Central Bank proposes easing biometric requirements and revising P2P transfer rules

Under the draft, linked cards would instead be switched to inactive status. Users could reactivate them by entering an OTP code. The requirement to delete transaction history would also be removed.

Greater flexibility for customer notifications

The amendments would also give banks and payment organizations more discretion over fraud warnings.

If malicious software or signs of remote access to a customer's device are detected, institutions are currently required to notify users by SMS. The draft would allow notifications to be sent either via SMS or push notifications within a mobile application.

The proposal also changes the rules for warning messages displayed before financial transactions.

Current regulations require fraud warnings before every transaction, including account transfers, P2P transfers, and service payments. Under the new approach, banks and payment organizations would determine which transactions require such warnings based on their internal fraud risk management policies.

P2P transfer rules could become more flexible

The Central Bank is also proposing changes to authentication requirements for person-to-person (P2P) transfers.

At present, every P2P transfer must be confirmed using an OTP code, while such transfers via websites are prohibited.

Under the draft, banks and payment organizations would be allowed to determine, based on their fraud risk policies, the criteria for requiring OTP confirmation and the maximum transfer amount that may be processed without mandatory verification by an anti-fraud system.

The amendments would also permit the use of SMS-based anti-fraud verification codes or other authentication methods instead of OTPs. The prohibition on P2P transfers through websites would remain unchanged.

Stronger privacy protection for cardholders

The draft also proposes stricter masking of cardholder information.

Current rules display the cardholder's full first name and only the initial of the surname. For transfers made using the recipient's phone number, the recipient's details are only partially concealed.

Under the proposed amendments, both the first name and surname of the transfer recipient's cardholder would be partially masked.

TLS requirement updated

The draft would also revise technical cybersecurity requirements.

Instead of requiring financial institutions to use Transport Layer Security (TLS) version 1.3 or higher, the regulation would require the use of a supported version of the TLS protocol, removing the reference to a specific version number.