Payment Aggregator License in India — Complete 2025 Guide
- Get link
- X
- Other Apps
Payment Aggregator License
in India — Complete 2025 Guide
If your business collects payments on behalf of merchants — online, at physical POS, or across borders — you need an RBI Certificate of Authorisation. The RBI’s landmark Master Direction on Regulation of Payment Aggregators, issued September 15, 2025, has comprehensively overhauled the framework. This definitive guide by Corpzo.com explains every category, requirement, document, and step you need to navigate the process.
What Is a Payment Aggregator? RBI’s Definition & Role in India’s Digital Economy
A Payment Aggregator (PA) is an entity that enables e-commerce merchants and businesses to accept various payment instruments from their customers — without each merchant needing to build its own payment integration. PAs act as the financial intermediary layer in India’s digital payments stack: they receive funds from customers, pool them in a segregated escrow account, and settle the proceeds to merchants after a defined processing cycle.
Unlike a Payment Gateway — which only provides technology infrastructure to route payment data — a Payment Aggregator actually handles money. This is what makes RBI authorisation mandatory for PAs. Every rupee that flows from a customer’s bank account to a merchant through a non-bank intermediary passes through a licensed PA framework.
Collect, pool & settle merchant payments
PAs receive customer payments across UPI, cards, net banking, and wallets; hold funds in an escrow account segregated from the PA’s own money; and settle to merchants within prescribed RBI timelines, typically T+1 to T+3 business days.
Gateways route data; PAs hold funds
A Payment Gateway provides only the technical routing between customer’s bank and merchant’s bank — it never touches money. A PA takes custody of funds, which is why RBI authorisation is required for PAs but not for standalone gateways that do not pool funds.
India’s $10 trillion digital payments opportunity
India records 10+ billion UPI transactions monthly. The digital payments market is projected to cross USD 10 trillion by 2026. Every merchant who cannot integrate directly with all banks relies on a licensed PA — making this one of India’s most high-growth regulated sectors.
All non-bank entities pooling merchant payments
Any non-bank entity that collects customer payments on behalf of merchants — whether online, at physical points-of-sale, or across international borders — must obtain RBI’s Certificate of Authorisation before commencing or continuing operations as a PA.
Three PA Categories under the RBI Master Direction, 2025
The September 2025 Master Direction is the first framework to formally classify Payment Aggregators into three distinct, regulated categories based on the nature of transaction facilitation. This replaces the earlier fragmented circulars that governed online and cross-border PAs separately while leaving physical PAs entirely unregulated:
Payment Aggregator (Online)
Entities facilitating digital payment transactions between customers and merchants through cards, UPI, net banking, wallets, and other electronic modes. The classic “fintech PA” model — Razorpay, PayU, CCAvenue operate in this space. The most common and well-established PA category in India.
Payment Aggregator (Physical)
Entities facilitating proximity or face-to-face payment transactions at physical merchant locations through card swipes, tap-and-pay (NFC), QR code scanners, and POS terminals. For the first time, brought under RBI’s regulatory oversight through the 2025 Master Direction. Application deadline for existing PA-Ps: December 31, 2025.
Payment Aggregator (Cross-Border)
Entities facilitating cross-border payment transactions for current account e-commerce, subject to FEMA regulations. Includes PA-CB Inward (receiving foreign customer payments into India) and PA-CB Outward (facilitating Indian customer payments to overseas merchants). Separate InCA and OCA accounts required.
Eligibility Conditions for PA Authorisation — Capital, Entity & Governance
Entity Structure
Private or Public Limited Company only
Only companies incorporated under the Companies Act, 2013 may apply. Sole proprietorships, partnership firms, and LLPs are categorically ineligible for PA authorisation. The entity type requirement is non-negotiable — the RBI will return applications from non-company entities without review.
PA activity must be an expressed object in MoA
The Memorandum of Association must explicitly include the business of operating as a Payment Aggregator among the company’s stated objects. Entities whose MoA does not contain this must amend it before applying — the RBI checks MoA compliance at the time of application review.
