NPCI AePS Guidelines 2026: New Rules, Latest Updates & Changes

Are you looking for the latest AePS new rules in 2026, RBI AePS guidelines, NPCI AePS updates, or changes that may affect AePS retailers, banking agents, fintech businesses, and AEPS software providers? AePS rules and security requirements continue to evolve, so businesses should follow the latest official instructions instead of relying on outdated information.

One important development for 2026 is the implementation of stronger due-diligence and monitoring requirements for AePS Touchpoint Operators (ATOs) following RBI’s 2025 directions. These requirements focus on onboarding, verification, ongoing monitoring, and risk controls.

NPCI’s official AePS circular page also shows FY 2026–27 updates, including a circular introducing step-up authentication for certain cash-withdrawal and BHIM Aadhaar Pay transactions.

Recent updates to the Aadhaar Enabled Payment System (AePS), regulated by the Reserve Bank of India (RBI) and the National Payments Corporation of India (NPCI), enforce mandatory two-factor step-up OTP authentication for transactions over ₹5,000, strict full-KYC vetting for all touchpoint operators, and the discontinuation of face authentication for cash withdrawals. 

For AEPS retailers, distributors, banking agents, fintech companies, and AEPS software provider, these Aeps software development make it important to review onboarding processes, transaction controls, authentication, monitoring, reconciliation, and software workflows regularly.

AEPS India helps businesses with AEPS Software, Best AEPS API Integration, AEPS Portal, and AEPS Management Software solutions designed around their operational requirements. If you are planning to start, upgrade, or integrate an AEPS business platform, discuss your requirements with AEPS India and choose a solution that can be maintained and updated as applicable AEPS rules evolve.

In this guide, AEPS India explains the latest AePS new rules and changes in 2026, including RBI AePS guidelines, NPCI AePS rules, AePS retailer requirements, ATO due diligence, authentication changes, transaction security, compliance requirements, and the practical impact on AEPS business.

AEPS New Rules and Changes in 2026: What Has Changed?

The Aadhaar Enabled Payment System (AePS) has introduced major security rules and operational changes in 2026. Led by directives from the Reserve Bank of India and the National Payments Corporation of India, these updates add two-factor step-up authentication for large withdrawals and enforce strict background checks for last-mile operators to stop fraud. 

Mandatory OTP for High-Value Transactions

• Threshold limit: Cash withdrawals and BHIM Aadhaar Pay transactions above ₹5,000 now require a two-step verification process.
• Aadhaar OTP: Along with the standard fingerprint or Aeps biometric scan, an Aadhaar-registered mobile OTP is compulsory for amounts exceeding ₹5,000.
• Smaller amounts: Transactions of ₹5,000 or less continue to use biometric authentication alone. 

Stricter Rules for Touchpoint Operators (ATOs)

• Biometric Mandate: Certified Aeps fingerprint or Aeps iris scanners are now compulsory for cash-out services at agent touchpoints. Face auth remains valid only for non-cash requests like balance checks or mini statements. 
• Full KYC requirement: Acquiring banks must complete full Know Your Customer verification for every micro ATM operator, business correspondent, or agent before onboarding them. 
• No Face Auth for Cash Out: NPCI discontinued camera-based face authentication for cash withdrawals and BHIM Aadhaar Pay to prevent spoofing frauds. 
• One Agent, One Bank: Individual AePS operators can now link and register with only one acquiring bank, increasing accountability and reducing multi-bank misuse. 
• Re-verification of inactive agents: If an agent or operator remains inactive for three consecutive months, banks must completely re-verify their KYC before letting them process transactions again. 

Enhanced Risk Monitoring and Technology

• Real-Time Fraud Tracking: Banks must integrate advanced fraud monitoring systems (like EFRMS) to track suspicious transaction patterns and agent locations. 
• Risk-based limits: Financial institutions apply tailored transaction limits based on individual operator risk profiles rather than a flat system limit. 

Latest AEPS Guidelines in 2026

The latest Aadhaar Enabled Payment System (AePS) guidelines for 2026 feature a mandatory step-up OTP authentication for cash withdrawals exceeding ₹5,000 alongside stricter Reserve Bank of India (RBI) due diligence and KYC rules for all touchpoint operators to minimize financial fraud. 

Key Transaction and Security Updates

• Step-up OTP Authentication: Under NPCI Circular No. 2026-27/AePS/001/096, any cash withdrawal or BHIM Aadhaar Pay transaction above ₹5,000 requires an Aadhaar-registered mobile OTP in addition to the mandatory biometric scan. 
• Biometric Locking: Users can utilize the UIDAI Resident Portal or bank applications to lock or unlock their biometrics for AePS safety when not actively transacting. 

Operator and Bank Compliance Rules

• Mandatory Operator KYC: Acquiring banks must perform full individual-level KYC and background risk-profiling on all AePS Touchpoint Operators (ATOs) before activation. 
• Re-verification of Inactive Agents: If an AePS operator remains inactive for three consecutive months, banks must re-verify their KYC credentials before allowing fresh transaction processing. 
• One Operator Policy: Enforcement of strict frameworks to limit operators to designated acquiring structures, preventing unauthorized terminal swapping and rogue aggregators. 

