AEPS New Update: Aadhaar OTP Mandatory for Cash Withdrawals Above ₹5,000
The domestic financial inclusion ecosystem across India has witnessed astronomical velocity, heavily powered by the Aadhaar Enabled Payment System (AEPS). By providing marginalized and remote populations with cardless, branchless access to liquid funds using just an identification number and biometric markers, AEPS has turned localized man- and paper-intensive processes into dynamic financial corridors. However, as the ecosystem expanded, it faced complex cybersecurity challenges, particularly involving identity cloning, credential replay strategies, and advanced biometric spoofing.
To fix these structural loopholes, the National Payments Corporation of India (NPCI), working alongside UIDAI and the Reserve Bank of India (RBI), has issued a fresh regulatory directive.
According to this crucial AEPS new update, a dynamic Aadhaar-linked Mobile OTP verification is now mandatory for all cash withdrawal requests valued at over ₹5,000, with the ultimate nationwide implementation deadline fixed for July 15, 2026. This regulatory step shifts the terminal network from standard single-factor biometric access to a two-factor authentication (2FA) framework. For operators, merchant networks, electronic partners, and local banking agents, deploying this dual-layered mechanism efficiently before the July 15 timeline is paramount to ensuring zero business downtime.
The Core Technical Need Behind Step-Up Security
Historically, the unmatched convenience of AEPS stood on a single-step operational flow: entering a 12-digit Aadhaar number followed by an instantaneous live biological confirmation (fingerprint or iris check). Unfortunately, this simplified gateway became an active target for bad actors. Criminal rings leveraged cloned fingerprint castings made from industrial silicone or polymer gels, frequently generated from compromised public data or duplicate land record registries.
Additionally, model-resistant Aadhaar input + single biometric flow + transaction clearance post-July 15 now requires:
By introducing a time-sensitive, machine-generated Aadhaar OTP for transactions exceeding the ₹5,000 benchmark, the new security architecture acts as an automated firewall. Even if a consumer's fingerprint data is compromised, unauthorized entities cannot clear the central processing engine without access to the customer's actual SIM card. This step-up framework eliminates high-ticket synthetic risks, safeguarding rural consumer trust in digital banking channels.
Operational Parameters: Value Brackets and Timelines
The new policy establishes explicit monetary triggers that dynamically modify how backend banking infrastructure routes and evaluates individual transaction requests.
1. Transactions Valued Up to ₹5,000
For cash withdrawals falling within the ₹1 to ₹5,000 spectrum, the operational flow is unchanged. Field operators can continue transaction execution using regular primary biometric setups, whether running a certified fingerprint module or an integrated iris image capturing camera. No secondary OTP authentication is triggered, maintaining checkout speeds for low-ticket everyday cash distribution.
2. Transactions Valued Above ₹5,000
The moment an individual initiates a cash withdrawal from ₹5,001 up to the official national transaction limit of ₹10,000, the step-up fraud-control mechanism activates immediately. The portal pauses the financial request right after the biometric check and waits for a unique 6-digit cryptographic verification code. This code is pushed instantly by UIDAI to the user's registered mobile number. The financial transfer finalizes only after a mandatory rule across all national clearing rails starting July 15, 2026.
Mobile Linkage Requirement
Standard Encrypted Channel
Aadhaar-Linked Mobile OTP
Step-by-Step System Workflow Under the 2FA System
To prevent transactional timeouts and settlement declines at the retail point after the AEPS new update, all terminal operators must rigorously comply with the updated sequence:
1. Initiation & Data Entry
The retail merchant opens the AEPS application dashboard, types the customer's 12-digit identification code, selects the issuing bank name, and inputs the targeted withdrawal amount exceeding ₹5,000.
2. Primary Biometric Verification
The consumer authenticates their identity by placing their finger on an approved L1 biometric scanner or aligning their vision with an authorized IRIS imaging device.
3. Automated OTP Dispatch
As the transaction amount crosses the ₹5,000 threshold, the NPCI routing engine communicates with UIDAI servers to trigger a real-time, encrypted OTP SMS to the registered mobile subscriber identity profile tied to that Aadhaar token.
4. Verification & Instant Settlement
The interface opens a secure token field. The merchant obtains the OTP securely from the customer, enters it, and clicks verify. Once validated by the central banking server, the customer's primary account is debited, and funds hit the retailer's digital wallet instantly.
Hardware Enhancements: Adopting L1 Devices and IRIS Capture Models
The roll-out of this security update coincides with a wider, mandatory hardware upgrade across India's financial grid. Legacy L0 biometric peripherals have been entirely phased out to make room for L1 Registered Devices featuring onboard cryptographic microchips (such as the Mantra MFS100 or Morpho CSD600 L1). These advanced models sign and encrypt biometric information directly at the point of physical contact, neutralizing data-in-transit interception or replay attacks.
Simultaneously, the industry is accelerating its transition toward advanced IRIS scanner technology to business correspondent points.
