Master Direction on Regulation of Payment Aggregator (PA) - आरबीआई - Reserve Bank of India
Master Direction on Regulation of Payment Aggregator (PA)
RBI/DPSS/2025-26/141 September 15, 2025 All Payment System Providers and Payment System Participants / Madam / Dear Sir, Master Direction on Regulation of Payment Aggregator (PA) The Reserve Bank of India had issued the ‘Guidelines on Regulation of Payment Aggregators and Payment Gateways’ vide circular DPSS.CO.PD.No.1810/02.14.008/2019-20 dated March 17, 2020 and CO.DPSS.POLC.No.S33/02-14-008/2020-2021 dated March 31, 2021 for regulation of entities that were engaged in online payment aggregation. Further, vide circular CO.DPSS.POLC.No.S-786/02-14-008/2023-24 dated October 31, 2023, directions were issued on ‘Regulation of Payment Aggregator – Cross Border (PA - Cross Border)’. 2. Subsequently on April 16, 2024, Reserve Bank of India, placed on its website, for public comments, the following draft directions on regulation of PA:
3. On a review of the inputs received and in line with RBI’s endeavour to further rationalise the regulations, this comprehensive Master Direction is issued under Section 18 read with Section 10 (2) of the Payment and Settlement Systems Act, 2007, and Section 10 (4) and Section 11 (1) of the Foreign Exchange Management Act (FEMA), 1999 for regulation of various categories of PA. Yours faithfully, (Gunveer Singh) Encl.: As above Master Direction on Regulation of Payment Aggregators In exercise of the powers conferred by Section 18 read with Section 10(2) of the Payment and Settlement Systems Act, 2007 (51 of 2007), and Section 10 (4) and Section 11 (1) of the Foreign Exchange Management Act (FEMA), 1999 (42 of 1999), the Reserve Bank of India, being satisfied that it is necessary and expedient in the public interest so to do, hereby, issues the Directions hereinafter specified. 1. Short Title and Commencement a. These Directions shall be called the Reserve Bank of India (Regulation of Payment Aggregators) Directions, 2025. a. These Directions shall be effective immediately unless indicated otherwise for any specific provision herein. a. These Directions shall apply to all bank and non-bank entities undertaking the business of Payment Aggregator (PA) as defined herein. These Directions shall also apply to all Authorised Dealer banks as well as Scheduled Commercial Banks which engage with entities undertaking PA business, to the extent hereinafter specified. a. Cash-on-delivery transaction: A merchant transaction wherein banknotes or currency notes, being legal tender in India, is offered or tendered, for and at the time of, delivery of goods and / or service(s). b. Contact Point Verification (CPV): Physical verification of the address or place of business of the merchant. c. E-commerce: Buying and selling of goods and services, including digital products, conducted over digital and electronic network. Explanation: For the purposes of this definition, the term ‘digital & electronic network’ shall include network of computers, television channels and any other internet application used in automated manner such as web pages, extranets, mobiles, etc. d. Inward transaction: Transaction involving the inflow of foreign exchange. e. Marketplace: An e-commerce entity which provides an information technology platform on a digital or electronic network to facilitate transactions between buyer(s) and seller(s). f. Merchant: An entity or a marketplace that sells goods, provides services, or offers investment products, and includes exporters and overseas sellers. g. Outward transaction: Transaction involving the outflow of foreign exchange. h. Payment channel: The method or manner through which payment instruction is initiated and processed in a payment system. i. Payment Aggregator (PA): An entity that facilitates aggregation of payments made by customers to the merchants through one or more payment channels through the merchant’s interface (physical / virtual) for purchase of goods, services or investment products, and subsequently settles the collected funds to such merchants. PA is categorised as below:
j. Payment Gateway (PG): An entity that provides technology infrastructure to route and facilitate processing of a payment transaction without any involvement in handling of funds. k. Central KYC Records Registry (CKYCR), Officially Valid Document (OVD), equivalent e-document, digital KYC, and Video-based Customer Identification Procedure (V-CIP) shall have the same meanings as defined in RBI Master Direction DBR.AML.BC.No.81/14.01.001/2015-16 dated February 25, 2016 on ‘Master Direction - Know Your Customer (KYC) Direction, 2016’, as amended from time to time (hereinafter referred to as ‘MD on KYC’). Chapter II 5. Authorisation for PA Business a. A bank does not require authorisation to carry out PA business. b. A non- bank entity shall seek authorisation for operating as a PA by submitting an application through RBI’s online portal. An entity, regulated by any of the financial sector regulator(s), shall apply along with a ‘No Objection Certificate’ (NOC) from such regulator(s), within 45 days of obtaining the NOC. c. A non-bank PA shall be a company incorporated in India under the Companies Act, 2013. The Memorandum of Association of the applicant entity should cover the proposed activity of operating as a PA. d. Following is applicable from the date of these Directions:
e. Application of an entity, not meeting the minimum capital requirement, or which is incomplete / not in the prescribed form, shall be returned.
