26/09/2026
Your business payment process is only as secure as its weakest approval or authentication point.
With evolving RBI requirements around payment security, businesses should review whether their controls adequately protect digital transactions involving biometric or token-based two-factor authentication.
Key areas to examine:
• Payment authentication: Confirm that biometric and token-based 2FA is properly implemented, periodically reviewed and restricted to authorised devices and users.
• Authorised users: Remove access promptly when employees change roles or leave, and maintain an updated record of payment permissions.
• Maker-checker controls: Separate payment preparation from approval. High-value or sensitive transactions should require independent verification.
• Tokenisation: Review how payment credentials and tokens are issued, stored, rotated and revoked, particularly for recurring payments and connected banking platforms.
• Bank mandates: Reconcile approved signatories, transaction limits and operating instructions with the bank’s current records.
• Fraud alerts: Enable real-time alerts, define escalation procedures and investigate unusual beneficiaries, timings, amounts or payment patterns without delay.
• Audit trails: Preserve clear records of login activity, authentication events, payment creation, approval, modification and rejection for effective review and audit support.
Do not rely on assumptions or outdated procedures. Verify the latest applicable RBI notifications, your bank’s security requirements and the controls relevant to your business before making changes.
Arpit Gupta & Co., Chartered Accountants, helps businesses review financial controls, compliance processes and payment-risk frameworks with clarity and precision.
Visit https://caarpitgupta.com/ to seek professional guidance.