The Reserve Bank of India (RBI) has implemented an additional compliance layer for Aadhaar-enabled Payment System (AePS) touchpoint operators to enhance transaction security and prevent misuse in biometric payment channels.

According to the Payment Systems Report for the half-year ending June 2025, the RBI has issued directions on due diligence for AePS Touchpoint Operators (ATOs) and the risk management instructions governing their activities. The new framework will take effect from January 1, 2026, and aims to tighten oversight of intermediaries facilitating biometric transactions significantly.

The report highlights that AePS has become a crucial channel for financial inclusion, allowing interoperable transactions at micro-ATM terminals via Business Correspondents using Aadhaar authentication.

According to the report, AePS fund transfer and BHIM Aadhaar Pay transactions together reached 108.03 lakh transactions worth ₹3,545.19 crore in the first half of 2025, reflecting strong usage in low-income and rural segments. However, the RBI highlights that the rapid expansion of AePS networks has created “gaps in operator due diligence and field-level verification,” necessitating a regulatory response to maintain system integrity.

The Payment Systems Report (June 2025) further states that the new rules for ATOs will introduce risk management guidelines covering the activities of AePS touchpoint operators. This suggests that entities operating under banks or third-party business correspondents will now be required to undergo stricter Know Your Customer (KYC) checks, keep detailed transaction records, and implement enhanced audit controls.

The report highlights that this is part of a wider regulatory tightening aimed at enhancing “safety, security, efficiency, and effectiveness of the payment ecosystem as well as protecting the interests of consumers.”

The RBI’s move, as documented in the Payment Systems Report (June 2025), marks a proactive step to protect the growing base of rural and semi-urban digital users from fraud and data misuse. By setting compliance deadlines well in advance, the central bank has provided AePS operators with time to adapt to the upgraded standards. The report concludes that these measures will come into effect from January 1, 2026.