Cross-Border Payment Aggregator (PA-CB) Rules: What Indian Exporters and SaaS Sellers Must Check (2026)
If you are an Indian exporter, a freelancer who has become a private limited company, or a SaaS business billing customers abroad, the payment provider that collects your foreign payments is almost certainly a cross-border payment aggregator, or PA-CB. Since September 2025, the Reserve Bank of India has regulated these providers under a single set of directions, and the rules shape how much you can collect per transaction, what KYC you face, how you get settled and what paperwork you receive.
This guide explains the PA-CB rules as they stand in October 2026, how to manage fraud and chargebacks on foreign cards, and what to check before choosing a provider. It is written for sellers, not aggregators.
Quick answer: A PA-CB is an RBI-authorised entity that collects cross-border payments for Indian merchants (inward) or for overseas sellers (outward). Since 15 September 2025, PA-CBs are governed by the RBI (Regulation of Payment Aggregators) Directions, 2025, which replaced the October 2023 PA-CB circular. Each transaction is capped at Rs 25 lakh, merchants must pass KYC through the aggregator, funds sit in a dedicated inward collection account with an authorised dealer bank, and the aggregator must give your bank the documents needed to close export entries. Before signing up, confirm the provider holds final authorisation, not only in-principle approval.
What is a cross-border payment aggregator (PA-CB)?
RBI defines a PA-CB as an entity that aggregates cross-border payments for current account transactions not prohibited under the Foreign Exchange Management Act (FEMA), for merchants it has onboarded, through e-commerce. There are two sub-categories:
- PA-CB facilitating inward transactions, which collects money from overseas buyers for Indian merchants and exporters. This is the one most Indian sellers use.
- PA-CB facilitating outward transactions, which collects money from Indian buyers for overseas sellers.
The directions define e-commerce broadly as transactions over a digital or electronic network, so an invoice link sent by email or a checkout embedded in a SaaS app both count. Merchant explicitly includes exporters.
One exclusion matters: a card transaction settled in foreign exchange through a card network, where the aggregator receives local currency, is not a PA-CB transaction. Ask your provider which licence covers your international card payments.
How is PA-CB regulated in 2026?
RBI issued the Reserve Bank of India (Regulation of Payment Aggregators) Directions, 2025 on 15 September 2025 (reference RBI/DPSS/2025-26/141). They consolidate the rules for online, physical and cross-border aggregators into one instrument and repeal the earlier circulars, including the 31 October 2023 circular on Regulation of Payment Aggregator, Cross Border. Authorisations granted under the repealed circulars remain valid.
For aggregators, the main requirements are:
- A non-bank PA-CB must be a company incorporated in India and must have net worth of Rs 15 crore when applying, rising to Rs 25 crore by the end of the third financial year after authorisation.
- Banks do not need separate PA authorisation.
- PA-CBs must follow the same security baseline as domestic aggregators, including PCI DSS compliance and an annual cyber security audit by a CERT-In empanelled auditor.
- Non-bank PAs must register with FIU-IND.
OurRBI payment aggregator guidelines checklistcovers the domestic side of these directions in detail. The rest of this guide focuses on what the cross-border rules mean for the seller receiving the money.
Which providers are authorised as PA-CBs?
RBI publishes a list of authorised payment aggregators, including PA-CBs, on its website and updates it periodically. That list is the only reliable source. Announcements and blog posts often blur the difference between final authorisation and in-principle approval.
| Status | What it means for you |
|---|---|
| Final authorisation | The provider holds a Certificate of Authorisation for PA-CB. Check whether it covers inward, outward or both. |
| In-principle approval | RBI has approved the application subject to conditions. The provider is not yet fully authorised. Ask how it is collecting your funds in the meantime. |
| Bank (AD Category-I) | Banks can act as aggregators without separate PA authorisation and handle foreign exchange directly. |
| Not listed | Ask which regulated entity actually holds your funds and issues your remittance documents. |
Skydo announced final PA-CB authorisation in January 2026. Payoneer India announced in-principle authorisation as a PA-CB for inward and outward transactions on 22 January 2026. PayPal announced in-principle approval for exports in May 2025, and Wise announced in-principle approval in July 2025. Several large domestic aggregators also hold PA-CB authorisations. Check the RBI list on the day you decide.
What rules apply to an exporter’s transactions?
