Assertion: In the architecture of Unified Payments Interface (UPI), the concept of a Virtual Payment Address (VPA) eliminates the need for a customer to share sensitive banking details such as account numbers or IFSC codes during a peer-to-peer transaction. Reasoning: The UPI platform acts as a central switch managed by the National Payments Corporation of India (NPCI) that maps the VPA to the underlying bank account through a secure library, ensuring that the transaction is processed via an Instant Payment System backend while maintaining data privacy.

Consider the following statements regarding digital banking regulations and guidelines in India: Statement 1: Mobile banking applications in India operate under a multi-factor authentication mandate where the first factor is typically something the user knows (like an MPIN) and the second factor is something the user possesses (such as a device bound token). Statement 2: The Reserve Bank of India permits banks to offer mobile banking services only to those customers who have a registered mobile number and an active debit card, explicitly prohibiting it for basic savings bank deposit account holders. Statement 3: As per typical cybersecurity risk mitigation practices, banks implement a cooling period for new beneficiaries added through digital channels, during which cumulative fund transfers are restricted. Which of the following conclusions is accurate?