Chapter III a. A PA shall be professionally managed. The promoters and directors of the entity shall satisfy the fit and proper criteria as below: i. The person has a record of fairness and integrity, including but not limited to:
ii. Such person has not incurred any of the following disqualifications:
b. The promoters and directors of the applicant entity may submit a declaration in the enclosed format (Annexure 2.5). RBI may also check ‘fit and proper’ status of the applicant entity and management thereof by obtaining inputs from other regulators, government departments, etc., as deemed fit. As regards fulfilment of ‘fit and proper’ criteria, RBI’s decision shall be final. c. Any takeover or acquisition of control or change in the management of a non-bank PA shall adhere to RBI circular CO.DPSS.POLC.No.S-590/02-14-006/2022-23 dated July 4, 2022 on ‘Requirement for obtaining prior approval in case of takeover / acquisition of control of non-bank PSOs and sale / transfer of payment system activity of non-bank PSO’, as amended from time to time. This provision shall also apply to an entity whose application for authorisation as PA is pending with RBI. 8. Dispute Management Framework
9. Security, Fraud Prevention and Risk Management Framework
11. Specific Directions applicable to PA – CB
An authorised PA shall submit reports as listed in Annexure 2 of this MD. Chapter IV a. A PA shall undertake customer due diligence (CDD) of its merchants in accordance with MD on KYC. While onboarding, the PA shall, with the merchant’s consent, retrieve the merchant’s KYC record from CKYCR. The process defined in MD on KYC should be followed in case CKYCR record is found to be not updated. b. Where a merchant’s record is not available in CKYCR, or a PA cannot access CKYCR as its application for authorisation is pending with the Reserve Bank, CDD of the merchant could be carried out through other mechanisms outlined in MD on KYC. If the merchant’s annual turnover does not exceed ₹40 lakh, or its annual export turnover does not exceed ₹5 lakh, the following process could also be adopted as an alternative:
c. A PA shall undertake background and antecedent check of the merchant. d. In case a PA contracts with another PA that onboards the merchant, the latter is responsible for carrying out due diligence of the merchant. e. PA shall facilitate allotment of appropriate Merchant Category Code and Merchant ID / Terminal ID to its merchants including those onboarded through an overseas PA. PA shall ensure that name of the merchant is captured appropriately for all transactions processed for it. f. A PA shall ensure that a marketplace onboarded by it does not accept payments for a seller not onboarded on to the marketplace’s platform. g. Necessary validation mechanisms shall be put in place by a PA to ensure that funds due to a merchant are credited in the merchant’s bank account only. h. The PA must also monitor transactions subsequently undertaken by the merchants to ensure that these transactions are in line with latter’s business profile and ensure adherence to other aspects of MD on KYC while conducting its operations. i. Non-bank PA shall register itself with the Financial Intelligence Unit-India (FIU-IND) in compliance with MD on KYC and meet the reporting requirements listed therein. j. A PA, including an existing PA whose application is pending with Reserve Bank of India for authorisation, shall ensure that merchants onboarded till December 31, 2025, comply with the above due diligence requirements within one year from the date of this MD. From January 1, 2026, merchants should be onboarded in accordance with due diligence requirements prescribed in this MD. 14. Responsibilities of Acquiring Bank
15. Due Diligence through assisted mode a. A non-bank PA may utilise agents to undertake the following activities related to due diligence of merchants:
b. The non-bank PA shall carry out due diligence of the persons appointed as authorised / designated agents. c. The ultimate responsibility of due diligence shall lie on PA and agents can only be used for limited purposes as prescribed above. Chapter V a. A non-bank PA shall maintain the funds collected on behalf of its merchants in a separate escrow account with any Scheduled Commercial Bank (SCB) in India. In case of a PA – CB, such account shall also be referred to as Inward Collection Account (InCA) for inward transactions and Outward Collection Account (OCA) for outward transactions, as applicable. Details of operations in escrow accounts are incorporated in Table 1 below and the instructions mentioned therein must be adhered to by December 31, 2025. Such escrow accounts shall only be utilised for authorised PA business and not for any other business. b. For the purposes of maintenance of an escrow account, payment system operated by PA shall be deemed to be ‘designated payment systems’ under Section 23A of the Payment and Settlements Systems Act, 2007. 17. Core portion of escrow accounts
18. General directions on Escrow account of PA