Capital Requirements — Two-Stage Net Worth Compliance
| Stage | Net Worth Requirement | Who Provides Certificate | Note |
|---|---|---|---|
| At Time of Application | ₹15 Crore minimum | Statutory Auditor (Annexure 2.1 format) | Newly incorporated entities may submit current NW certificate without audited accounts |
| By End of Year 3 from CoA | ₹25 Crore minimum | Statutory Auditor (annual certificate) | Must be maintained on a continuous basis thereafter |
Fit & Proper Criteria
All promoters, directors, and key management personnel must satisfy the RBI’s fit-and-proper requirements. The RBI may verify compliance by obtaining inputs from other regulators, government departments, law enforcement agencies, and credit bureaus. RBI’s decision on fit-and-proper compliance is final. Key requirements include:
- ✓No history of defaults on financial obligations or debt repayment
- ✓No criminal proceedings, particularly for economic offences, fraud, or financial crimes
- ✓No adverse regulatory action by RBI, SEBI, IRDAI, or any other financial sector regulator
- ✓Demonstrated integrity, competence, and relevant experience in financial or technology services
- ✓Financial soundness commensurate with the scale of proposed PA operations
Technical Pre-Conditions
Payment card security standards mandatory
Applicants must have implemented or be actively implementing PCI-DSS (Payment Card Industry Data Security Standard) compliance for all systems handling cardholder data. PCI-DSS compliance must also be verified for merchants during onboarding.
Segregated nodal account with authorised bank
An escrow or nodal account must be opened (or a letter of intent obtained) with an RBI-authorised commercial bank before operations commence. All customer payments flow through this account — completely segregated from the PA’s operating funds.
Board-approved KYC/AML policy mandatory
A comprehensive, board-approved KYC and AML policy — aligned with RBI’s Master Direction on Know Your Customer (2016) and PMLA, 2002 — must be in place. FIU-IND registration is also mandatory for all non-bank PAs.
Board-approved infosec framework
A board-approved Information Security Policy, reviewed at least annually, is mandatory. It must cover data classification, access controls, asset inventory, security organisational structure, incident response, and alignment with business objectives.
Documents Required for Payment Aggregator License Application
Preparing a complete, accurate, and RBI-formatted document set is the most critical success factor in the PA authorisation process. Incomplete applications are returned by RBI without processing — there is no partial review of incomplete files. Below is the comprehensive checklist:
Corporate & Entity Documents
- ✓Certificate of Incorporation under the Companies Act, 2013
- ✓Memorandum of Association (MoA) explicitly including PA activity as an object
- ✓Articles of Association (AoA)
- ✓Board Resolution authorising the filing of the RBI PA authorisation application
- ✓PAN card of the company
- ✓List of all directors, promoters, and KMPs with DIN / PAN details
- ✓Shareholding pattern and corporate structure chart
Financial Documents
- ✓Audited financial statements for the last two financial years (if entity has operated)
- ✓Statutory Auditor certificate confirming minimum net worth of ₹15 crore in RBI Annexure 2.1 prescribed format
- ✓For newly incorporated entities: Statutory Auditor certificate on current net worth (audited accounts not mandatory if entity is newly incorporated)
- ✓Capital structure details — paid-up capital, reserves, deferred tax assets (to be excluded from NW)
- ✓Source of funds documentation for net worth — promoter contribution, equity raise, bank statements
- ✓Business plan and projected financials for 3–5 years with revenue model and merchant pipeline
Fit & Proper Declarations
- ✓Individual Fit and Proper declarations from each director and promoter (RBI Annexure 2.5 format)
- ✓KYC documents: Aadhaar, PAN, passport, and address proof for all directors and promoters
- ✓Self-declaration of no criminal / regulatory proceedings against any director or promoter
- ✓Details of positions held in any other RBI / SEBI / IRDAI regulated entity
- ✓NOC from existing financial sector regulator (if applicable), obtained before PRAVAAH filing
Compliance & Technical Documents
- ✓Board-approved Information Security Policy
- ✓PCI-DSS compliance certificate or gap assessment and implementation roadmap
- ✓Board-approved KYC / AML Policy aligned with RBI KYC Master Direction 2016
- ✓Merchant onboarding policy (board-approved, with background check procedures)
- ✓Merchant agreement template showing allocation of settlement, refund, and chargeback responsibilities
- ✓Escrow / nodal account opening confirmation or bank letter of intent
- ✓Grievance redressal mechanism and nodal officer appointment details
- ✓Cyber security incident response policy including 2–6 hour breach reporting protocol
- ✓FIU-IND registration (or parallel application if newly applying) under PMLA, 2002
- ✓IT infrastructure overview, payment processing technology stack, and system architecture
8-Step Payment Aggregator License Registration Process
The PA authorisation process from entity formation to grant of Certificate of Authorisation (CoA) follows a structured, multi-stage pathway. Here is the complete roadmap as Corpzo manages it for clients:
-
1Entity SetupIncorporate the Entity & Ensure MoA Covers PA Activity If no entity exists, incorporate a private or public limited company under the Companies Act, 2013. The MoA must explicitly list operating as a Payment Aggregator as an object of the company. For existing companies, verify and if needed, amend the MoA through a special resolution and file the amendment with the ROC. Corpzo handles incorporation and MoA drafting / amendment as the foundational first step of every PA engagement.
