India Payments & Fintech Regulation

Licensing, Authorisation & Market Access

The Reserve Bank of India's Payment Aggregator Master Directions, 2025 bring offline Payment Aggregators under authorisation for the first time, closing a gap in the licensing perimeter that had previously applied only to online payment aggregation. Offline PAs — those handling point-of-sale acceptance and same-location instrument transactions — must now apply for RBI authorisation, with existing offline PAs required to submit applications by 31 December 2025 or wind down operations entirely by 28 February 2026. This is a scope-widening development rather than a tightening of existing rules: it extends the authorisation perimeter to a category of non-bank payment intermediary that had not previously required it.

A parallel development affects the PA-CB (cross-border Payment Aggregator) authorisation category: its permitted scope has been liberalised to cover processing of permissible current-account transactions under FEMA, where it had previously been confined to trade transactions only. This is a market-access widening for cross-border payment aggregators, expanding the transaction types they may lawfully process under their existing authorisation.

On the compliance-timeline side, an extended deadline to 15 September 2026 has been granted for merchant customer-due-diligence compliance, but only for merchants onboarded up to 31 December 2025; no equivalent leeway applies to merchants onboarded from 1 January 2026, who face immediate CDD compliance expectations. Non-bank PAs, including the new offline PA-P category, are confirmed as PMLA reporting entities required to register with FIU-IND — an AML-compliance overlap that connects to financial-integrity's coverage of India's reporting-entity architecture but is not analysed further here. Throughout this domain, the bank-versus-non-bank distinction is structurally significant: these authorisation and CDD obligations fall on non-bank payment institutions and e-money institutions, not on banks directly.

Outlook

The two dates to track are 31 December 2025, the offline-PA authorisation application deadline, and 28 February 2026, the wind-down deadline for non-compliant offline PAs. The 15 September 2026 merchant-CDD extended-compliance deadline is the third near-term milestone, after which no further leeway is anticipated for merchants onboarded from 1 January 2026 onward.

Licensing, Authorisation & Market Access

The Reserve Bank of India's consolidated Regulation of Payment Aggregators Directions, 2025, effective 15 September 2025, rationalises and repeals what had previously been three separate regulatory frameworks — the 2020 and 2021 PA-PG Guidelines and the 2023 cross-border payment-aggregator framework — into a single directions document. The consolidated framework establishes three distinct licensing categories: PA-Online, PA-Cross-Border and PA-Physical, replacing what had been a fragmented, incrementally-built licensing architecture with a single coherent instrument.

The consolidation carries substantive compliance consequences with hard deadlines. PA-P entities that did not submit an authorisation application to the RBI by 31 December 2025 are required to wind up their PA-P operations entirely by 28 February 2026 — a genuine market-exit consequence for non-compliant entities, not merely a procedural lapse. Separately, payment aggregators were given an extended customer-due-diligence remediation timeline running to 15 September 2026 for merchants that had been onboarded before 31 December 2025, reflecting a rolling compliance window built into the same 2025 Directions rather than a new, unrelated obligation.

Taken together, these developments mark a maturing, more prescriptive supervisory posture for India's payment-service-provider sector. The consolidation itself is a structural simplification, but the accompanying deadlines — a hard wind-up date for non-compliant PA-P entities and a rolling merchant-KYC remediation timeline — indicate that the RBI is treating the new framework as an enforceable compliance architecture rather than a restatement of existing practice. Non-bank payment institutions and e-money institutions bear the primary compliance burden of this consolidation, distinct from bank-operated payment aggregators, which sit within existing prudential supervision.

Outlook

The 28 February 2026 PA-P wind-up deadline and the 15 September 2026 extended CDD remediation deadline are the two concrete compliance markers to track through the remainder of this cycle and into early 2026. Both are confirmed, dated obligations under the same 2025 Directions rather than open proposals, and non-compliance carries a genuine market-access consequence for affected payment aggregators.