19. The following circulars are hereby repealed except for an existing PA – CB which had applied for authorisation as PA – CB on or before April 30, 2024 and a decision thereon is pending with the Reserve Bank of India:
20. The circular DPSS.CO.PD.No.1102/02.14.08/2009-10 dated November 24, 2009 on ‘Directions for opening and operation of Accounts and settlement of payments for electronic payment transactions involving intermediaries’ is hereby repealed except only in relation to an existing PA – O which has sought authorisation and a decision thereon is pending with the Reserve Bank of India. 21. Save as provided herein, circulars listed in Annexure – 3 stands repealed with the issuance of this MD. 22. Notwithstanding such repeal as aforementioned, all authorisation / approvals granted, actions taken, and acknowledgements issued under the aforesaid circulars/ Directions shall continue to be valid and shall be deemed to have been granted under this MD. 23. The circulars, directions and guidelines so repealed shall be deemed to have been in force until the date of coming into effect of this MD. Baseline Technology-related Recommendations Indicative baseline technology-related recommendations for adoption by the PAs (mandatory) and PGs (recommended) are: 1. Security-related Recommendations The requirements for the entities in respect of IT systems and security are presented below: 1.1. Information Security Governance: The entities at a minimum shall carry out comprehensive security risk assessment of their people, IT, business process environment, etc., to identify risk exposures with remedial measures and residual risks. These can be an internal security audit or an annual security audit by an independent security auditor or a CERT-In empanelled auditor. Reports on risk assessment, security compliance posture, security audit reports and security incidents shall be presented to the Board. 1.2. Data Security Standards: Data security standards and best practices like PCI-DSS, PA-DSS, latest encryption standards, transport channel security, etc., shall be implemented. 1.3. Security Incident Reporting: The entities shall report security incidents / card holder data breaches to RBI within the stipulated timeframe to RBI. Monthly cyber security incident reports with root cause analysis and preventive actions undertaken shall be submitted to RBI. 1.4. Merchant Onboarding: The entities shall undertake comprehensive security assessment during merchant onboarding process to ensure these minimal baseline security controls are adhered to by the merchants. 1.5. Cyber Security Audit and Reports: The entities shall carry out and submit to the IT Committee quarterly internal and annual external audit reports; bi-annual Vulnerability Assessment / Penetration Test (VAPT) reports; PCI-DSS including Attestation of Compliance (AOC) and Report of Compliance (ROC) compliance report with observations noted if any including corrective / preventive actions planned with action closure date; inventory of applications which store or process or transmit customer sensitive data; PA-DSS compliance status of payment applications which stores or processes card holder data. 1.6. Information Security: Board approved information security policy shall be reviewed atleast annually. The policy shall consider aspects like: alignment with business objectives; the objectives, scope, ownership and responsibility for the policy; information security organisational structure; information security roles and responsibilities; maintenance of asset inventory and registers; data classification; authorisation; exceptions; knowledge and skill sets required; periodic training and continuous professional education; compliance review and penal measures for non-compliance of policies. 1.7. IT Governance: An IT policy shall be framed for regular management of IT functions and ensure that detailed documentation in terms of procedures and guidelines exists and are implemented. The strategic plan and policy shall be reviewed annually. The Board level IT Governance framework shall have- 1.7.1. Involvement of Board: The major role of the Board / Top Management shall involve approving information security policies, establishing necessary organisational processes / functions for information security and providing necessary resources. 1.7.2. IT Steering Committee: An IT Steering Committee shall be created with representations from various business functions as appropriate. The Committee shall assist the Executive Management in implementation of the IT strategy approved by the Board. It shall have well defined objectives and actions. 1.7.3. Enterprise Information Model: The entities shall establish and maintain an enterprise information model to enable applications development and decision-supporting activities, consistent with board approved IT strategy. The model shall facilitate optimal creation, use and sharing of information by a business, in a way that it maintains integrity, and is flexible, functional, timely, secure and resilient to failure. 