-
2Capital ComplianceBuild & Certify Net Worth of Minimum ₹15 Crore Achieve the minimum ₹15 crore net worth required at application. This typically involves promoter capital infusion, equity raise from investors, or a combination. The net worth must be certified by the statutory auditor in Annexure 2.1 format — which specifically requires exclusion of deferred tax assets from the net worth computation. For newly incorporated entities, the auditor can certify current net worth without historical audited statements. Corpzo assists with capital structure planning, investor structuring, and auditor coordination.
-
3Compliance Build-OutEstablish Escrow, Policies, PCI-DSS & FIU-IND Registration Complete the compliance infrastructure before filing: (a) Open or obtain letter of intent for escrow account with an RBI-authorised bank; (b) Board approve the Information Security Policy, KYC/AML Policy, and Merchant Onboarding Policy; (c) Begin PCI-DSS gap assessment and remediation; (d) Apply for or complete FIU-IND registration under PMLA; (e) Establish the cyber security incident reporting mechanism, including the 2–6 hour breach reporting protocol. This is typically the longest pre-application phase — 2 to 4 months.
-
4NOC (if applicable)Obtain No-Objection Certificate from Existing Regulator If the applying entity is regulated by any other financial sector regulator (SEBI, IRDAI, NHB, PFRDA, etc.), a NOC from that regulator must be obtained before filing on PRAVAAH. The PRAVAAH application must then be filed within 45 days of receiving the NOC — a firm deadline that must be tracked meticulously. Entities not subject to any other sectoral regulation skip this step and proceed directly to PRAVAAH filing.
-
5PRAVAAH PortalCreate Account & File Application on PRAVAAH Access the RBI’s PRAVAAH portal (pravaah.rbi.org.in), register a user account for the applying entity using the company’s official email and contact details, and navigate to the Payment Aggregator authorisation application section. Select the correct PA category (PA-O, PA-P, PA-CB, or multiple), fill the application form, upload all supporting documents in the prescribed formats, review for completeness, and submit electronically. PRAVAAH generates an application reference number on submission for all future correspondence and status tracking.
-
6RBI ReviewRBI Processing — Verification, Query Management & Business Assessment RBI undertakes a multi-layer review: (a) Completeness and format check of all documents; (b) Net worth and capital adequacy verification; (c) Business plan and payment model evaluation; (d) Fit-and-proper verification of all directors and promoters by consulting other regulators, government departments, and databases; (e) Assessment of KYC/AML, IT security, and escrow frameworks. RBI may raise queries through the PRAVAAH portal — responses must be submitted promptly and comprehensively. RBI may also conduct a physical site visit or virtual interview with the management team.
-
7In-Principle ApprovalReceipt of In-Principle Approval (IPA) Upon satisfactory initial review, the RBI grants an In-Principle Approval (IPA). The IPA is not the final Certificate of Authorisation — it confirms that the application is suitable, subject to fulfilment of specific conditions. During the IPA period (typically 6 months), the entity must complete full PCI-DSS certification, operationalise the escrow account, complete system integration and testing, and demonstrate readiness of the complete merchant onboarding and settlement framework.
-
8CoA GrantedGrant of Certificate of Authorisation (CoA) by RBI After all IPA conditions are fulfilled and RBI’s final verification is complete, the Certificate of Authorisation (CoA) is granted under Section 7 of the PSS Act, 2007. The CoA authorises the entity to commence or continue PA operations in the approved category (PA-O, PA-P, PA-CB, or multiple). The entity is then listed on RBI’s publicly accessible directory of authorised Payment Aggregators. Ongoing compliance obligations become immediately and fully applicable from the date of the CoA.