Latest NPCI AEPS Circulars and Notifications in 2026

The key 2026 update for the Aadhaar Enabled Payment System (AePS) is NPCI Circular No. 2026-27/AePS/001/096 (issued June 12, 2026), which mandates two-factor step-up authentication via Aadhaar OTP for all cash withdrawals and BHIM Aadhaar Pay transactions exceeding ₹5,000, alongside standard biometric verification. 

Major 2026 AePS Circulars & Policy Directives

Step-up Authentication (Circular OC 096 / FY 26-27):

• Issued: June 12, 2026.
• Core Rule: Transactions up to ₹5,000 require only biometric verification. Transactions above ₹5,000 require mandatory biometric scan plus an Aadhaar OTP sent to the customer’s registered mobile number. 

UIDAI Aadhaar Status Notification APIs (Circular OC 095 / FY 25-26):

• Issued: April 17, 2026.
• Core Rule: Integrates real time Aeps API frameworks via Authentication Service Agencies (ASAs) to track changes in Aadhaar statuses (such as updates for deceased profiles) to plug systemic fraud vulnerabilities. 

Enhanced Touchpoint KYC Norms (Effective January 1, 2026):

• Context: Backed by RBI frameworks and enforced across NPCI acquiring networks.
• Core Rule: Strict merchant/Aeps agent onboarding requiring STQC-certified Level 1 Aeps biometric devices, continuous risk-profiling, and verifiable identity audit trails for all active business correspondents. 

Latest Aeps Trends News 2026

The Aadhaar Enabled Payment System (AePS) in 2026 is undergoing a major security and compliance overhaul driven by strict Reserve Bank of India (RBI) and National Payments Corporation of India (NPCI) mandates. Major updates include step-up OTP authentication for high-value transactions, mandatory L1 biometric devices, and tightened agent KYC rules. 

The market has recently undergone significant security changes to AePS regulations. Withdrawals over ₹5,000 now require an OTP (Option Transfer) to your Aadhaar-linked mobile number, and operators are being closely monitored to prevent fraud. 

Enhanced Security & Authentication Rules

• OTP for more than ₹5,000: Now, for cash withdrawal or Aadhaar Pay transaction of more than ₹5,000, an OTP will be sent to the customer’s Aadhaar-linked mobile number, which will be required to be entered. 
• Mandatory L1 Biometric Scanners: All operational hardware must use encrypted, STQC-certified L1 Aeps biometric devices to eliminate spoofing and fake fingerprint risks. 
• Strict monitoring of operators: Under the new guidelines of RBI and NPCI, the activities of merchants and touchpoint operators are being closely monitored to prevent fraud. 
• AI Fraud Analytics: Platforms are increasingly integrating artificial intelligence for real-time liveness detection and behavioral risk monitoring. 
• Action on inactive IDs: KYC process is being re-done for AEPS operators whose IDs have been closed or inactive for more than three months. 

Regulatory & Compliance Shifts

• Stricter Operator Guidelines: Acquiring banks enforce a rigid “One Operator, One Bank” framework alongside complete merchant and Business Correspondent (BC) due diligence. 
• Forced Re-KYC: Agents or operators inactive for a continuous period of three months must undergo a fresh Aeps KYC verification before their access is re-enabled. 
• Security Instructions: Do not share OTP with any other person or merchant. 

Rural Expansion & Service Evolution

• Assisted Micro-ATMs: Local retail stores continue to scale up as essential rural “mini-banks,” driving high transaction volumes past 3.5 billion annually. 
• Beyond Basic Cash Out: Outlets are shifting into comprehensive neighborhood financial hubs by adding embedded lending, micro-insurance, and digital gold services to traditional withdrawals. 

Important points for customers and shopkeepers

• Keep your mobile with you: Whenever customers go to withdraw money, they should keep their Aadhaar linked mobile with them. 
• Security Instructions: Do not share OTP with any other person or merchant. 
• Transaction Limit: Generally the limit per transaction is up to ₹10,000, but due to security and banks’ own regulations the process has become more strict now. 

RBI AePS Guidelines Effective From 1 January 2026

The Reserve Bank of India’s (RBI) major guidelines for the Aadhaar Enabled Payment System (AePS), which became effective on January 1, 2026 (via Circular No. CO.DPSS.POLC.No.S339/02-01-001/2025-2026), focus on strict due diligence for AePS Touchpoint Operators (ATOs) to prevent identity fraud and secure last-mile transactions. 

Stricter Onboarding and KYC for Operators

• Customer-Grade Due Diligence: Acquiring banks must run formal KYC checks on every micro ATM device or AePS operator (ATO/merchant/business correspondent) before Aeps onboarding them, treating them like individual bank customers rather than informal agents. 
• Re-verification Rules: If an operator remains inactive for three consecutive months, banks must completely re-verify their KYC credentials before allowing them to process transactions again. 

