RBI Payment Aggregator Guidelines: Security and Compliance Checklist (2026)
On 15 September 2025, the Reserve Bank of India replaced its patchwork of payment aggregator rules with a single instrument: the Reserve Bank of India (Regulation of Payment Aggregators) Directions, 2025. It covers online, physical and cross-border aggregators in one place, and it repeals the 2020 guidelines, the 2021 clarifications and the 2023 cross-border circular that most compliance teams had been working from.
Most summaries of the directions focus on licensing and net worth. This guide focuses on the security and compliance controls an aggregator has to run day to day, and what they mean for the merchants and gateways that work with aggregators. It ends with a checklist.
Quick answer: RBI’s 2025 payment aggregator directions require non-bank aggregators to be authorised, hold net worth of Rs 15 crore at application and Rs 25 crore by the end of the third financial year, keep merchant funds in escrow, and complete customer due diligence on every merchant. On security, aggregators must follow the Baseline Technology-related Recommendations in Annex 1, ensure merchants meet PCI DSS and PCI SSF where applicable, never let card credentials sit on merchant-accessible systems, store payment data only in India, report incidents to RBI and pass an annual system and cyber security audit by a CERT-In empanelled auditor. Merchants onboarded before 2026 must be brought up to the new due diligence standard within one year, which means by the end of 2026.
What are the RBI payment aggregator guidelines?
The directions (reference RBI/DPSS/2025-26/141) were issued under the Payment and Settlement Systems Act, 2007 and FEMA, and took effect immediately. They define three categories of payment aggregator:
| Category | What it covers |
|---|---|
| PA-O (online) | Payments where the payer and merchant are not physically together, such as e-commerce checkouts |
| PA-P (physical) | Payments where the device and instrument are physically present, such as card terminals and QR at a counter |
| PA-CB (cross-border) | Cross-border current account transactions, inward and outward |
Existing authorisations were carried over. Entities that only did physical aggregation had to apply by 31 December 2025 or wind down by 28 February 2026. RBI’s list of authorised payment system operators shows around 60 or more payment aggregators across the three categories.
What is the difference between a payment aggregator and a payment gateway?
A payment aggregator handles merchants’ funds: it collects money from customers and settles it to merchants. A payment gateway only provides the technology that routes and processes payments, without handling funds.
Gateways are outside the directions, but RBI encourages them to follow the same Annex 1 technology recommendations. An aggregator may use gateways, but must treat them under RBI’s IT outsourcing rules, so its security obligations extend to them by contract. Our guide to third-party service provider risk explains how to manage that.
Who needs authorisation, and what are the core requirements?
- Banks do not need separate authorisation. Non-banks must be companies under the Companies Act, 2013, with payment aggregation in their memorandum, and apply through RBI’s portal.
- Net worth must be at least Rs 15 crore at application and Rs 25 crore by the end of the third financial year, maintained at all times and certified by auditors every year by 30 September.
- Promoters and directors must meet fit and proper criteria.
- Merchant funds must sit in an escrow account with a scheduled commercial bank, with one additional escrow allowed at another bank. The day-end balance must cover all amounts due to merchants. Cross-border aggregators use separate inward and outward collection accounts, with no netting between them.
- An aggregator may not run a marketplace business, may not set limits by payment mode, and must refund to the original payment method.
One change surprises many teams. The 2020 rules set settlement timelines such as T+1. The 2025 directions do not prescribe a timeline; settlement follows the agreement between aggregator and merchant, which must be fair and state the timelines clearly.
What security controls do the directions require?
Paragraph 9 sets the security baseline. Aggregators must:
- Run risk management and fraud detection and prevention systems.
- Ensure merchants’ infrastructure complies with PCI DSS and PCI SSF, as applicable. The 2020 text referred to PA-DSS, which has since been retired in favour of the PCI Software Security Framework.
- Have a Board-approved information security policy and follow the Baseline Technology-related Recommendations in Annex 1.
- Store payment data according to RBI’s April 2018 data storage circular.
- Complete an annual system audit, including a cyber security audit, by a CERT-In empanelled auditor, and send the report to RBI.
- Follow RBI’s July 2024 Master Direction on cyber resilience for non-bank payment system operators.