The PA-CB rules are written for aggregators, but each one has a direct effect on how you collect and reconcile money.
| Rule | What the directions say | What to check as a seller |
|---|---|---|
| Value limit | Maximum Rs 25 lakh per transaction, inward or outward | The cap applies to the whole transaction, not each unit. Split large contracts into separate invoices or use bank wire for big tickets |
| Eligible transactions | Current account transactions not prohibited under FEMA, through e-commerce | Capital account receipts, such as investment from abroad, cannot go through a PA-CB |
| Merchant due diligence | KYC under RBI’s KYC directions, using CKYCR where available; background checks and transaction monitoring | Your declared business profile must match what you sell. A mismatch can freeze settlements |
| Small merchant route | Simplified KYC where annual turnover is up to Rs 40 lakh or export turnover up to Rs 5 lakh | Useful for new freelancers and small sellers. Expect full KYC once you cross the thresholds |
| Collection account | Inward Collection Account with an AD Category-I bank, separate for INR and each foreign currency; no pre-funding, no netting with outward funds | Your money is ring-fenced from the aggregator’s own funds |
| Settlement | As per your agreement, with timelines stated transparently | Ask for settlement timelines in writing. Non-INR settlement is allowed only for exporters onboarded directly by the inward PA-CB |
| Identification | Each payment must be identified as a cross-border transaction | Make sure your invoices and purpose codes match what you sell |
| Export documentation | PA-CB must give your AD bank the documents needed to close your entries in RBI’s export monitoring system (EDPMS) | Open EDPMS entries can block other export transactions and benefits |
| Refunds | To the original payment method, routed through the collection account | Refunds of foreign payments carry exchange rate differences |
Merchants onboarded before 1 January 2026 had one year to meet the new due diligence standard, so many sellers received re-KYC requests in 2026.
The Rs 25 lakh cap matters most for larger SaaS and service exporters. The earlier industry reading applied it per unit; the 2025 directions make it the maximum per transaction, so enterprise contracts above Rs 25 lakh need to be invoiced in parts or collected by bank transfer.
What documents do you need for GST, FEMA and export benefits?
You also need proof that foreign exchange arrived, so your bank can close export entries and you can claim GST zero-rating.
FEMA export rules changed on 1 October 2026. The Foreign Exchange Management (Export and Import of Goods and Services) Regulations, 2026 replaced the 2015 regulations, and an amendment notified on 22 September 2026 set the realisation period at nine months, or twelve months where the export is invoiced or settled in rupees. For services, the period runs from the invoice date. Service exporters also now file an Export Declaration Form with their bank for each month’s invoices. Check the current requirements with your AD bank, since procedures under the new regulations are still settling.
The documents that matter:
- Foreign inward remittance certificate (FIRC) or its electronic version. Only an AD Category-I bank issues it. Many PA-CBs pass bank-issued e-FIRCs to you through their dashboard. Confirm that you get one per settlement or per transaction, and that it shows the purpose code and foreign currency amount.
- Purpose code. RBI’s purpose codes classify why money came in, for example P0802 for software implementation or consultancy and P1006 for business and management consultancy. A wrong code can cause problems with GST refunds and export reporting.
- Letter of Undertaking (LUT). Under GST, export of services is zero-rated if conditions are met, including receipt of payment in convertible foreign exchange or in rupees where RBI permits. Filing an LUT lets you export without paying IGST upfront.
- Settlement statements linking each invoice, foreign currency amount, exchange rate, fees and rupee credit.
Some providers advertise automatic FIRCs, for exampleRazorpay’s international payments pagelists auto FIRC for goods exporters. Whatever the provider, test the documentation flow with a small payment before moving all your clients.
How do you secure international card payments?
Inbound foreign card payments carry more fraud risk than domestic ones, and the Indian authentication framework does not protect you. RBI’sauthentication directionscover Indian-issued instruments. Their cross-border provisions apply to outbound payments by Indian cardholders to overseas merchants. When a US or European customer pays you, the issuing country’s rules and card network rules apply.
That has three consequences.
First, 3D Secure on foreign cards depends on the issuer. European and UK issuers applystrong customer authentication under PSD2, but for a payment acquired outside Europe it is applied on a best-efforts basis. Many US issuers rarely challenge. Ask your aggregator whether it requests 3D Secure on international cards and whether it uses3D Secure 2 with full data, which lets low-risk payments pass without a challenge. A successfully authenticated payment usually shifts fraud chargeback liability to the issuer under card network rules.