Risk Monitoring and Security Controls

• Active Transaction Tracking: Banks are required to monitor operator activities through live transaction systems, watching for abnormal transaction volumes, geographical mismatches, or suspicious patterns. 
• Enhanced Tech Safeguards: Implementation of robust audit trails, restricted Aeps API access meant strictly for AePS operations, and real-time fraud monitoring tools. 

System Integrity

• Accountability: By placing legal and operational accountability squarely on the acquiring banks to vet and audit their last-mile network managers and agents, the framework minimizes compromised credentials and fake biometric clones. 

AEPS Compliance Requirements for Businesses

To offer AePS services, businesses and Touchpoint Operators (ATOs) must complete strict KYC verification, use STQC-certified Aeps L1 biometric hardware, adhere to the National Payments Corporation of India (NPCI) transaction limits, and follow the latest RBI “One Operator, One Bank” security norms. 

Operator Eligibility & KYC Compliance

• Personal ID: Valid PAN card and Aadhaar card linked to an active mobile number.
• Age Requirement: Operator must be at least 18 years old.
• Business Proof: Shop & Establishment License, GST registration, or Udyam Registration Certificate.
• Rigorous Verification: Mandatory full KYC and periodic revalidation for agents, including re-KYC for accounts inactive for over three months.
• Operator Mapping: Strict compliance with the “One Operator, One Bank” rule to stop unauthorized multi-bank access. 

Hardware & Software Requirements

• Biometric Scanner: Mandatory STQC-certified L1 Aeps Registered Device (RD) fingerprint or iris scanner to prevent spoofing.
• Terminal Device: Android smartphone (version 7.0+) with USB OTG or a Windows PC with stable 4G/5G or Wi-Fi internet.
• Data Security: No local storage of sensitive user biometric data or full Aadhaar numbers on the merchant device; end-to-end encryption is required. 

Transaction & Operational Rules

• Transaction Caps: Maximum limit of ₹10,000 per transaction and standard daily ceilings (typically up to ₹50,000 based on the acquiring bank).
• Explicit Consent: Record clear user consent before initiating any biometric authentication.
• Audit Logs: Maintain comprehensive transaction logs and audit trails as mandated by NPCI and RBI frameworks. 

How Is Money Withdrawn Through AePS?

To withdraw money using AePS (Aadhaar card), visit your nearest Bank Mitra, Customer Service Center (CSC), or best micro ATM. Provide your Aadhaar number, bank name, and withdrawal amount to the shop owner. Verify your identity by placing your finger or face on the Aeps biometric machine (fingerprint or face scan), and you will receive your cash. 

The entire process of withdrawing money

• Visit a Bank Mitra or Centre: Visit any certified AePS operator, bank kiosk or public service centre near you. 
• Provide the necessary information: Tell the operator your 12-digit Aadhaar number, your bank name, and the amount of money . 
• Perform biometric authentication: Place your fingerprint on the machine or complete face authentication
• Receive Cash: Once the Aadhaar matching and transaction is successful, the money will be deducted from your account and the shopkeeper will give you the cash. 

New AePS KYC Rules for Retailers, BCs & Touchpoint Operators

AePS rules for retailers and banking agents (touchpoint operators) enforced by the RBI and NPCI mandate strict agent KYC, mandatory re-verification after 3 months of inactivity, use of certified L1 Aeps biometric hardware, zero biometric data storage, and compliance with single-bank affiliation limits. 

Eligibility and Registration Prerequisites

• Mandatory KYC Documents: Retailers must provide an active PAN card, Aadhaar card linked to a bank account, proof of business address (GST/Udyam/Utility bill), and a bank passbook or cancelled cheque for settlements. 
• Certified Hardware: Agents must use STQC-certified Level 1 L1 Aeps biometric fingerprint or L1 Aeps iris scanners that encrypt data at the device level. 
• Authorized Onboarding: Retailers must register strictly through authorized Aeps india. 

Operational and Compliance Rules

• Inactive Account Rule: If an agent terminal records zero transactions for a continuous period of three months, the acquiring bank must freeze the operator ID and execute a fresh KYC check before re-enabling best Aeps services. 
• One Operator, One Bank: Agents are restricted to operating under a single acquiring bank framework to streamline liability and audit tracing. 
• No Data Storage: Retailers are legally prohibited from storing customer biometric data, Aadhaar numbers, or transaction PINs on local computers, mobile phones, or Aeps app servers. 
• Liveness Detection: Systems utilized by touchpoints must support biometric liveness checks to block fake fingerprints or spoofing tools. 

Transaction and Risk Guidelines

• Transaction Limits: Standard cash withdrawals are typically capped at ₹10,000 per transaction (with overall daily aggregate caps determined by the Aeps india). 
• Continuous Monitoring: Acquiring banks must track retailer activity profiles in real-time to spot irregular transaction spikes, split transactions, or abnormal cash-out patterns indicative of fraud. 
• Interoperability: Agents are authorized to process transactions (cash withdrawal, balance inquiry, mini-statements, and Aadhaar-to-Aadhaar transfers) for customers across all NPCI-participating banks. 