Licensing, Authorisation & Market Access

The Reserve Bank of India's Draft Master Direction on Prepaid Payment Instruments, 2026 tightens governance requirements for non-bank PPI issuers, mandating fit-and-proper promoter and director criteria and bringing PPI customer onboarding directly within the RBI's own KYC framework rather than leaving it to issuer-level policy. This consolidates non-bank payment regulation under a same-activity, same-risk, same-regulation principle, narrowing the gap between how banks and non-bank prepaid-instrument issuers are governed. The direction remains in draft form, so its final scope and effective date are not yet settled, and this assessment is probable rather than confirmed.

Separately, the Payment Aggregator authorisation regime under the Payment and Settlement Systems Act 2007 continues without material change: more than 60 entities hold in-principle or final RBI Payment Aggregator authorisation as of 2026, and the net-worth threshold for that category remains at ₹15-25 crore. This is a distinct authorisation category from PPI issuance and from banking licensure, and its continuity this cycle indicates a stable, if still-maturing, market-access structure for payment aggregation specifically, even as the PPI governance standard is being actively raised.

The bank-versus-non-bank distinction is material here: the PPI tightening applies specifically to non-bank PI/EMI issuers, since banks are already subject to RBI's banking-license-level KYC and governance standards. The effect of the Draft Master Direction, if finalised as proposed, would be to narrow rather than eliminate this bank/non-bank regulatory gap.

Outlook

The key near-term development to track is whether the Draft Master Direction is finalised in its current form, amended following industry consultation, or delayed. Any change to the promoter fit-and-proper criteria or the KYC-integration requirement between draft and final stage would materially affect non-bank PPI issuers' market-access planning.

Licensing, Authorisation & Market Access

The Reserve Bank of India's rewritten Payment Aggregator Directions, reference RBI/DPSS/2025-26/141 and notified 15 September 2025, constitute a confirmed, high-impact, comprehensive rewrite of the licensing and market-access framework for payment aggregators in India. The central structural innovation is the introduction of an Offline PA category for the first time, bringing offline-context payment aggregation into an authorisation regime that had previously applied only to online aggregation. The directions explicitly repeal the prior 2020 intermediary-transactions circular except for decisions already pending authorisation, a confirmed finding that establishes a clean regulatory handover rather than an overlapping dual regime.

The new framework carries distinct compliance timelines for different aggregator sub-categories. Existing offline PAs were required to apply for RBI authorisation by 31 December 2025, a probable-confidence deadline; critically, this leeway is not available for merchants onboarded after 1 January 2026, who face the new requirements immediately upon onboarding rather than benefiting from any transition window. This bifurcation means firms operating offline-PA business lines must track two distinct compliance populations -- pre-existing merchants under a grace period, and new merchants under immediate compliance -- within the same regulatory category.

Cross-border payment aggregators (PA-CBs) see a combined liberalisation and tightening. Their permissible scope is liberalised: PA-CBs may now process any permissible current-account transaction under FEMA, rather than being restricted to trade transactions alone, a probable-confidence expansion of their addressable business. This liberalisation is paired with a new INR 25 crore net-worth requirement, due by 31 March 2026, meaning the broadened scope of permissible activity is conditioned on a materially higher capital base than may have previously applied to smaller cross-border aggregators. Separately, non-bank payment aggregators, including the newly created offline PA-P category, are confirmed as PMLA reporting entities that must register with FIU-IND, carrying this finding through from the AML-adjacent scope of the same directions rather than from original AML analysis produced here.

Throughout this framework, the distinction between bank-affiliated PSPs and non-bank payment institution/e-money-institution aggregators remains operationally significant: the net-worth threshold, authorisation deadlines and PMLA registration obligations bear most directly on the non-bank PI/EMI population, which had previously operated under lighter-touch oversight relative to bank-affiliated payment processors.

Outlook

The compliance calendar is front-loaded through the first three quarters of the 2025-26 to 2026-27 window: the offline-PA authorisation deadline of 31 December 2025 has already passed, an extended merchant-CDD compliance deadline runs to 15 September 2026 for merchants onboarded before 31 December 2025, and the PA-CB net-worth threshold falls due 31 March 2026. Supervisory attention through this period is likely to concentrate on authorisation-status verification for offline PAs and net-worth compliance for cross-border aggregators. Watch for RBI guidance clarifying the merchant-CDD extended-deadline population and for any enforcement action against aggregators that miss the passed 31 December 2025 offline-PA authorisation deadline.