Second, address checks are limited.AVScompares the billing address with the issuer’s records, but card issuers are required to support it mainly in the United States, Canada and the United Kingdom, and for Visa in Europe. For cards from other regions, AVS often returns no result.
Third, fraud arrives as disputes, often months later. The cardholder can dispute long after you have delivered, and the aggregator debits the chargeback from your balance, often with a fee. Digital goods and SaaS trials are common targets forfriendly fraudand forcard testing attacksthat use free-trial or low-value checkouts to validate stolen cards.
| Control | What it does | Limits for Indian sellers |
|---|---|---|
| 3D Secure 2 | Issuer authenticates the cardholder; liability usually shifts | Depends on issuer support; challenges reduce conversion |
| AVS | Checks billing address against issuer data | Reliable mainly for US, Canadian and UK cards |
| CVV check | Confirms the card is likely in the buyer’s hands | Stolen card data often includes CVV |
| Velocity and BIN rules | Blocks repeated attempts and high-risk card ranges | Needs tuning to avoid blocking real buyers |
| Delivery and usage evidence | Supports chargeback responses | Only works if logs are kept and linked to orders |
Currency handling adds its own risk. If a customer pays in US dollars and you are settled in rupees, a full refund later may cost you more or less than you received because the exchange rate has moved. Ask how your provider handles refunds and chargebacks across currencies, and whether it charges conversion twice.
What should you check before choosing a PA-CB provider?
Use this checklist before onboarding, and repeat it once a year.
- Authorisation. Confirm on RBI’s list that the provider holds final PA-CB authorisation for inward transactions, in the name of the entity you contract with.
- Product scope. Check which methods are covered: international cards, local methods abroad and virtual accounts for wires. Each may run under a different licence or bank partner.
- Documentation. Ask for a sample e-FIRC and settlement statement. Confirm purpose codes, frequency of issue and that the provider sends EDPMS information to your bank.
- Fees and FX markup. Get the transaction fee, the foreign exchange markup over a stated reference rate, GST on fees, chargeback fees and any fixed charges in writing. A low headline fee with a wide FX spread can cost more overall.
- Settlement terms. Ask for the settlement cycle in writing, whether you can hold balances in foreign currency, and what triggers a hold.
- Dispute handling. Ask how chargebacks are notified, how long you have to respond, what evidence formats are accepted and whether the provider offers fraud screening for international cards.
- Security. Confirm PCI DSS compliance, 3D Secure 2 support for international cards, webhook signing and two-factor login on the dashboard.
- Limits. Confirm how the provider enforces the Rs 25 lakh per transaction cap and whether it applies lower internal limits to new accounts.
- Exit. Check how balances are settled if you leave, and how long past FIRCs stay downloadable.
Frequently asked questions
1. What does PA-CB stand for?
PA-CB stands for Payment Aggregator, Cross Border. It is an RBI authorisation category for entities that collect cross-border payments for merchants, either inward for Indian exporters or outward for overseas sellers.
2. Is the 2023 PA-CB circular still in force?
No. The RBI (Regulation of Payment Aggregators) Directions, 2025, issued on 15 September 2025, repealed the 31 October 2023 PA-CB circular and consolidated its rules. Authorisations granted under the old circular remain valid.
3. What is the maximum amount per transaction through a PA-CB?
Rs 25 lakh per transaction, for both inward and outward payments. The limit applies to the total value of the transaction, not each unit of goods or services within it.
4. Can a freelancer use a PA-CB?
Yes. Merchants include individuals and proprietors as well as companies. Where annual turnover is up to Rs 40 lakh, or export turnover up to Rs 5 lakh, the aggregator can use a simplified KYC process.
5. Do PA-CBs issue FIRCs?
A FIRC is issued by an AD Category-I bank, not the aggregator itself. PA-CBs usually pass on the bank’s electronic FIRC through their dashboard. Confirm the format and frequency before you sign up.
6. Is 3D Secure mandatory for foreign cards paying an Indian merchant?
Not under Indian rules. RBI’s authentication directions cover Indian-issued instruments. For foreign cards, the issuing country and card network decide whether authentication is required, so ask your provider to request 3D Secure 2 where it reduces fraud risk.
7. How long do I have to realise export proceeds?
From 1 October 2026, the realisation period under the FEMA export regulations is nine months, or twelve months for exports invoiced or settled in rupees. For services, it runs from the invoice date. Your AD bank can extend it in some cases.