What Is the Maximum Amount You Can Withdraw Through AEPS?

A maximum of ₹10,000can be withdrawn at a time through AePS . However, the total daily or monthly withdrawal limit may vary depending on security and bank regulations. 

Main transaction limits

• Per Transaction:Maximum ₹10,000 as per NPCI guidelines . 
• Daily Limit: Many banks allow a total transaction limit of₹25,000 to ₹50,000 in a day (depending on your bank’s policy). 
• Monthly Limit: For safety reasons, many banks also impose a limit on total monthly withdrawals. 

Things to keep in mind

• Some banks may restrict the per transaction limit to ₹2,000 to ₹5,000 due to their internal risk management policies.
• Contact your respective bank to know the exact and updated limit. 

AEPS Transaction Rules and Important Requirements

An Aadhaar Enabled Payment System (AePS) transaction allows users to perform basic banking operations such as cash withdrawals, balance inquiries, and mini statements using a 12-digit Aadhaar number and biometric authentication through a top micro ATM or banking correspondent, without needing a debit card, PIN, or signature. 

Essential Requirements for AePS

• Aadhaar Linking: Your 12-digit Aadhaar number must be actively linked to your bank account.
• Biometric Data: Valid fingerprint or iris scan data registered via UIDAI for real-time authentication.
• Primary Account Designation: If multiple accounts exist under one bank, only the designated primary/default account is accessed.
• Authorized Touchpoint: Access to an official micro ATM system, Point of Sale (PoS), or Business Correspondent (BC) agent. 

Core Transaction Rules

• No PIN or OTP: Financial transfers and cashouts do not require a secret PIN, password, or OTP; security relies strictly on biometric validation. 
• Interoperability: The system is fully interoperable across banks, meaning an account holder of any bank can transact at any bank’s certified AePS micro ATM. 
• Fund Transfer Restrictions: Aadhaar-to-Aadhaar fund transfers are restricted strictly to accounts that are individually linked to Aadhaar. 
• Daily Settlement Cut-off: The transaction cut-off time for daily settlements is 11:00 PM (IST). 

AEPS Security and Fraud Prevention Rules in 2026

The Reserve Bank of India (RBI) and the National Payments Corporation of India (NPCI) enforced stricter regulatory guidelines starting January 1, 2026, to combat rising biometric and identity fraud in the Aadhaar Enabled Payment System (AePS). These rules tighten due diligence for last-mile operators, mandate risk-based tracking, and introduce multi-factor authentication for high-value transactions. 

Operator Onboarding and KYC Rules

• Mandatory Full KYC: Acquiring banks must complete comprehensive Aeps KYC verification for all AePS Touchpoint Operators (ATOs) and Business Correspondents (BCs) before activation. 
• Re-Verification for Inactivity: Operators who remain inactive for three consecutive months must undergo a mandatory KYC re-verification before they can process transactions again. 
• One Operator, One Bank: Individual AePS operators are restricted to working with a single acquiring bank to establish clear accountability and prevent credential sharing. 

Transaction Security and Risk Control

• Two-Factor/OTP Verification: High-value or sensitive cash withdrawals exceeding ₹5,000 incorporate secondary verification layers like OTP confirmations alongside biometric scans. 
• Behavioral Risk Monitoring: Banks must run real-time fraud monitoring systems (such as EFRMS) to analyze transaction velocity, geographical location matching, and anomalous withdrawal volumes for both agents and user accounts. 
• Inactive Account Protection: Banks temporarily disable AePS channels for consumer accounts showing zero activity across extended periods (such as 12 months) until re-enabled by the account holder. 

Consumer Fraud Redressal

• Zero-Liability Window: Users must report unauthorized AePS transactions to their bank within 3 days to qualify for zero-liability protection under consumer guidelines. 
• Biometric Locking: Customers can utilize the UIDAI Official Portal or mobile banking apps to lock their biometric data dynamically when not performing active transactions. 

AEPS Biometric and Aadhaar Authentication Guidelines

The National Payments Corporation of India (NPCI) Aadhaar Enabled Payment System (AePS) allows customers to perform basic banking tasks like cash withdrawals and balance checks using their 12-digit Aadhaar number and a best Aeps biometric scan. Transactions require UIDAI-certified, L1-compliant biometric devices running active Registered Device (RD) services to ensure secure, encrypted, and cardless identity verification. 

Core Customer Requirements

• Aadhaar Seeding: Your bank account must be actively linked (seeded) to your Aadhaar number.
• Biometric Registration: Your fingerprints or iris scans must be properly registered in the Unique Identification Authority of India (UIDAI) database.
• Active Mobile Number: A valid mobile number must be connected to your bank account and Aadhaar to receive instant transaction alerts. 

Biometric Device Standards

• STQC Certification: All fingerprint and iris scanners must hold valid approval from the Standardisation Testing and Quality Certification Directorate. 
• L1 Compliance: Scanners must meet mandatory Level 1 (L1) security compliance featuring on-device encryption. 
• RD Service: Devices must use active Registered Device service software to encrypt biometric data at the point of capture, preventing the storage or exposure of raw biometric prints. 
• Liveness Detection: Modern terminals should use liveness detection algorithms to block fake or cloned fingerprint impressions. 