The structured advantages of this infrastructure include:
A massive block of rural manual workers and senior citizens experience high False Rejection Rates (FRR) because their fingerprints have faded or altered over time due to labor or age.
IRIS recognition offers a zero-contact, exceptionally accurate alternative that remains unaffected by physical wear.
Deploying dual-capability hardware configurations (L1 fingerprint + IRIS reader) gives retailers a distinct edge, keeping transaction success rates high after the July 15 deadline.
Real-Time Tracking of Split-Transaction Fraud
To stop merchants or operators from bypassing the new OTP step by splitting large ticket withdrawals into multiple sub-₹5,000 requests (e.g., executing two separate transactions of ₹4,000 to settle an ₹8,000 withdrawal request), NPCI and acquiring financial networks have rolled out automated fraud detection engines.
The central system's neural network tracks transaction velocity patterns continuously. If multiple consecutive sub-threshold withdrawals hit the same bank account or emerging from the same retail point within a short timeframe, the platform flags the pattern as an anomaly and declines the transactions automatically. Continuous attempts to split balances can result in an unexpected, permanent suspension of the merchant's terminal license. Best practice dictates executing clean, single higher-value transactions wrapped in the compliant OTP process.
Actionable Strategy Guide for Field Retailers
With the July 15, 2026 enforcement deadline fast approaching, financial merchants can continue serving customers without interruption by ensuring their devices and processes are fully compliant with the new AEPS security requirements.
Pre-Screen Customer Mobile Connectivity: Before initiating any payout over ₹5,000, ask the customer if their Aadhaar-linked mobile number SIM card is active and currently receiving signal inside your shop.
Encourage Aadhaar Information Maintenance: If a customer encounters a transaction failure due to an unlinked phone number, direct them to an authorized Aadhaar center to link their mobile immediately, ensuring no retail payment-volume business downtime.
Establish Dual-Hardware Readiness: Protect your retail point from fingerprint recognition issues by introducing a high-performance IRIS scanning option alongside your L1 hardware.
Educate the Local Community: Place clear, transparent informational banners inside your shop to let consumers know that the new OTP step is a mandatory national security policy designed to keep their money safe, rather than an arbitrary store delay.
Comprehensive Frequently Asked Questions (FAQs)
Q1: What exactly is the new update regarding the AEPS cash withdrawal limit?
The latest AEPS update does not change the maximum cash withdrawal cap (which stands at ₹10,000 per transaction based on the bank's rules). Instead, it introduces a safety rule: any transaction over ₹5,000 now requires a mandatory Aadhaar OTP alongside standard biometrics to be successfully completed.
Q2: What happens if a customer's mobile number is not linked to their Aadhaar card?
If a customer attempts a cash withdrawal exceeding ₹5,000 and their mobile number is not registered with UIDAI, the transaction will be systematically declined by the gateway. For transactions above this threshold, an official link is mandatory. The customer can still withdraw amounts up to ₹5,000 using only their fingerprint or IRIS scan.
Q3: When is the final deadline to implement this OTP rule across all merchant systems?
The absolute enforcement date set by the regulatory authorities is July 15, 2026. After this date, no banking system in India will permit single-factor biometric withdrawals for amounts greater than ₹5,000.
Q4: Can an IRIS scan replace the mandatory Aadhaar OTP requirement for higher transactions?
No. An IRIS scan serves as a primary biometric authentication layer, just like a fingerprint scanner. Transactions exceeding ₹5,000, the Aadhaar-linked mobile OTP is an unavoidable second-factor security requirement, meaning it must be entered regardless of whether a fingerprint or an IRIS scan was used.
Q5: Will splitting a ₹9,000 transaction into two separate transactions of ₹4,500 help avoid the OTP step?
No. The NPCI's AI-driven fraud monitoring tools actively flag and block multiple sub-₹5,000 transactions performed on the same bank account within a short time window. Attempting split transactions can trigger compliance reviews and lead to the permanent termination of the merchant's AEPS terminal ID.
Q6: Does this new update apply to small withdrawals under ₹5,000 as well?
No. For any cash withdrawal amount from ₹1 up to ₹5,000, the conventional single-factor authentication process remains fully active. Retailers can process these transactions quickly using just a fingerprint or IRIS scan without triggering a mobile OTP.
Conclusion: Securing the Digital Financial Grid
The introduction of the AEPS new update requiring mobile OTPs for withdrawals over ₹5,000 represents a crucial step forward in making rural digital transactions highly secure. While it adds a quick step to high-value cash withdrawals, the protection it offers against biometric spoofing and fraudulent behavior is invaluable.
With the rollout taking effect on July 15, 2026, upgrading your retail infrastructure to L1 specifications, adopting contactless IRIS readers, and respecting the strict anti-splitting mandates will ensure that merchants can continue serving their business operations, maintaining regulatory compliance, and continue to serve as the most trusted financial hubs in their communities.
To witness a practical, step-by-step presentation of how this new workflow functions on digital portals and the specific system settings required, you can review this AEPS regulatory update presentation video, which breaks down the entire process flow using real-world examples.