Annex 1 lists the detailed controls. The ones that most often need work are grouped below.
| Area | What Annex 1 expects |
|---|---|
| Governance | Board involvement in IT, an IT steering committee, a Cyber Crisis Management Plan, an information security policy reviewed at least once a year |
| Risk assessment | Security risk assessments reported to the Board, and asset-level assessment of threats and vulnerabilities |
| Reporting to the IT committee | Quarterly internal and annual external audit reports, VAPT every six months, PCI DSS AOC and ROC with corrective actions, an inventory of applications handling sensitive data, PCI SSF status of payment applications |
| Access and encryption | Least-privilege, need-to-know access; well-established encryption algorithms |
| Forensic readiness | Collection and analysis of security logs |
| Data sovereignty | Data stored in infrastructure that does not belong to external jurisdictions |
| Vendors | Right to audit in outsourcing contracts, or annual third-party security audit reports; vendor agreements allowing regulatory access |
| Merchants | A comprehensive security assessment at onboarding, and review of the merchant’s PCI DSS status |
| Payment rules | No card credentials on merchant-accessible systems, no ATM PIN option for card-not-present payments, refunds to the original method |
The cyber resilience direction adds detail. Payment aggregators are treated as large non-bank operators, so they need a CISO or equivalent, vulnerability assessment, penetration testing and source code review at least annually, encryption in transit and at rest, multi-factor authentication for debits, near real-time fraud monitoring and a 24×7 fraud reporting facility, and log retention of five years. For APIs and webhooks between aggregators and merchants, see our guide to payment API and webhook security.
What do the rules require for merchant onboarding?
Paragraph 13 makes aggregators responsible for knowing their merchants.
- Customer due diligence follows RBI’s KYC directions. Since a 28 November 2025 circular, references to the old KYC Master Direction in payment rules are read as references to the Reserve Bank of India (Commercial Banks: Know Your Customer) Directions, 2025.
- With the merchant’s consent, aggregators retrieve the KYC record from the Central KYC Records Registry.
- Merchants with annual turnover up to Rs 40 lakh (or export turnover up to Rs 5 lakh) can be onboarded with a simplified process: PAN or Form 60, contact point verification and an officially valid document of the proprietor.
- Aggregators must run background checks, assign the correct merchant category code, settle funds only to the merchant’s own bank account, and monitor that transactions match the merchant’s business profile.
- Non-bank aggregators must register with FIU-IND.
- Merchants onboarded up to 31 December 2025 must be brought into compliance within one year. Merchants onboarded from 1 January 2026 must comply from the start.
The 2020 guidelines also required aggregators to check that merchants do not sell fake or prohibited goods and that their websites show terms and refund policies. The 2025 text does not repeat this word for word, but it remains good practice and fits the onboarding security assessment in Annex 1.
What do the rules say about card data and data localisation?
Annex 1 states that customer card credentials must not be stored in any database or server accessed by the merchant. This sits alongside RBI’s card-on-file rules: since 1 October 2022, only card issuers and card networks may store card-on-file data, and everyone else uses tokens, keeping at most the last four digits and the issuer name for reconciliation.
Under RBI’s April 2018 circular, all payment system data must be stored only in India. The foreign leg of a cross-border transaction can also be stored abroad. RBI’s FAQ allows processing abroad, as long as the data is deleted there and brought back to India within one business day or 24 hours, whichever is earlier.
Who reports incidents, and when?
| Obligation | Timeline | Source |
|---|---|---|
| Report unusual incidents (cyber attacks, outages, internal fraud, settlement delays) to RBI | Within 6 hours of detection | Cyber resilience direction, July 2024 |
| Report cyber incidents to CERT-In | Within 6 hours of noticing | CERT-In Directions, April 2022 |
| Monthly incident report with root cause analysis to RBI | Monthly | Payment aggregator directions, Annex 1 |
| Transaction statistics to RBI | By the 7th of each month | Payment aggregator directions, Annex 2 |
| Escrow auditor and banker certificates | Quarterly, by the 15th of the following month | Payment aggregator directions |
| Net worth certificate | Annually, by 30 September | Payment aggregator directions |
| System and cyber security audit by a CERT-In empanelled auditor | Annually | Payment aggregator directions, paragraph 9 |
CERT-In also requires logs to be kept for 180 days in India and clocks to be synchronised with NIC or NPL time servers. Our guide to breach notification deadlines covers how to coordinate multiple regulators in one incident.
