Why it matters
Payments are where precision and security matter most, and where much of the technology is not the bank’s choice. Networks and regulators set message formats, security rules and authentication requirements, and every participant must implement them exactly. Payment system architecture explains the model; this page covers the technology that implements it.
The landscape
| Technology | Role | Where it is used | Notes |
|---|---|---|---|
| ISO 8583 | Compact message format for card and ATM authorisations | Card networks, ATM switches, card processing | Each network adds its own field conventions |
| ISO 20022 | Rich, structured XML or JSON payment messages | High-value and cross-border payments worldwide | Carries more data about payer, payee and purpose |
| SFMS | Secure messaging for RTGS, NEFT and related systems | Banks connecting to RBI-run payment systems | Launched 2001; run by IFTAS |
| INFINET | The banking sector’s closed network | Connectivity for RBI-run payment systems | Launched 1999; run by IFTAS |
| UPI interfaces | Specifications, libraries and certification for UPI participants | Banks and apps joining UPI | Published and certified by the operator |
| Hardware security modules | Key storage, PIN verification and message signing | Card issuing, acquiring and payment switches | Payment HSMs are a specialised class |
| Tokenisation services | Replace card numbers with merchant-specific tokens | Online card payments and wallets | Required for stored cards |
| Interoperable QR codes | Carry payee details for scan-to-pay | Shops and merchants | One code accepted by many apps |
| 3-D Secure and additional authentication | Authenticate the cardholder for card-not-present payments | Online card payments | Now governed by the 2025 authentication Directions |
Families and standards, not recommendations. Network-specific details are in each operator's own documentation. Sources1Institute for Development and Research in Banking Technology. About IDRBT. As of 1 January 2025.2Reserve Bank of India. Chief Executive Officer (CEO) for Indian Financial Technology and Allied Services (IFTAS). As of 20 September 2022.
Message standards
ISO 8583ISO 8583. An international standard for card and similar transaction messages, used by card networks and ATM switches. is the long-standing format for card authorisations: compact, fast and built around numbered fields such as amount, merchant type and response code. ISO 20022ISO 20022. An international standard for richly structured financial messages, increasingly used for high-value and cross-border payments. is a richer standard with structured data about the parties and the purpose of a payment. That structure helps screening, reconciliation and fraud detection. Payment engineers spend much of their time translating between formats and validating every field.
Networks and messaging in India
Banks reach RBI-run payment systems over a dedicated network and messaging layer. IDRBT launched INFINET, a closed user group network for banks, in June 1999; it now runs on MPLS.1Institute for Development and Research in Banking Technology. About IDRBT. As of 1 January 2025. SFMS, a secure financial messaging platform, was launched on 14 December 2001 and is used by NEFT, RTGS and delivery-versus-payment settlement of government securities.1Institute for Development and Research in Banking Technology. About IDRBT. As of 1 January 2025. IFTAS is a wholly owned subsidiary of RBI, registered under the Companies Act, 2013; it runs INFINET, SFMS, the Indian Banking Community Cloud and GIFT.2Reserve Bank of India. Chief Executive Officer (CEO) for Indian Financial Technology and Allied Services (IFTAS). As of 20 September 2022.
Keys, PINs and HSMs
Payment security rests on keys. PINs are encrypted at the point of entry and verified inside hardware security modules, so no application ever sees a clear PIN. Keys are organised in hierarchies: a small number of master keys protect the keys that protect data. They are changed on schedules, and handling them needs several people present, so no one person can misuse them.
Tokens instead of card numbers
Since 1 October 2022, no entity in the card payment chain other than card issuers and card networks may store actual card data; merchants use tokens instead.3Reserve Bank of India. Restriction on Storage of Actual Card Data [i.e. Card-on-File (CoF)] (RBI/2022-2023/95). As of 28 July 2022. A token works only for the merchant or device it was issued for, so a breach at one merchant does not expose usable card numbers. Tokenisation services, run by card networks and issuers, create tokens, map them back to cards for authorisation and manage their lifecycle when cards expire or are replaced.
Authentication
RBI's Authentication Mechanisms for Digital Payment Transactions Directions, 2025, issued on 25 September 2025, require at least two factors of authentication for domestic digital payments, with compliance from 1 April 2026.4The Tribune. RBI unveils new directions to strengthen digital payment security. As of 25 September 2025. For digital payments other than card-present transactions, at least one authentication factor must be dynamic, that is, unique to the transaction.5KPMG in India. RBI Authentication Mechanisms for Digital Payment Transactions Directions, 2025. As of 1 December 2025. The 2025 authentication framework encourages new authentication factors but does not require banks to stop using SMS-based OTP.6Business Standard. RBI issues Directions on Framework on Authentication Mechanisms for Digital Payment Transactions. As of 25 September 2025. For cards used abroad online, Card issuers must be able to validate an additional authentication factor for non-recurring cross-border card-not-present transactions, when the overseas merchant asks, by 1 October 2026.4The Tribune. RBI unveils new directions to strengthen digital payment security. As of 25 September 2025.
In practice, banks are adding device-bound keys, biometrics and in-app approvals alongside OTPs. They are also using risk-based checks that ask for more when a payment looks unusual.
Scale and timing
Payment technology must work at national scale: UPIUnified Payments Interface. NPCI's real-time system for paying from a bank account with a UPI ID, QR code or phone number, through apps on a phone. alone averages 791 million a day7Business Standard. UPI sets new record at 24.51 bn transactions in Aug, value at ₹29.82 trn. As of 31 August 2026.. Every component in the path, such as message parsing, fraud scoring, HSMHardware security module. A tamper-resistant device that stores cryptographic keys and performs operations such as PIN verification. operations and the core posting, has a share of a tight time budget. A slow HSM or an overloaded fraud engine shows up to customers as failed payments.
How to choose
Most choices here are about implementation quality rather than technology selection: follow each network’s specification exactly, certify early, size HSMs and tokenisation services for peak rather than average load, and keep payment components separate from the rest of the estate to limit what falls under card-security rules.
Pitfalls
- Loose message validation, letting malformed fields through to downstream systems.
- HSM capacity sized for average load, failing on festival or salary days.
- Card numbers surviving in logs, test data or analytics copies.
- Authentication added as an afterthought, creating extra steps that customers abandon.
- Specification drift, when a network updates its rules and one component is not upgraded.
Questions for a design review
- Which message standards does this system parse, and how strictly is each field validated?
- Where are keys and PINs handled, and does any system see them in clear?
- Could a card number appear in any log, file or database outside the tokenisation service?
- Which authentication factors does each journey use, and which is dynamic?
- What is the time budget for each step in the payment path, and what happens when one is exceeded?