Tamra Patra
4notify India · The Copper-Plate Edicts
EDICT · RBI · NPCI · UPI · Banks
Tamra Patra
TP-IN-003
Date
2026-05-27
Status
In force
Category
Banking and payments

UPI, NPCI banking OTP and RBI two-factor authentication: delivery to SBI, HDFC, ICICI, Axis, Kotak and PNB customers

India runs the world's largest real-time payment network. The Unified Payments Interface (UPI), operated by the National Payments Corporation of India (NPCI), processes ~14 billion transactions a month across SBI, HDFC, ICICI, Axis, Kotak, PNB and 300+ other banks. RBI's two-factor authentication mandate makes the OTP the single most time-sensitive A2P SMS in the country. 4notify delivers banking OTPs with a sub-4-second P50 across Jio, Airtel, Vi and BSNL through tier-1 direct connections — and never via grey routes.

SMSPushEmail
Preamble

Whereas, by virtue of the powers vested by the Reserve Bank of India Act, 1934 and the Payment and Settlement Systems Act, 2007, and in furtherance of the RBI Master Directions on Digital Payments Security Controls, this edict is issued upon the delivery of authentication codes for the Unified Payments Interface and bank-channel two-factor authentication.

Statutory basis
Reserve Bank of India Act, 1934

Statutory foundation for the central bank and its supervisory mandate over banking.

Payment and Settlement Systems Act, 2007

Legal basis for NPCI, UPI and all retail payment systems in India.

RBI Master Directions on Digital Payments Security Controls

Mandatory two-factor authentication for digital payment channels at all scheduled commercial banks.

Implementation
01

Transactional category + bank Header ID

Banking OTPs run under the transactional Content Template category, with a bank-prefixed Header ID (e.g. VK-HDFCBK) that is exempt from DND and routed at TSP priority.

02

OTP generated in the bank HSM

The OTP is generated inside the bank's HSM; 4notify receives only the hash and the destination phone number — never the OTP in clear.

03

P50 ≤ 4 seconds + cascade

The OTP is delivered in under 4 seconds at P50. If the DLR fails, the cascade falls through to push, then to email — within the same 60-second authentication window.

04

Five-year audit custody

Every delivery is signed and retained for five years, in line with RBI Master Directions and the IT Act, 2000 audit trail requirements.

Delivery envelope
json
{
  "event": "bank.upi.otp",
  "bank_ifsc": "HDFC0000123",
  "txn_id": "UPI/20260527/948210",
  "amount": 12500.00,
  "currency": "INR",
  "delivery": {
    "channel": "sms",
    "fallback": ["push", "email"],
    "window_seconds": 60,
    "template_id": "1207168760000123456"
  },
  "audit_signature": "https://4notify.net/sig/in/bank/948210"
}
Sample message
SMS

VK-HDFCBK: OTP for INR 12,500 UPI debit from a/c XX8429 is 482193. Valid 5 min. Do NOT share this OTP with anyone, including HDFC Bank staff. -HDFC Bank

Compliance checklist
  • TRAI DLT Header registered under a transactional bank prefix
  • Tier-1 direct connections active on Jio, Airtel, Vi and BSNL
  • OTP P50 ≤ 4 seconds measured per quarter
  • Five-year RBI / IT Act audit custody in place
The 4notify difference

4notify is the only A2P provider with simultaneous tier-1 direct connections to Jio, Airtel, Vi and BSNL plus signed five-year audit custody for banking OTP delivery conforming to the RBI Master Directions on Digital Payments Security Controls.

Frequently asked questions
Does 4notify deliver direct to Indian banks or through an aggregator?

Tier-1 direct connections to Jio, Airtel, Vi and BSNL. We do not use grey-route aggregation for authentication traffic.

Are app push notifications a valid second factor under RBI rules?

Yes — an app-bound push is a recognised possession factor. But because app availability is not guaranteed in low-connectivity regions, we always combine push with SMS or email.

Issued
4notify Office of Operations
2026-05-27 · TP-IN-003

Start free

14 days, no card. English-language support on weekdays.

Other edicts in this edition