Conduct, Safeguarding & Financial Promotions

This cycle's most consequential conduct-side development for the Indian payments industry is direct and confirmed at the highest source tier: banks and financial institutions that promote or facilitate financial transactions for online money gaming will be guilty of an offence, effective from 1 May 2026. This statement, made explicitly by the government, converts what had previously been an indirect exposure for the payments industry into a direct criminal-liability standard tied to a specific prohibited activity.

The Online Gaming Rules, 2026 operationalise this penal-liability announcement into a concrete transaction-blocking mechanism: a designated authority is empowered to instruct banks and payment service providers to halt transactions linked to specified games, with penalties attaching to delayed compliance. This is a confirmed, though Tier 2-sourced, development that gives the conduct obligation an enforceable operational form rather than leaving it as a general prohibition. Both banks and non-bank payment service providers fall within scope of this obligation, a rare instance where the conduct standard is deliberately drawn across the bank/non-bank line rather than differentiated by institution type.

A further, less-corroborated development concerns merchant-category-code tagging: reporting sourced only at a low evidentiary tier indicates a designated authority mandated a unique gaming merchant-category code for UPI-based gaming transactions specifically to enable real-time monitoring and deposit-limit enforcement. This remains an uncertain finding pending stronger-tier corroboration, and should be read as a plausible but unconfirmed elaboration of the broader transaction-blocking framework rather than a settled fact.

Outlook

The practical enforcement pattern under the new penal-liability regime, and specifically whether and how often the designated authority exercises its transaction-blocking power against banks or PSPs, is the central indicator to watch through the remainder of 2026. Independent corroboration of the gaming merchant-category-code mandate would also be a significant confirming development if it emerges.

Conduct, Safeguarding & Financial Promotions

The 2025 Payment Aggregator Directions impose a confirmed, high-impact conduct and safeguarding obligation on all payment aggregators operating in India: a board-approved dispute-resolution policy with clear refund timelines is now mandatory, alongside maintenance of PCI-DSS/PA-DSS data-security standards. This combines a customer-facing conduct requirement -- ensuring merchants and consumers have a defined, governed path to dispute resolution and refunds -- with a technical data-security baseline that aggregators must demonstrably maintain rather than merely aspire to.

The safeguarding mechanism specified is procedural rather than a discrete asset-segregation rule: the requirement centres on the board-approved policy itself and the underlying PCI-DSS/PA-DSS compliance posture, rather than, for example, a specific customer-funds-segregation mechanism of the kind seen in some other jurisdictions' payment-institution safeguarding regimes. Security-incident reporting is bound to this same conduct framework: aggregators must report security incidents to RBI within stipulated timeframes, including a monthly cyber-incident reporting cadence, meaning conduct obligations and operational-security obligations are woven together in the same directive rather than sitting in separate regulatory tracks.

This conduct and safeguarding tightening applies across the newly authorised online, offline and cross-border aggregator categories established by the same directions, meaning the non-bank PI/EMI population bears the primary weight of these new board-governance and data-security obligations, consistent with the directions' overall focus on non-bank aggregator oversight rather than bank-affiliated PSP conduct specifically.

Outlook

Watch for RBI supervisory guidance detailing the specific stipulated timeframes for security-incident reporting beyond the monthly cyber-incident cadence already specified, and for any published enforcement action addressing aggregators found not to have implemented a board-approved dispute-resolution policy. As the broader PA Directions rewrite beds in through 2026, conduct-related supervisory findings are likely to surface alongside the authorisation and net-worth compliance actions tracked under the licensing module.

Operational Resilience & Critical Infrastructure

The 2025 Payment Aggregator Directions formalise a confirmed operational-resilience obligation requiring payment aggregators to present reports on risk assessment, security-compliance posture, security audits and incidents to their board, and to report the same to RBI. This sits alongside the confirmed PCI-DSS/PA-DSS data-security standard and the monthly cyber-incident reporting cadence carried within the same directions, together constituting a materially strengthened operational-resilience framework for the payment-aggregator sector relative to the prior 2020 regime.