Step-by-Step Transaction Process

1. Visit a Touchpoint: Go to an authorized Aeps india provide Aeps Software.
2. Provide Details: Give your 12-digit Aadhaar number and name of your bank.
3. Select Service: Choose your transaction type (cash withdrawal, balance enquiry, or mini-statement).
4. Scan Biometric: Place your finger or scan your iris on the certified L1 device.
5. Real-Time Auth: The device encrypts the data block (PID) and sends it securely through the NPCI switch to UIDAI and your issuer bank for instant verification and settlement. 

AEPS Settlement and Reconciliation Rules

Aadhaar Enabled Payment System (AePS) settlement and reconciliation rules govern how funds move, clear, and match between merchants, business correspondents, acquiring banks, and the National Payments Corporation of India (NPCI). These rules ensure accurate fund transfers, handle failed transactions, and enforce strict risk management and due diligence. 

Settlement Rules

• Wallet to Bank Movement: Successful transaction funds first land in the agent or merchant’s AePS pool or virtual wallet, from which a payout/settlement is initiated to their registered bank account. 
• Timelines: Standard wallet credits happen on a T+0 or T+1 working day cycle. Manual or top Aeps API-driven payouts utilize IMPS (instant up to 30 minutes) or NEFT (2 to 24 hours) depending on the service provider configuration. 
• Eligibility: Only explicitly confirmed successful transactions qualify for payout settlement. Declined, dropped, or timeout transactions are blocked from settlement routines. 
• Failed Txn Refunds: Failed or broken transaction values auto-reverse back to the customer’s source bank account, typically within T+3 to T+7 working days post-confirmation from NPCI. 

Reconciliation Rules

• Data Matching: Aeps india must match core banking system (CBS) logs, switch transaction files, and the National Settlement Service (NTSL) reports provided by NPCI on a daily basis. 
• Key Matching Parameters: Automated matching engines validate entries using Retrieval Reference Numbers (RRN), transaction dates, customer account numbers, exact value amounts, and response codes. 
• Dispute and Adjustment Handling: Any mismatch between a customer debit and a merchant credit triggers a chargeback or dispute log via NPCI’s dispute management system for periodic ledger adjustments. 

Regulatory Compliance & Operator Norms

• One-Operator-One-Bank: AePS Touchpoint Operators (ATOs) are restricted to mapping with a single acquiring bank to establish accountability and trace operational risk. 
• Mandatory KYC & Inactivity Rule: Acquiring banks must conduct thorough initial and periodic KYC on all operators. If an operator remains inactive with zero transactions for three consecutive months, a fresh Aeps KYC check is mandatory before re-enabling the touchpoint. 
• Transaction Monitoring: Acquiring banks must continuously track unusual velocity, high-risk geographic anomalies, and transaction spikes to mitigate identity theft and credential compromise. 

2026 AePS Rules for Banks and Acquiring Banks

Effective January 1, 2026, the Reserve Bank of India (RBI) implemented strict rules under Notification No. RBI/2025-26/63 targeting acquiring banks. These rules mandate rigorous due diligence, mandatory KYC, and real-time fraud monitoring for all Aadhaar Enabled Payment System (AePS) Touchpoint Operators (ATOs) to prevent credential theft and last-mile financial fraud. 

Operator Onboarding & KYC

• Mandatory Due Diligence: Acquiring banks must perform complete Know Your Customer (KYC) checks on all local agents and micro-ATM operators before onboarding them. 
• Existing BC Exception: If an operator is already an approved Business Correspondent (BC), the bank can use that prior verified KYC record. 
• Re-validation Rule: Operators who remain inactive for three straight months must complete a fresh KYC verification before handling new transactions. 

Risk Management & Monitoring

• Real-Time Tracking: Acquiring banks must run active transaction monitoring systems to catch unusual patterns, high volumes, or suspicious regional spikes. 
• Risk Profiling: Banks must assign specific risk tiers to every operator and scale their oversight based on the local fraud risk. 
• API Security: System integrations and Application Programming Interfaces (APIs) must be locked down exclusively for legitimate AePS transaction processing. 

AEPS Rules for AEPS Software and API Providers

Aadhaar Enabled Payment System software and Aeps API provider like Aeps india must strictly follow National Payments Corporation of India (NPCI), Reserve Bank of India (RBI), and UIDAI regulations. Aeps india must enforce the “One Operator, One Bank” rule, use L1 certified registered biometric devices, perform agent KYC, and prohibit raw biometric data storage. 

Core Compliance & Operational Rules

Agent and Merchant Onboarding

• Mandatory KYC: Providers must complete strict KYC verification (PAN and Aadhaar) for every merchant, agent, or operator before activating AEPS features. 
• One Operator, One Bank Rule: An AEPS operator or retailer can link and process transactions through only a single acquiring bank to maintain strict financial accountability. 
• Inactivity Re-KYC: If an agent remains inactive for 3 consecutive months, the Aeps admin software must block access and force a mandatory re-KYC before reactivation. 

