The Reserve Bank of India (RBI) has issued final guidelines for payment aggregators, aimed at tighter rules to increase customer safety and prevent fraud.

The norms, which come into effect immediately, set uniform rules for regulating bank and non-bank payment aggregators, including those handling cross-border payments.

The RBI’s comprehensive guidelines on PAs have come after getting feedback from stakeholders on its draft directions brought out in April 2024.

Three categories

The RBI has classified payments aggregators (PAs) into three categories as per the work they undertake.

These include: PA–Physical (PA–P) for in-person transactions; PA–Online (PA–O) for e-commerce and remote transactions; and PA–Cross Border (PA–CB) for inward and outward forex payments, with maximum transaction value of Rs 25 lakh.

RBI authorisation and capital

Banks do not require RBI authorisation to run PA business. However, for non-banking PAs, the RBI has set specific capital requirements. They need a minimum net-worth requirement of Rs 15 crore at application stage and Rs 25 crore within three years.

Escrow accounts

As per RBI’s directions, non-bank PAs must keep customer collections in a separate escrow account with a scheduled commercial bank (SCB). 

Cross-border PAs must maintain separate Inward Collection Accounts (InCAs) for inward transactions and Outward Collection Accounts (OCAs) for outward transactions. 

They also need to maintain permitted debits: settlement to merchants, refunds, promotional payouts.

The  ‘core portion’ of escrow balances (the lowest average fortnightly balance over 26 fortnights) can earn interest but cannot be used for loans.

Dispute resolution policy

The RBI has mandated PAs to set up a board-approved dispute resolution policy to handle payment-related disputes, including refunds. Mention has to be made about clear refund timelines. 

No transaction limits

As per the RBI norm, transaction limits can’t be set by PAs. Only banks are allowed to set the cap on how much can be paid in a transaction. 

Security and fraud prevention systems

PAs need to put in place board-approved information security policies. They will have to ensure that their merchants’ infrastructure complies with international standards such as the Payment Card Industry Data Security Standard (PCI-DSS) and Payment Application Data Security Standard (PA-DSS).

PAs will also have to maintain strong fraud detection and prevention systems to protect customers from misuse of digital payment channels.

KYC and merchant due diligence

PAs must carry out full KYC and background checks on merchants. 

PAs must adopt simplified checks for small merchants with  turnover below Rs 40 lakh or export turnover below Rs 5 lakh. These checks include verifying PAN, conducting contact point verification and obtaining officially valid documents.

Non-bank PAs must register with Financial Intelligence Unit–India and comply with anti-money laundering obligations.