India Payment Aggregator licence, what foreign fintech needs.

Payment Aggregator (PA):

• Entity that onboards merchants to accept various payment instruments (cards, UPI, net banking, wallet) and settles funds to merchants.
• Takes custody of funds for brief period (merchant's funds flow via PA's nodal account to merchant's bank).
• Needs RBI authorisation (licence) under PSS Act 2007.
• Example: Razorpay, Cashfree, Paytm Payment Services, PhonePe for Business.

Payment Gateway (PG):

• Technology provider that routes payment data between merchant, customer, acquirer, issuer. Does NOT handle funds custody.
• Does NOT need RBI authorisation separately but is subject to RBI guidelines (data localisation, security standards).
• Example: pure PG function of certain gateways (though most Indian PGs are also PAs).

PA-CB (Payment Aggregator Cross-Border):

• Specialised PA licence for cross-border payment flows: Indian consumer paying foreign merchant, or foreign consumer paying Indian merchant.
• Separate authorisation framework (RBI October 2023 PA-CB circular).
• Three sub-categories: PA-E (Export, for Indian merchants selling abroad), PA-I (Import, for Indian consumers buying abroad), PA-CB for both.
• Enables UPI international linkages, card payments cross-border, international remittance for e-commerce.

• Company incorporated in India under Companies Act 2013 (private limited / public limited / unlisted / listed). Foreign fintech must have Indian subsidiary.
• Net worth: minimum INR 15 crore in year 1 of application; INR 25 crore in year 3 and ongoing.
• Net worth certification: CA certificate confirming net worth as of latest audited balance sheet date.
• Promoters' background: fit and proper person test. Promoters / directors must not be disqualified; must have relevant financial / technology experience.
• IT infrastructure: dedicated India-hosted infrastructure. Core payment systems hosted in India (data localisation).
• Nodal / escrow account: specified bank for merchant funds; settlement to merchants within T+1 for most instruments.

1. Pre-application: structure Indian subsidiary (WOS of foreign parent typical); fund with min INR 15 crore net worth; set up IT infrastructure in India; appoint CTO + Compliance Officer + Chief Risk Officer.
2. Application: Form A to RBI with supporting documents — company incorporation, MOA/AOA, net worth CA certificate, business plan, system architecture, security assessment, promoter / director KYC.
3. RBI examination: typically 6-18 month review. Includes IT infrastructure inspection, business plan evaluation, promoter background check, legal + compliance review.
4. In-principle approval: 1-year validity. Applicant must demonstrate operational readiness.
5. Full authorisation (Certificate of Authorisation): upon RBI satisfaction. Entity becomes authorised PA.
6. Ongoing compliance: monthly / quarterly reporting, annual CA certification of net worth, periodic IT audit, security incident reporting.

• Data localisation (RBI April 2018 circular): all payment data (card number, CVV, OTP, device data, user data) must be stored ONLY in India. Foreign fintech typically keeps India-only data stores for Indian users.
• Card tokenisation (RBI September 2021): card storage prohibited by any entity except card networks + issuers. PA / PG must use network tokens for recurring payments.
• Merchant onboarding (RBI March 2020 PA/PG circular): PA must conduct merchant KYC, maintain merchant database, submit to RBI on request.
• Nodal account (RBI March 2020): merchant funds in nodal account; cannot be used for own purposes; T+1 settlement for most instruments.
• Grievance redressal: standardised merchant + consumer complaint mechanism.
• Security audit (annual): PCI DSS + CERT-In empanelled auditor annual audit.
• Non-bank PPI (Prepaid Payment Instrument): separate licensing framework if issuing wallets.
• UPI integration: NPCI approval + bank partnership for UPI handles.

Last updated: 2026-10-15.