Data Security and Privacy

• Zero Data Storage: Trusted Aeps Software and Trusted Aeps API servers must never store raw biometric data (fingerprints/iris scans), Aadhaar numbers, or PIN blocks. 
• End-to-End Encryption: All biometric capture blocks must use secure encryption protocols (AES-256/RSA) transferred directly from the hardware. 
• Liveness Detection: Software must integrate biometric liveness detection tools to prevent spoofing, rubber fingerprints, and fraudulent authentications. 

Hardware and Integration Standards

• L1 Certified Registered Devices (RD): Aeps Software platform must exclusively support STQC-certified Level 1 (L1) biometric physical scanners with built-in encryption rather than obsolete legacy devices. 
• Secure Hosting: Aeps API infrastructure must operate via encrypted channels (HTTPS/TLS) with real-time connectivity to the official NPCI switch. 

Transaction Parameters

• Withdrawal Caps: Cash withdrawals are typically limited to a maximum of ₹10,000 per transaction, with an aggregate daily ceiling of ₹50,000 per customer profile subject to specific bank controls. 

What AEPS Software Businesses Need to Update in 2026

In 2026, AEPS software businesses must update their platforms to enforce strict RBI and NPCI regulatory mandates like the “One-Agent-One-Bank” linking, integrate STQC-certified L1 biometric registered devices, adopt AI-driven fraud detection, and expand top Aeps service offerings to include micro-loans and instant T+0 settlements. 

Regulatory and Compliance Updates

• One-Agent-One-Bank Rule: Restrict agent profiles to link with a single primary bank for settlements to comply with strict 2026 Reserve Bank of India (RBI) risk directives. 
• Mandatory Re-KYC: Automate periodic re-KYC workflows for inactive touchpoint operators (every 3 months) to prevent unauthorized usage. 
• L1 Biometric Compliance: Update device integration layers to exclusively accept STQC-certified L1 Aeps registered biometric fingerprint and iris scanners, phasing out older L0 insecure hardware. 

Security and Fraud Prevention

• AI Fraud Analytics: Implement machine learning models to detect real-time spoofing, abnormal transaction patterns, and biometric cloning. 
• Liveness Detection: Upgrade biometric capture components to check for live physical presence, reducing fake rubber-finger or iris-spoofing attempts. 
• End-to-End Encryption: Enhance data pipelines with advanced tokenization and multi-factor authentication (2FA) for admin and distributor panel access. 

Financial and Feature Expansion

• T+0 Instant Settlements: Build automated liquidity engines to process same-day merchant and agent payouts instantly rather than standard batch cycles. 
• Diversified Financial Services: Expand modern Aeps API stacks beyond basic balance checks and withdrawals to support embedded micro-insurance, micro-loans, and digital gold. 
• Multi-Modal Biometrics: Add support for facial recognition and iris scanning alongside fingerprint capture to improve transaction success rates for elderly or manual-labor users. 

AePS Fraud Prevention Rules in 2026

Effective January 1, 2026, the Reserve Bank of India (RBI) and National Payments Corporation of India (NPCI) implemented strict security frameworks for the Aadhaar Enabled Payment System (AePS). These rules target merchant touchpoint accountability, step-up authentication, and agent risk profiling to curb biometric cloning and identity fraud. 

Operator Due Diligence and KYC

• Mandatory Onboarding Checks: Acquiring banks must complete exhaustive Know Your Customer (KYC) verifications for all AePS Touchpoint Operators (ATOs) before activation. 
• Re-verification of Inactive Agents: Operators inactive for three consecutive months must undergo complete KYC re-validation before handling live transactions. 
• Risk Categorization: Banks must assign risk profiles (low, medium, high) to each touchpoint based on transaction volume and geographical parameters. 

Transaction Monitoring and Limits

• Step-Up Authentication: Cash withdrawals and BHIM Aadhaar Pay transactions exceeding ₹5,000 require an additional Aadhaar-based OTP verification alongside mandatory biometric scans. 
• Real-time Surveillance: Banks must deploy automated transaction monitoring systems to flag abnormal terminal behaviors, unexpected volume spikes, or multi-location fingerprint attempts from a single Aeps agent ID. 
• Aadhaar Data Guardrails: Application Programming Interfaces (APIs) linked with the ecosystem must be restricted exclusively to verified AePS processing. 

AEPS Compliance Checklist for 2026

The Aadhaar Enabled Payment System (AePS) compliance framework for 2026 incorporates stricter Reserve Bank of India (RBI) norms and National Payments Corporation of India (NPCI) guidelines. Key updates include mandatory step-up OTP authentication for cash withdrawals over ₹5,000, rigorous onboarding KYC for operators, and L1 Aeps biometric device requirements. 