The structural significance of formalising board-level presentation of security and risk-assessment reporting is that it embeds operational-resilience accountability at governance level rather than leaving it purely as a technical-compliance function reporting only to management. Combined with the monthly cyber-incident reporting obligation to RBI, this creates a dual accountability channel -- internal board oversight and external regulatory reporting -- operating on overlapping but distinct cadences.

This resilience obligation applies to the newly authorised online, offline and cross-border aggregator categories alike, meaning the non-bank PI/EMI population that dominates the payment-aggregator sector in India now faces board-governance and regulatory-reporting obligations for operational resilience that more closely approach, though do not necessarily match, the standards historically expected of bank-affiliated payment infrastructure.

Outlook

Watch for the first cycle of monthly cyber-incident reports to RBI under the new framework, and for any RBI commentary on aggregate incident volumes or patterns across the newly regulated offline-PA population, which entered the authorisation regime for the first time this cycle. Any high-profile security incident at a payment aggregator in the coming cycles would be the first real test of whether the board-reporting and RBI-notification cadence functions as intended under the new directions.

Scheme & Network Compliance

The National Payments Corporation of India introduced a merchant discount rate on person-to-merchant Unified Payments Interface transactions, departing from the long-standing zero-MDR position on UPI. The rule sets a 0.4 percent charge on transactions above Rs2,000, capped at Rs300 for transactions of Rs75,000 or more, with a flat Rs5 fee for railways, telecom, insurance and fuel payments, a reduced 0.02 percent rate for capital-market payments, and no charge for peer-to-peer transfers or for small merchants processing Rs1 lakh or less per month. Consumers remain entirely unaffected: the scheme rule applies only to the merchant side of person-to-merchant transactions.

The scheme-rule change was enabled by statute rather than scheme discretion alone: a Gazette notification of 14 September 2026 amended section 10A of the Payment and Settlement Systems Act, 2007, establishing the enabling legal framework for digital-payment processing charges on a rail that had previously operated on a mandated zero-MDR basis. This statutory-basis finding carries more caution than the scheme-rule finding itself, since it rests on a secondary explainer source rather than a directly retrieved Gazette text.

The rule was originally due to take effect on 15 October 2026. On 13 October 2026, two days before that date, the scheme deferred implementation to a point after the Diwali festival period, with no replacement date announced, following public and political pushback against the prospect of new merchant-side costs on India's dominant free payment rail. The Finance Ministry has denied that the deferral reflects pressure from the United States, a denial offered in response to speculation linking the deferral to external trade considerations. The underlying scheme rule and its enabling statutory amendment remain formally in place: this is a deferral of implementation timing, not a reversal of the rule itself.

Outlook

The operative question for scheme participants and merchants is when a revised go-live date will be announced and whether the rate structure will change in response to the pushback that triggered the deferral. A future cycle should watch specifically for a post-Diwali NPCI circular; the political sensitivity already displayed around this rule suggests any relaunch is likely to be managed carefully to avoid a second reversal.

Payment Corridor Dynamics

NPCI and the RBI are reintroducing a Merchant Discount Rate on the Unified Payments Interface rail. A 0.4% MDR will apply to eligible UPI merchant transactions above ₹2,000, effective 15 October 2026. This is probably the most structurally significant single development in India's domestic payment-corridor economics this cycle: UPI has operated as a zero-MDR rail for small transactions since 2020, as part of a deliberate government policy of promoting digital-payments adoption by keeping merchant acceptance costs at zero. The reintroduction of even a modest 0.4% rate marks the first material departure from that decade-long zero-MDR posture.

The practical effect falls on merchant acquirers and the broader UPI merchant-acceptance ecosystem, which must now build MDR collection and reconciliation into transaction processing for eligible transactions above the ₹2,000 threshold, where previously no such mechanism was required for the affected transaction band. The structural significance is less about the rate itself, which is modest by card-scheme standards, than about what it signals for the commercial economics of India's flagship instant-payment rail going forward: a shift away from an absolute zero-cost-to-merchant model toward one in which at least some transaction volume now carries an explicit cost.

