Two-factor authentication
Also written 2FA
The requirement that online mutual fund subscriptions and redemptions be authenticated by two factors, one of them an OTP sent to the email or phone registered with the AMC — signature does the job offline.
In plain language
A password proves that someone knows something. It does not prove that the someone is the unit holder. Two-factor authentication (2FA) adds a second, independent check — in mutual funds, a One-Time Password sent to the unit holder's email or phone number registered with the AMC.
SEBI requires it as part of the controls against third-party payments and fraudulent redemptions. For online transactions it is 2FA; for offline transactions the equivalent control is the signature method, where the RTA verifies the signature against the specimen on record.
The point of anchoring one factor to the registered contact details is that a fraudster who has stolen login credentials still cannot complete the transaction without also controlling the investor's registered phone or inbox.
How it works
The rules, from section 13.2 of the workbook:
| Transaction | Authentication |
|---|---|
| Online subscription or redemption | 2FA |
| Offline subscription or redemption | Signature method |
| Non-demat redemption | One factor must be an OTP to the registered email or phone |
| Demat redemption | Process laid down by the Depositories |
| SIP and other recurring transactions | 2FA only at registration of the recurring mandate |
The scope widened over time. 2FA was earlier required only for redemption. With effect from 1 April 2023 it is also required for subscription transactions.
The same device reappears in Chapter 15. Nomination forms, or opt-out declarations, submitted online may be validated through 2FA with an OTP as one factor — as an alternative to a digital signature certificate or Aadhaar-based e-Sign — instead of the wet signatures of all unit holders required on physical forms.
Because the OTP goes to registered details, changes to those details are guarded too. An email ID or mobile number can be registered in the folios of only one investor (PAN), and changing both email and mobile together requires a cooling period of 10 days between the two changes. A change of bank mandate received with or just before a redemption also triggers a 10-day cooling period.
A worked example
Illustrative numbers.
The SIP. Mrs Ghosh registers a Rs 10,000 monthly SIP for 24 months on an AMC's app. At registration she enters an OTP sent to her registered mobile. Over two years Rs 2,40,000 is debited in 24 instalments — and she is not asked for an OTP again, because for recurring transactions 2FA applies only at registration.
The lump sum. She separately buys Rs 1,00,000 of a debt scheme online. Since 1 April 2023 that subscription also needs 2FA, so she enters another OTP.
The attempted fraud. Someone obtains her app password and tries to redeem Rs 3,00,000. Her folio is non-demat, so one factor must be an OTP to her registered email or phone — which the fraudster does not have. Suppose he tries first to change her mobile number and email to his own: changing both together forces a 10-day gap between the two changes. And if he submits a new bank mandate along with a redemption, a 10-day cooling period applies before payout.
None of these controls is foolproof by itself. Together they mean that stealing a password is not enough: the attacker also needs the registered contact details, and changing them costs time.
Why NISM asks about it
Chapter 13 (Banking Operations in Mutual Funds) states the 2FA rule as point 9 of section 13.2, Third Party Verification and Payment to Valid Account, including the 1 April 2023 extension to subscriptions and the SIP registration rule. Chapter 15 (Non-Financial Transactions) uses 2FA for online nomination and opt-out forms, and sets the 10-day cooling periods for contact-detail and bank-mandate changes. Expect a question on which transactions need 2FA, what one factor must be, and what happens for recurring transactions.
Common exam traps
- Since 1 April 2023, subscriptions need 2FA too. Before that it applied only to redemptions.
- SIPs need 2FA once, at registration, not on every instalment.
- One factor for non-demat redemption must be an OTP to the email or phone registered with the AMC — not any phone the investor happens to use.
- Demat redemptions follow the depositories' authentication, not the AMC's OTP.
- Offline transactions use the signature method, not 2FA.
- For online nomination, 2FA is one of three accepted validations, alongside a digital signature certificate and Aadhaar-based e-Sign.
- Two different 10-day cooling periods: between changing email and mobile together, and on a bank mandate change received with or just before a redemption.
Where this is taught
Free preparation for NISM Series II-BRelated terms
- Folio numberThe unique account number a fund house allots to an investor, under which the registrar holds that investor's units across every scheme of the fund, along with the bank mandate, address and signature.
- NominationThe account holder's written direction naming who receives the securities on death — up to ten nominees for a demat account, with percentages that must total 100, mandatory for single holdings.
- Registrar and Transfer AgentThe SEBI-registered agency that keeps the investor records of a mutual fund — processing purchases and redemptions, updating folios and unit capital, and issuing account statements.
- Systematic Investment PlanA facility to invest a constant amount into a scheme at regular intervals, which buys more units when the NAV is low and fewer when it is high and so averages the cost of acquisition down.
- Third-party chequeA payment for a mutual fund investment drawn from a bank account of which the first holder is not an account holder — not acceptable, and the reason registrars run third-party verification on every subscription.
- Cyber Security RiskThe risk that an AIF's or its service providers' systems are breached, corrupted or disrupted — governed by SEBI's Cyber Security and Cyber Resilience Framework, which all AIFs had to comply with by 31 August 2025.
- Registered bank accountsThe bank accounts an investor links to a mutual fund folio for pay-outs — up to 5 for an individual and 10 for a non-individual — with one marked as the default for redemption proceeds.