Operator and Agent Onboarding (ATOs)

• Comprehensive KYC: Complete full Know Your Customer verification for all AePS Touchpoint Operators via the NPCI Portal guidelines and RBI Master Directions.
• Reactivation Protocol: Re-verify KYC for any operator inactive for 3 continuous months before allowing transaction access.
• Mandatory Documentation: Collect valid PAN cards, Aadhaar-linked mobile numbers, and business proof (GST/Shop Establishment license)

Transaction Security & Authentication

• Step-Up OTP Verification: Enforce mandatory Aadhaar-based OTP secondary authentication alongside fingerprint/iris scans for cash withdrawals exceeding ₹5,000.
• Hardware Compliance: Deploy exclusively STQC-certified, L1-compliant Aeps biometric scanning devices with encrypted data transmission rails.
• Data Privacy: Ensure zero local storage or logging of raw biometric templates or sensitive customer identity parameters. 

Risk Monitoring & Surveillance

• Real-Time Surveillance: Implement transaction monitoring systems to flag suspicious velocity, unusual geography, or abnormal volume spikes.
• Dynamic Limits: Configure risk-based operating transaction caps mapped to specific agent profiles and location risk metrics.
• Periodic Audits: Conduct scheduled internal and technical security audits across all New Aeps API integrate and Aeps merchant portal. 

General AePS Operational Compliance Checklist

What AEPS Changes Mean for Retailers, Distributors & Fintech Businesses

Recent regulatory shifts by the Reserve Bank of India (RBI) and the National Payments Corporation of India (NPCI) have transformed the Aadhaar Enabled Payment System (AePS). Key mandates include strict Know Your Customer (KYC) for touchpoint operators, Buy L1 Aeps biometric device compliance, the “One Operator, One Bank” rule, and stepped-up OTP/face authentication for higher-value transactions. 

What These Changes Mean for Retailers

• Stricter Compliance: Retailers must complete mandatory individual KYC and use STQC-certified Level 1 L1 Aeps biometric scanners to process payments. 
• Re-verification Rules: If a retailer remains inactive on the network for 3 consecutive months, their account is deactivated and requires a full re-KYC. 
• Operational Adjustments: Cash withdrawal or BHIM Aadhaar transactions above ₹5,000 now trigger secondary authentications like Aadhaar-based OTPs, slowing down high-value checkouts slightly. 
• Account Locking: Under the “One Operator, One Bank” directive, individual agents are restricted to working with a single acquiring bank, ending multi-bank switching from a single counter. 

What These Changes Mean for Distributors

• Network Cleansing: Distributors face the task of auditing active versus inactive agents. Ghost or dormant accounts must be purged or put through re-KYC. 
• Hardware Upgrades: Distributors must supply L1 Aeps biometric fingerprint or supply Aeps iris devices to their retail network, phasing out older legacy hardware. 
• Commission Realignment: With tighter operational monitoring, rogue practices or unauthorized extra convenience fees charged by local agents are heavily penalized, shifting focus strictly to official Aeps commission margins. 

What These Changes Mean for Fintech Businesses

• Robust Tech Stack Integration: Aeps india must embed AI-driven fraud analytics, real-time liveness detection, and instant multi-factor user verification. 
• Compliance Cost Increases: Engineering infrastructure to support single-bank routing, strict agent onboarding parameters, and enhanced API validation raises the cost of white label AEPS operations.
• Higher System Trust: Although compliance is tougher, these frameworks drastically cut down fraudulent clone-fingerprint exploits, securing long-term ecosystem reliability and higher transaction success rates for legitimate users.
  

Common AEPS Rule Mistakes Businesses Should Avoid

Businesses and merchant operators using the Aadhaar Enabled Payment System must strictly avoid skipping full Aeps KYC during Aeps agent onboard, utilizing unauthorized or unverified APIs, failing to monitor transactions for biometric spoofing, and neglecting proper record-keeping or grievance redressing protocols. 

Compliance and Onboarding Errors

• Skipping Full KYC: Onboarding Touch Point Operators (ATOs) or sub-merchants without complete KYC checks mandated by regulatory standards invites immediate suspension. 
• Inaction Re-evaluations: Failing to trigger mandatory re-KYC for agents or channels inactive for over three months. 
• Using Unapproved APIs: Integrating Aeps b2b software or unverified gateway pipelines that do not restrict data flows strictly to authorized National Payments Corporation of India functions. 

Operational and Security Risks

• Ignoring Biometric Spoofing: Over-relying on basic fingerprint scans without liveness detection checks, leaving terminals vulnerable to cloned silicone or rubber fingerprints. 
• Poor Transaction Logs: Failing to maintain precise, real-time transaction records (or physical/digital AEPS diaries), which complicates tracking failed settlements and customer disputes. 
• Slow Grievance Handling: Neglecting prompt escalation frameworks for money-debited-but-undisbursed failures, breaching Reserve Bank of India timelines and inviting penalties. 

How to Verify the Latest AEPS Rules From Official Sources

To verify the latest Aadhaar Enabled Payment System (AePS) rules, check official regulatory portals like the National Payments Corporation of India and the Reserve Bank of India, which publish direct notifications, Master Directions, and operational circulars regarding transaction limits and agent due diligence. 

