-border online purchases. * **Reduced Fraud Losses:** Card issuers and merchants may experience reduced losses due to fraudulent transactions. **9. Conclusion:** The Reserve Bank of India's draft directions on AFA for cross-border CNP transactions represent a significant step toward enhancing the security of these transactions. By mandating AFA validation by card issuers, the policy aims to reduce fraud, build consumer confidence, and mitigate risks associated with cross-border online card payments. Stakeholders, particularly card issuers, should carefully review the draft directions and provide feedback to the RBI by the specified deadline to ensure a smooth and effective implementation of the final policy.

Key Entities Referenced