Outlook

The 15 October 2026 effective date is the concrete marker to track. Whether this modest reintroduction is a one-off adjustment or the beginning of a broader recalibration of UPI's commercial-economics model is the open question that will likely become clearer only after the new MDR has been in effect for a full reporting cycle.

Product Innovation & Market Development

The Reserve Bank of India's FY2025-26 Annual Report signals a deliberate expansion of its central bank digital currency programme. The Report states RBI will explore bilateral and multilateral cross-border CBDC pilots during FY2026-27, extending the e-Rupee programme beyond its current domestic pilot footprint into cross-border settlement use cases. Domestically, the Report also signals a widening of existing CBDC pilots into direct-benefit-transfer and business-application use cases, broadening the programme's functional scope beyond its initial retail and wholesale pilot design.

Separately, and on thinner sourcing, RBI is reported to have launched a deposit-tokenisation pilot around October 2025 using its Unified Markets Interface, applying blockchain-based settlement to tokenised Certificates of Deposit. This pilot, if confirmed by further reporting, would represent a distinct product-innovation track from the e-Rupee CBDC programme, applying distributed-ledger settlement mechanics to an existing wholesale-market instrument rather than to a sovereign digital currency. Both developments sit within the bank/PSP side of India's payments infrastructure, reflecting RBI's own central-bank-led experimentation rather than non-bank product innovation.

Outlook

Watch for RBI's FY2026-27 activity on cross-border CBDC pilots as the most concrete near-term marker of this programme's direction, and for any further confirmation or expansion of the deposit-tokenisation pilot beyond its October 2025 launch, which currently rests on a single lower-tier source.

Product Innovation & Market Development

The Reserve Bank of India's 2025-26 Annual Report commits to a substantial expansion of e-rupee central-bank-digital-currency experimentation during 2026-27. The programme spans cross-border bilateral and multilateral CBDC pilots, asset tokenisation experimentation via the Unified Multi-Ledger Infrastructure, programmable-money direct-benefit-transfer pilots running in Gujarat, Puducherry and Chandigarh, and a digital-assets cooperation pact with the Monetary Authority of Singapore. This is a confirmed institutional commitment rather than a speculative proposal, reflecting the RBI's stated annual-report-level prioritisation of CBDC development.

The breadth of this programme — spanning cross-border settlement, asset tokenisation, and domestic social-transfer programmability — signals that the RBI regards the e-rupee as its primary vehicle for digital-money innovation, in preference to accommodating private stablecoin issuance. The digital-assets pact with Singapore's Monetary Authority is notable as an early instance of India pursuing bilateral digital-currency cooperation with another major Asian financial centre, extending the CBDC programme's ambition beyond purely domestic use cases.

Outlook

The pace and results of the Gujarat, Puducherry and Chandigarh programmable-money pilots, and the concrete shape the MAS cooperation pact takes in practice, are the two most consequential near-term markers for assessing whether this expanded CBDC programme translates into deployed product rather than continued pilot-stage experimentation.

Consumer Protection & APP Fraud

India's digital-fraud compensation framework now places the burden of proving customer negligence on banks and payment service providers rather than on the customer. Under this framework, customers who report unauthorised digital transactions promptly and are not shown to have been negligent are entitled to zero-liability compensation, reversing what would otherwise be a burden-of-proof default falling on the consumer to demonstrate they were not at fault. Banks and PSPs are additionally required to submit quarterly aggregate reporting to RBI on these compensation outcomes, creating a supervisory data trail on how frequently unauthorised-transaction claims arise and how they are resolved.

This burden-shift is a significant consumer-protection development for a market where digital-payment fraud volumes are substantial, and it applies specifically to the bank/PSP side of the payments ecosystem rather than to non-bank payment institutions, reinforcing the bank-versus-non-bank distinction that runs through this cycle's other India developments.

Outlook

Watch for the first quarterly aggregate reporting cycles under this framework, which should begin to reveal the practical scale of zero-liability compensation claims and the extent to which banks are successfully or unsuccessfully proving customer negligence under the new burden-of-proof standard.