Primary Official Portals

• NPCI Notifications: Visit the NPCI AePS Circulars page to read numbered operational guidelines (such as OC updates on step-up authentication or status notification low cost Aeps API). 
• RBI Regulations: Check the Reserve Bank of India Notifications section for regulatory frameworks, security updates, and merchant/operator due diligence rules. 
• Aadhaar Ecosystem Guidelines: Consult the Unique Identification Authority of India for biometric data standards and authentication Aeps API specification.

Key Verification Steps

• Review Circular Numbers: Cross-reference any claims or social media updates with exact circular alphanumeric codes issued by NPCI or RBI. 
• Check Bank Partner Advisories: Look at official notices from your acquiring Aeps india.
• Verify Compliance Dates: Ensure that operational rules (such as mandatory re-KYC for inactive touchpoint operators or single-bank mapping restrictions) match current regulatory enforcement timelines. 

AePS Rules 2026: RBI vs NPCI – Who Does What?

Under the 2026 AePS framework, the Reserve Bank of India (RBI) sets overarching macro-prudential regulations, legal mandates, and agent due-diligence standards, while the National Payments Corporation of India (NPCI) manages the operational switches, transaction switching, security protocols, and switch-level authentications. 

Regulatory Comparison: RBI vs. NPCI

Key Responsibilities At a Glance

RBI Focus:

• Enforces strict merchant/agent KYC guidelines.
• Mandates re-verification for operators inactive for 3 consecutive months.
• Directs continuous risk profiling of transaction nodes by acquiring banks. 

NPCI Focus:

• Operates the central payment switch routing transactions between acquirer and issuer banks.
• Implements runtime security tech like biometric locking features and L1 biometric device mandates.
• Defines operational limits (e.g., standard per-transaction thresholds). 

How AEPS India Helps Businesses Adapt to AEPS Changes

Aeps india is an AEPS provider helps businesses adapt to regulatory and technological changes by upgrading Aeps banking API for NPCI and UIDAI compliance, integrating AI-driven fraud detection, and enabling real-time error corrections for biometric failures. These solutions ensure high transaction success rates and continuous operations. 

Regulatory and Security Updates

• NPCI/UIDAI Compliance: Adheres instantly to updated safety, encryption, and data confidentiality norms.
• Biometric Security: Adds AI-based liveness detection and best-finger-detection routines to prevent fraud.
• Risk Management: Deploys real-time tracking dashboards to monitor agent activities and stay audit-ready. 

Technical and Operational Support

• AI Error Correction: Predicts and reduces biometric scanning failures before routing requests.
• High Uptime Infrastructure: Keeps secure Aeps API connection stable to prevent downtime during peak banking hours.
• Instant Settlements: Manages liquidity through real-time or same-day (T+0) settlement cycles. 

Business Growth and Scaling

• Multi-Service Integration: Bundles Micro ATM Software, Aadhaar Pay Software, and BBPS Software utilities alongside standard AEPS.
• Merchant Assistance: Provides automated Aeps onboard, KYC compliance tools, and merchant training Aeps portals. 

Conclusion: Stay Updated With the Latest AEPS Rules in 2026

The AEPS new rules and changes in 2026 are making security, due diligence, transaction controls, and compliance more important for banks, start AEPS businesses, touchpoint operators, retailers, and technology providers. RBI’s due-diligence framework for AePS Touchpoint Operators became effective from January 1, 2026, while NPCI continues to publish AEPS-specific circulars and notifications during FY 2026–27.

For any business using B2B AEPS Software, AEPS Payment API, B2B AEPS Portal, or B2B AEPS services, it is important to regularly check the latest RBI AEPS guidelines, NPCI AEPS circulars, applicable bank requirements, KYC/due-diligence requirements, authentication rules, transaction controls, and security updates instead of relying on old information. NPCI identifies AePS as a bank-led model that enables customers to access basic banking services through an AePS touchpoint.

The Reserve Bank of India (RBI) and National Payments Corporation of India (NPCI) introduced major security changes for the Aadhaar Enabled Payment System (AePS), including mandatory full KYC for touchpoint operators, restrictions on face authentication for cash withdrawals, and step-up OTP authentication for high-value transactions. 

AEPS India helps businesses with reputed AEPS Software, Reputed AEPS API Integration, Reputed AEPS Portal and AEPS business solution designed around their operational requirements. If you are planning to start, upgrade, or manage an AEPS business in 2026, choosing a Aeps solution that can adapt to applicable NPCI guidelines, RBI requirements, security updates, transaction monitoring, retailer management, and reporting needs is essential.

If you are planning to starting AEPS business, upgrade AEPS software, integrate AEPS Service API, or manage a growing retailer network, choosing technology that can adapt to applicable TOP AEPS requirements is equally important. AEPS India provides AEPS Software, Low Budget AEPS API and AEPS Portal solution to help businesses manage their digital AEPS operations through a centralized platform.

Stay informed, verify the latest official AEPS circulars, and keep your AEPS technology and business processes updated. If you need an AEPS Software Solution or AEPS API solution for your business, contact AEPS India to discuss your requirements and request a demo.

FAQs: AePS New Rules and Changes in 2026