India’s RBI Keeps UPI on 2FA and NRI Transfers Feel It

What the payment rule actually does

India’s RBI now requires two-factor authentication for domestic digital payments, including UPI, cards and wallets and the rule has been in force since April 1, 2026. Single OTP checks, frankly, don’t cut it anymore.

The setup needs two independent factors, with at least one dynamic one, so that could mean UPI PIN + OTP, biometric approval or a device token. Risk-based checks still exist, weirdly, so small routine payments on trusted devices may feel lighter, while new devices or bigger transfers can trigger stricter verification.

Who gets caught by it

This hits NRIs, expats and digital nomads using Indian payment apps, plus travelers using UPI One World after KYC. If you’re paying rent, sending money or just splitting bills in India, the extra step is now part of the flow and honestly, that’s the point.

It’s better for fraud control, but it can slow things down, especially for frequent transfers or high-value payments. Tourists aren’t blocked, though they still need proper KYC to access UPI-linked services and compliant apps are the real gatekeepers here, not a special exemption.

What to do before your next payment

Check that your bank or app supports the new 2FA flow, then make sure your NRE/NRO setup, passport details and linked number are all current. If you’re using UPI abroad or on the move, keep your app updated, because older versions can fail on the new checks.

For routine spend, expect a little more friction. For anything larger, expect more and plan for it.

Read our full India guide for the complete picture.