Additional Factors of Authentication (AFA)

Driven by the need to enhance the security of digital transactions and to help protect customers’ interests, the Reserve Bank of India (RBI) has issued a framework for alternative authentication mechanisms.
The framework introduces Additional Factors of Authentication (AFA), which, according to 1Kosmos, brings a stronger, more secure authentication in play, such as biometric verification and multi-factor authentication (MFA). The broader objectives are aimed squarely at improving the customer experience, promoting digital banking, ensuring regulatory compliance, and balancing innovation with risk.
1Kosmos provides a ready, state-of-the-art capability to meet the RBI mandate with a privacy-by-design platform to strengthen authentication with verified identity, empower individuals to manage their own personal identifiable information, and provide them convenient, passwordless access to digital services.
1Kosmos functions as a universal authenticator for legacy apps and provides multi-factor authentication by default millions of times each day for workers, customers, and citizens at some of the largest organizations in the world.
Interestingly, RBI categorically mentions the need to move away from SMSbased one-time passwords (OTP) as a factor. While no specific mandate was given by the central regulator, SMS-based OTP became the primary Defacto and most adopted second factor for digital payments.
SMS-based authentication is not secure and has been deprecated since 2016 as per National Institute of Standards and Technology (NIST) since it is recognized to be vulnerable to attacks. To address these challenges and with advancements in technology, RBI produced recommendations to safeguard digital payments.
The RBI draft framework on alternative authentication mechanisms for digital payment transactions introduces several key requirements:
The 1Kosmos platform is well-positioned to address the Reserve Bank of India’s (RBI) draft framework on alternative authentication mechanisms for digital payment transactions. Below is a detailed summary.
This flexibility allows service providers and their users to choose the authentication method that best suits their needs, thereby increasing the adoption of digital payments while maintaining high security standards with minimal friction to the user experience.
The platform is attested for Authentication Assurance Level 1, 2, and 3 as per NIST 800-63 standards.
This allows 1Kosmos to enforce multiple factors of authentication via various authentication methods in a single platform.
It also leverages adaptive authentication to adjust the required factors based on risk signals, ensures secure transmission and storage of authentication data, and provides convenient user management and recovery options. This approach helps to protect against unauthorized access while maintaining a user-friendly experience.
1Kosmos customers are able to leverage this in multiple ways, for example, by this global banking customer.
Based on the risk assessment, 1Kosmos adapts the authentication process. For elevated risk / high value activities, it might require additional verification steps, such as biometric authentication, multi-factor authentication (MFA), or additional identity proofs. For low-risk activities, it may streamline the process with fewer steps.
As an example, a 1Kosmos banking customer leverages Liveness by having users blink their eyes and smile to authenticate digital payments, proving they are a real person.
India has recently enacted the Digital Personal Data Protection (DPDP) Act, which emphasizes the protection of personal data, ensuring data privacy, security, and minimizing data breaches. The 1Kosmos solution can significantly aid in compliance with this act by offering more secure and user-friendly ways to verify identity without traditional passwords, which are a common point of vulnerability. Specifically, the following benefits accrue on its implementation:
The 1Kosmos platform is well-equipped to address the RBI’s draft framework on alternative authentication mechanisms for digital payment transactions. By offering robust, dynamic, and diverse authentication methods, 1Kosmos enhances security while maintaining user convenience. The platform s risk-based approach, customer consent mechanisms, and real-time transaction alerts further align with the RBI’s requirements. Additionally, 1Kosmos commitment to compliance and standardization ensures that its solutions are secure, interoperable, and reliable, making it an ideal choice for issuers looking to meet the RBI’s guidelines.