Ongoing Compliance After the PA License is Granted
The CoA is the beginning of a PA’s compliance journey, not its end. The RBI’s Master Direction, 2025 imposes a structured calendar of ongoing obligations:
| Obligation | Frequency | Details |
|---|---|---|
| Security Breach Reporting to RBI | 2–6 hours | Card data breaches must be reported to RBI within 2–6 hours of detection |
| Cyber Security Incident Report | Monthly | Monthly report with root cause analysis and preventive actions taken for any security incidents |
| IT Audit Report to Board Committee | Quarterly | Internal and external IT audit reports submitted to the board’s IT oversight committee |
| Escrow Compliance Certificate | Quarterly | Certificate from the escrow bank confirming compliance with RBI’s escrow account rules |
| Net Worth Certificate (Auditor) | Annual | Statutory Auditor certifies continued compliance with ₹15 Cr / ₹25 Cr net worth requirements |
| PCI-DSS Review | Annual | Full PCI-DSS compliance assessment; share compliance status of payment applications with RBI |
| Information Security Policy Review | Annual | Board must review and re-approve the Information Security Policy at least annually |
| Merchant Due Diligence Compliance | Ongoing | Full CDD compliance required for all merchants onboarded after January 1, 2026; transition period until Sept 15, 2026 for pre-Dec 2025 merchants |
| FIU-IND Reporting | Ongoing | Suspicious Transaction Reports (STRs) and Currency Transaction Reports (CTRs) to FIU-IND per PMLA timelines |
Critical Operational Rules Every Authorised PA Must Follow
Binding written contracts with all merchants
Every merchant onboarded must be covered by a legally enforceable written agreement detailing settlement timelines, refund policies, chargeback handling, dispute resolution processes, and data storage restrictions (merchants must not store card data).
Strict separation from e-commerce marketplace
A licensed PA entity cannot simultaneously operate an e-commerce marketplace. Where a PA is part of a group with marketplace operations, the PA entity must be legally and operationally distinct from the marketplace entity — with no cross-contamination of operations or funds.
Small and medium merchant due diligence
The 2025 directions classify merchants into two categories: small merchants (physical, turnover below ₹5 lakh, not GST-registered) and medium merchants — with differentiated KYC and onboarding requirements. PAs have until September 15, 2026 to complete updated due diligence for merchants onboarded before January 1, 2026.
Prior RBI approval for ownership changes
Any takeover, acquisition, or change in management or control of a non-bank PA requires prior RBI approval. The PA must notify RBI within 15 days of becoming aware of any proposed change in ownership or control — and must not complete the change without RBI clearance.
All payment data must be stored in India
Payment data related to Indian transactions must be stored only within India. No customer payment data may be stored or transmitted outside India’s territorial limits without specific RBI permission. This applies to both PA-owned infrastructure and third-party cloud or data processing arrangements.
Nodal officer & prescribed turnaround times
Every PA must appoint a nodal officer for complaints and disputes. Failed transaction refunds must be processed within RBI’s prescribed Turn-Around Time (TAT) limits. PAs must publish comprehensive information on merchant policies, privacy policy, and terms & conditions on their websites and mobile apps.
Penalties for Operating Without a License or Violating PA Directions
Unauthorised PA Operations
Operating as a PA without RBI’s Certificate of Authorisation is a criminal offence under Section 7 of the PSS Act, 2007. Unlicensed PAs can be prosecuted, forced to immediately wind down, and required to close all escrow accounts.
Master Direction Contravention
Violation of any provision of the PSS Act or RBI’s Master Direction can attract monetary penalties up to ₹1 lakh per day of continuing violation, in addition to any initial penalty. RBI can also issue a directive to cease specific operations pending compliance.
Missed Deadline (PA-P)
PA-P entities that missed the December 31, 2025 application deadline were required to wind up operations by February 28, 2026 and their banks were directed to close all associated escrow accounts. Operating PA-P business after this date without authorisation compounds the violation.
Serious or Persistent Violations
Persistent non-compliance with KYC/AML obligations, serious data security breaches, escrow mismanagement, or regulatory deception can result in suspension or cancellation of the CoA — permanently ending the PA’s right to operate in the Indian payments ecosystem.
Get Your RBI Payment Aggregator License with Corpzo
From entity incorporation and MoA drafting to net worth certification, PRAVAAH filing, IPA condition fulfilment, and post-CoA annual compliance — Corpzo manages every step of your PA license journey.
Payment Aggregator License — Answers to the Most Common Questions
Ready to Launch Your Payment Aggregator Business in India?
India’s digital payments ecosystem is growing at unprecedented speed. Corpzo’s payment regulatory team navigates every step of the RBI authorisation process — from entity structuring to Certificate of Authorisation — with precision, speed, and zero incomplete submissions.
- Get link
- X
- Other Apps
Comments
Post a Comment