Has RBI penalised payment aggregators under these rules?
Yes, though penalties so far have been modest. In March 2026, RBI fined Cashfree Payments Rs 3.10 lakh for non-compliance with the payment aggregator directions, including an impermissible debit from its escrow account, after an inspection covering April 2024 to June 2025. Escrow handling is a regular inspection focus.
Payment aggregator compliance checklist
Authorisation and governance
- Authorisation in place for each category you operate (PA-O, PA-P, PA-CB).
- Net worth certified annually by 30 September and tracked against the Rs 25 crore requirement.
- Board-approved information security policy, reviewed in the last 12 months.
- IT steering committee and Cyber Crisis Management Plan in place.
- CISO or equivalent appointed.
Security operations
- Own PCI DSS ROC and AOC current and reported to the IT committee.
- Payment applications assessed under PCI SSF.
- VAPT every six months; penetration testing and source code review at least annually.
- Encryption in transit and at rest; multi-factor authentication for debits.
- Logs retained for five years, with 180 days kept in India for CERT-In.
- Near real-time fraud monitoring and a 24×7 fraud reporting channel.
Merchants and data
- Every merchant’s KYC meets the 2025 KYC directions, including those onboarded before 2026, by 31 December 2026.
- Security assessment and PCI DSS status review completed at onboarding.
- No card credentials stored on any merchant-accessible system; tokenisation used for saved cards.
- All payment data stored in India; any foreign processing deleted within 24 hours.
- Gateways and other vendors contractually bound to Annex 1 controls, with right to audit.
Reporting
- Incident reporting runbook covers RBI and CERT-In within 6 hours.
- Monthly incident and transaction reports, and quarterly escrow certificates, on a compliance calendar.
- Annual system and cyber security audit booked with a CERT-In empanelled auditor.
What do the guidelines mean for merchants?
Merchants are not regulated directly, but the directions reach them through their aggregator. Expect your aggregator to:
- Refresh your KYC during 2026 if you were onboarded earlier.
- Ask about your PCI DSS status and your security controls, especially if card data passes through your systems. Our guide to PCI DSS certification in India explains what to provide.
- Refuse any integration that would store card data on your servers.
- Settle only to a bank account in your own name, and refund only to the original payment method.
If you use more than one aggregator, our guide to payment orchestration security covers how to keep controls consistent across them.
Frequently asked questions
What is the current RBI regulation for payment aggregators?
The Reserve Bank of India (Regulation of Payment Aggregators) Directions, 2025, issued on 15 September 2025. It replaced the 2020 guidelines, the 2021 clarifications and the 2023 cross-border circular.
What is the net worth requirement for a payment aggregator licence?
Rs 15 crore at the time of application and Rs 25 crore by the end of the third financial year after authorisation, maintained at all times.
Do payment gateways need RBI authorisation?
No. Gateways that only provide technology and do not handle funds are outside the directions. RBI encourages them to follow the Annex 1 technology recommendations, and aggregators that use them must apply outsourcing controls.
Are payment aggregators required to be PCI DSS compliant?
Yes. Aggregators must report their PCI DSS ROC and AOC to their IT committee and ensure merchants’ infrastructure complies with PCI DSS and PCI SSF as applicable.
How fast must a payment aggregator report a cyber incident?
Within 6 hours of detection to RBI under the cyber resilience direction, and within 6 hours to CERT-In. A monthly incident report with root cause analysis also goes to RBI.
Is T+1 settlement still mandatory?
The 2025 directions do not set a specific settlement timeline. Settlement follows the aggregator-merchant agreement, which must state the timelines clearly and be fair to the merchant.
Can a payment aggregator store card numbers?
Only card issuers and card networks may store card-on-file data. Aggregators and merchants use tokens, and the directions prohibit card credentials on merchant-accessible systems.
What is the deadline for existing merchants to meet the new KYC rules?
Merchants onboarded up to 31 December 2025 must be brought into compliance within one year, so by the end of 2026.