1.7.4. Cyber Crisis Management Plan: The entities shall prepare a comprehensive Cyber Crisis Management Plan approved by the IT strategic committee and shall include components such as Detection, Containment, Response and Recovery. 1.8. Enterprise Data Dictionary: The entities shall maintain an “enterprise data dictionary” incorporating the organisation’s data syntax rules. This shall enable sharing of data across applications and systems, promote a common understanding of data across IT and business users and prevent creation of incompatible data elements. 1.9. Risk Assessment: The risk assessment shall, for each asset within its scope, identify the threat / vulnerability combinations and likelihood of impact on confidentiality, availability or integrity of that asset – from a business, compliance and / or contractual perspective. 1.10. Access to Application: There shall be documented standards / procedures for administering an application system, which are approved by the application owner and kept up-to-date. Access to the application shall be based on the principle of least privilege and “need to know” commensurate with the job responsibilities. 1.11. Competency of Staff: Requirements for trained resources with requisite skill sets for the IT function need to be understood and assessed appropriately with a periodic assessment of the training requirements for human resources. 1.12. Vendor Risk Management: The Service Level Agreements (SLAs) for technology support, including BCP-DR and data management shall categorically include clauses permitting regulatory access to these set-ups. 1.13. Maturity and Roadmap: The entities shall consider assessing their IT maturity level, based on well-known international standards, design an action plan and implement the plan to reach the target maturity level. 1.14. Cryptographic Requirement: The entities shall select encryption algorithms which are well established international standards and which have been subjected to rigorous scrutiny by an international community of cryptographers or approved by authoritative professional bodies, reputable security vendors or government agencies. 1.15. Forensic Readiness: All security events from the entities infrastructure including but not limited to application, servers, middleware, endpoint, network, authentication events, database, web services, cryptographic events and log files shall be collected, investigated and analysed for proactive identification of security alerts. 1.16. Data Sovereignty: The entities shall take preventive measures to ensure storing data in infrastructure that do not belong to external jurisdictions. Appropriate controls shall be considered to prevent unauthorised access to the data. 1.17. Data Security in Outsourcing: There shall be an outsourcing agreement providing ‘right to audit’ clause to enable the entities / their appointed agencies and regulators to conduct security audits. Alternatively, third parties shall submit annual independent security audit reports to the entities. 1.18. Payment Application Security: Payment applications shall be developed as per PA-DSS guidelines and complied with as required. The entities shall review PCI-DSS compliance status as part of merchant onboarding process. 2. Other Recommendations 2.1 The customer card credentials shall not be stored within the database or the server accessed by the merchant. 2.2 Option for ATM PIN as a factor of authentication for card not present transactions shall not be given. 2.3 Instructions on storage of payment system data, as applicable to PSOs, shall apply. 2.4 All refunds shall be made to original method of payment unless specifically agreed by the customer to credit an alternate mode. Reports to be submitted by Authorised Payment Aggregators Annual 1. Net-worth Certificate - Audited Annual report with statutory auditor certificate on Net-worth – by September 30th (Annexure 2.1). 2. IS Audit Report and Cyber Security Audit Report with observations noted, if any, including corrective / preventive action planned with closure date – Externally Audited – as prescribed by RBI. The scope of audit shall encompass all relevant areas of information system processes and applications. Quarterly 1. Auditor’s Certificate on Maintenance of Balance in Escrow Account – by 15th of the month following the quarter end. (Annexure 2.2 and Annexure 2.3). 2. Bankers’ Certificate on Escrow Account Debits and Credits – Internally Audited – by 15th of the month following the quarter end in case of PA – O and PA – P. 3. Bankers’ Certificate on InCA / OCA Debits and Credits – Internally Audited – by 15th of the month following the quarter end in case of PA - CB. Monthly 1. Statistics of Transactions Handled – by 7th of next month (Annexure 2.4). Non-periodic 1. Declaration and Undertaking by the Director - Changes in Board of Directors – as and when happens. – (Annexure 2.5) List of circulars repealed with the issuance of this Master Direction
|
इस पेज को शेयर करें:
आरबीआई मोबाइल एप्लीकेशन इंस्टॉल करें और लेटेस्ट न्यूज़ का तुरंत एक्सेस पाएं!
