RBI Enhances AePS Security with New Onboarding Directions

Mumbai, Jun 27 (PTI) The Reserve Bank on Friday issued directions to banks on onboarding Aadhar Enabled Payments System (AePS) touchpoint operators to enhance security.

The RBI has asked the acquiring bank to carry out due diligence of all ATOs before onboarding the AePS Touchpoint Operator (ATO), which is the same as the one followed while acquiring a customer, as per the directions.

If the due diligence of ATOs has already been done in their capacity as business correspondent/sub-agent, then the same may be adopted. Directions are applicable from January 1 next year.

In cases where an ATO has remained inactive for a continuous period of three months, the acquiring bank will have to carry out KYC of the ATO before enabling him or her to transact further, the RBI said.


"In recent times, there have been reports of frauds perpetuated through AePS due to identity theft or compromise of customer credentials. To protect bank customers from such frauds, and to maintain trust and confidence in the safety and security of the system, a need is felt to enhance the robustness of AePS," it added.

In a notification to banks, the RBI said the February 8, 2024, statement on developmental and regulatory policies had first made the announcement for such directions to curtail fraud.

The directions are issued under Section 18 read with Section 10(2) of the Payment and Settlement Systems (PSS) Act, 2007, it said.

The directions also have measures on risk management, including asking the acquiring bank to monitor the activities of ATOs through their transaction monitoring systems on an ongoing basis and set operational parameters based on the business risk profile of the ATOs.

The operational parameters regarding ATOs shall be reviewed on a periodic basis, reflecting emerging fraud trends, the apex bank said.