Apple Pay arrived in India on September 30, 12 yrs after its global debut. Headlines focused on Apple. But the real story is RBI. The door opened not with a commercial breakthrough but with a regulatory one.
For years, a card payment in India effectively meant an OTP. A wallet built on Face ID and Touch ID had no natural place in that framework. Today it does. And that shift deserves more attention than the launch itself. Now, customers can pay on iPhones, iPads and Apple Watches with a glance, touch or device passcode. No OTP.
OTP served India well. It gave card payments an extra layer of security when much of the world still relied on a signature. But it also became a gift to fraudsters. Every 'Your account will be blocked' SMS is an attempt to extract one thing: a 6-digit secret.
RBI's Payments Vision 2025 contemplated alternatives: behavioural biometrics, digital tokens, in-app notifications and risk-based checks. Then came the decisive step. Rather than replace one mandated tech with another, RBI chose to regulate the outcome, instead of prescribing the tool.
The 2024 draft framework on alternative authentication culminated in RBI's Authentication Mechanisms for Digital Payment Transactions Directions of September 2025, in force since April. They retain the requirement of 2-factor authentication, but widen the choice of factors available to issuers and users, including device-native biometrics. And they hold issuers answerable to the customer when they fall short.
That distinction is profound. Good regulation does not bet on which tech will prevail 5 yrs from now. It fixes the principles - security, consumer protection, accountability and interoperability - and lets innovation compete beneath them.
The evidence is already in. In October 2025, NPCI introduced on-device biometric authentication as an alternative to the UPI PIN. In June, more than 611 mn UPI transactions worth ₹25,416 cr were authorised by a fingerprint or a face. Apple Pay now carries that transition from UPI into cards.
This matters because India's payments challenge has changed. Scale is solved. The next frontier is to make payments frictionless, secure and invisible.
A frank assessment must also record what this launch does not do. Apple Pay in India does not yet support RuPay, or UPI - the rail that carries roughly 84% of India's digital payment volume. A premium wallet for credit-card holders on global networks is a beginning, not an arrival.
There is a deeper governance question, too. When authentication moves into the device, the device-maker becomes part of the security chain. That is largely welcome. Global platforms invest more in secure hardware than most banks ever could. But it also concentrates a critical function in a handful of private platforms.
RBI has rightly made the issuer answerable to the customer. It must now ensure that issuers can, in turn, hold their platform partners to the same standard. Outcome-based regulation works only when accountability flows all the way down the chain.
This philosophy should now extend beyond payments. India has built extraordinary DPI that includes Aadhaar, UPI, DigiLocker, Account Aggregator and ONDC. The next generation of reform must focus on how citizens actually experience it.
Three principles should serve as a guide:
Regulate outcomes, not technologies
Whether tomorrow's authentication relies on biometrics, passkeys, behavioural signals or something not yet invented should matter less than whether it meets defined standards of security, consent and accountability.
Design for 2-way interoperability
RBI's own Payments Vision prioritised the internationalisation of UPI and RuPay. India should export its digital rails and make it easy for global rails to operate securely here. Reciprocity should be the norm: global wallets on Indian terminals, and Indian rails inside global wallets.
Make inclusion synonymous with choice
Fingerprints wear with age and manual labour; not every citizen owns a phone with secure biometrics. Biometrics should complement, not compulsorily replace, PINs and OTPs. Good architecture offers several safe doors into the system, not one mandatory gate.
There is a larger economic point. Ease of payment now shapes commerce, tourism and investment. The more invisible the payments layer becomes, the more visible the economy built upon it.
India's first digital payments revolution was about access and scale. UPI proved that public digital infrastructure, built on openness and interoperability, could transform an economy. The second revolution will be about trust, choice and disappearing friction.
Apple Pay's arrival is, therefore, not merely the entry of another wallet. It shows what happens when regulation makes room for technology to evolve without compromising the consumer.