Consumer Protection & APP Fraud

The Reserve Bank of India has issued draft amendment directions reviewing the 2017 customer-liability-limitation framework that governs how losses from unauthorised electronic-banking transactions are allocated between customers and institutions. The review is a direct response to a shift in the dominant fraud typology: where the 2017 framework was designed primarily around system-level vulnerabilities and unauthorised access, the current fraud environment is increasingly driven by social-engineering techniques that induce customers to authorise payments themselves — authorised-push-payment fraud, in the terminology used elsewhere in this monitor's coverage.

This is a probable rather than confirmed development in terms of its eventual final shape, since the directions remain in draft form, but the direction of travel — toward a liability framework better calibrated to social-engineering-driven fraud rather than purely system-vulnerability-driven fraud — is a clear signal about where Indian consumer-protection policy in payments is heading.

Outlook

Whether the draft amendment directions are finalised, and in what form the revised customer-liability allocation ultimately lands, is the key marker to track. The shift in underlying fraud typology that is driving this review is itself a durable structural trend rather than a one-off anomaly, suggesting further consumer-protection policy attention in this area is likely regardless of the specific final shape these directions take.

Consumer Protection & APP Fraud

The Reserve Bank of India's digital-fraud compensation framework, assessed at probable confidence from a lower-tier source this cycle, requires zero-liability compensation for unauthorised digital transactions where the customer reports promptly and was not negligent. Critically, the burden of proving negligence rests with the bank rather than the customer, a material consumer-protection tightening that shifts the evidentiary burden away from the party with less visibility into the transaction's authentication chain.

The operational mechanics attached to this framework require banks to issue provisional credit to affected customers within prescribed timelines, ensuring consumers are not left without access to disputed funds while a fraud investigation proceeds, and to report aggregate fraud-compensation data to RBI on a quarterly basis. This quarterly reporting obligation gives RBI a standing data feed on the scale of digital-fraud compensation across the banking sector, which could in later cycles support more granular supervisory or policy responses to APP-fraud trends.

This framework applies specifically to the bank/PSP population handling digital transactions, distinct from the non-bank PI/EMI-focused obligations formalised in the same cycle's payment aggregator directions, reflecting the different points in the payment chain at which liability and compensation obligations naturally attach. The lower source-tier basis for this framework's specifics -- relative to the payment aggregator directions material sourced more directly to RBI's own circular index -- means the precise operational parameters merit confirmation against RBI's own published framework text in a future cycle.

Outlook

Watch for the first quarterly aggregate fraud-compensation reports banks submit to RBI under this framework, which would provide the first empirical measure of the scheme's practical scale and effectiveness. Given the probable-confidence, lower-tier sourcing basis for this cycle's finding, a direct RBI primary-source retrieval in a subsequent cycle would materially strengthen confidence in the framework's exact operational parameters.

Commercial Intelligence & Fintech

India's fintech sector produced two notable discrete commercial events this cycle, set against a backdrop of overall sector funding growth alongside declining deal volume. Tracxn's nine-month 2026 report shows Indian fintech companies raised approximately 2.2 billion dollars across the January-to-September period, up 14 percent on the 1.9 billion dollars raised over the same period in 2025, even as the number of completed rounds fell sharply year on year.

The largest single funding event of the period was CRED's 540 million dollar round, one of five mega-rounds that together accounted for roughly 48 percent of all capital raised across the nine-month window. On the acquisition side, Indiabulls Group completed the purchase of Fintech Cloud for 110 million dollars, reported as the largest fintech acquisition of the nine-month period. Both figures are disclosed amounts drawn from vendor analytics reported through quality press rather than from primary deal filings independently verified this cycle.

The pattern these two events illustrate, a small number of large transactions accounting for a disproportionate share of total sector activity, is a discrete commercial-intelligence signal distinct from any structural market-concentration thesis: it describes what happened in specific, named transactions during the period rather than asserting a durable shift in India's fintech industry structure.

Outlook

Future cycles should watch for confirmation of deal terms and strategic rationale behind the Indiabulls Group acquisition of Fintech Cloud, and for whether the funding concentration pattern, a small number of mega-rounds dominating total capital raised, persists or reverses as further 2026 data becomes available.