India

Licensing, Authorisation & Market Access

The Reserve Bank of India's rewritten Payment Aggregator Directions, reference RBI/DPSS/2025-26/141 and notified 15 September 2025, constitute a confirmed, high-impact, comprehensive rewrite of the licensing and market-access framework for payment aggregators in India. The central structural innovation is the introduction of an Offline PA category for the first time, bringing offline-context payment aggregation into an authorisation regime that had previously applied only to online aggregation. The directions explicitly repeal the prior 2020 intermediary-transactions circular except for decisions already pending authorisation, a confirmed finding that establishes a clean regulatory handover rather than an overlapping dual regime.

The new framework carries distinct compliance timelines for different aggregator sub-categories. Existing offline PAs were required to apply for RBI authorisation by 31 December 2025, a probable-confidence deadline; critically, this leeway is not available for merchants onboarded after 1 January 2026, who face the new requirements immediately upon onboarding rather than benefiting from any transition window. This bifurcation means firms operating offline-PA business lines must track two distinct compliance populations -- pre-existing merchants under a grace period, and new merchants under immediate compliance -- within the same regulatory category.

Cross-border payment aggregators (PA-CBs) see a combined liberalisation and tightening. Their permissible scope is liberalised: PA-CBs may now process any permissible current-account transaction under FEMA, rather than being restricted to trade transactions alone, a probable-confidence expansion of their addressable business. This liberalisation is paired with a new INR 25 crore net-worth requirement, due by 31 March 2026, meaning the broadened scope of permissible activity is conditioned on a materially higher capital base than may have previously applied to smaller cross-border aggregators. Separately, non-bank payment aggregators, including the newly created offline PA-P category, are confirmed as PMLA reporting entities that must register with FIU-IND, carrying this finding through from the AML-adjacent scope of the same directions rather than from original AML analysis produced here.

Throughout this framework, the distinction between bank-affiliated PSPs and non-bank payment institution/e-money-institution aggregators remains operationally significant: the net-worth threshold, authorisation deadlines and PMLA registration obligations bear most directly on the non-bank PI/EMI population, which had previously operated under lighter-touch oversight relative to bank-affiliated payment processors.

Outlook

The compliance calendar is front-loaded through the first three quarters of the 2025-26 to 2026-27 window: the offline-PA authorisation deadline of 31 December 2025 has already passed, an extended merchant-CDD compliance deadline runs to 15 September 2026 for merchants onboarded before 31 December 2025, and the PA-CB net-worth threshold falls due 31 March 2026. Supervisory attention through this period is likely to concentrate on authorisation-status verification for offline PAs and net-worth compliance for cross-border aggregators. Watch for RBI guidance clarifying the merchant-CDD extended-deadline population and for any enforcement action against aggregators that miss the passed 31 December 2025 offline-PA authorisation deadline.

Conduct, Safeguarding & Financial Promotions

The 2025 Payment Aggregator Directions impose a confirmed, high-impact conduct and safeguarding obligation on all payment aggregators operating in India: a board-approved dispute-resolution policy with clear refund timelines is now mandatory, alongside maintenance of PCI-DSS/PA-DSS data-security standards. This combines a customer-facing conduct requirement -- ensuring merchants and consumers have a defined, governed path to dispute resolution and refunds -- with a technical data-security baseline that aggregators must demonstrably maintain rather than merely aspire to.

The safeguarding mechanism specified is procedural rather than a discrete asset-segregation rule: the requirement centres on the board-approved policy itself and the underlying PCI-DSS/PA-DSS compliance posture, rather than, for example, a specific customer-funds-segregation mechanism of the kind seen in some other jurisdictions' payment-institution safeguarding regimes. Security-incident reporting is bound to this same conduct framework: aggregators must report security incidents to RBI within stipulated timeframes, including a monthly cyber-incident reporting cadence, meaning conduct obligations and operational-security obligations are woven together in the same directive rather than sitting in separate regulatory tracks.

This conduct and safeguarding tightening applies across the newly authorised online, offline and cross-border aggregator categories established by the same directions, meaning the non-bank PI/EMI population bears the primary weight of these new board-governance and data-security obligations, consistent with the directions' overall focus on non-bank aggregator oversight rather than bank-affiliated PSP conduct specifically.

Outlook

Watch for RBI supervisory guidance detailing the specific stipulated timeframes for security-incident reporting beyond the monthly cyber-incident cadence already specified, and for any published enforcement action addressing aggregators found not to have implemented a board-approved dispute-resolution policy. As the broader PA Directions rewrite beds in through 2026, conduct-related supervisory findings are likely to surface alongside the authorisation and net-worth compliance actions tracked under the licensing module.

Operational Resilience & Critical Infrastructure

The 2025 Payment Aggregator Directions formalise a confirmed operational-resilience obligation requiring payment aggregators to present reports on risk assessment, security-compliance posture, security audits and incidents to their board, and to report the same to RBI. This sits alongside the confirmed PCI-DSS/PA-DSS data-security standard and the monthly cyber-incident reporting cadence carried within the same directions, together constituting a materially strengthened operational-resilience framework for the payment-aggregator sector relative to the prior 2020 regime.

The structural significance of formalising board-level presentation of security and risk-assessment reporting is that it embeds operational-resilience accountability at governance level rather than leaving it purely as a technical-compliance function reporting only to management. Combined with the monthly cyber-incident reporting obligation to RBI, this creates a dual accountability channel -- internal board oversight and external regulatory reporting -- operating on overlapping but distinct cadences.

This resilience obligation applies to the newly authorised online, offline and cross-border aggregator categories alike, meaning the non-bank PI/EMI population that dominates the payment-aggregator sector in India now faces board-governance and regulatory-reporting obligations for operational resilience that more closely approach, though do not necessarily match, the standards historically expected of bank-affiliated payment infrastructure.

Outlook

Watch for the first cycle of monthly cyber-incident reports to RBI under the new framework, and for any RBI commentary on aggregate incident volumes or patterns across the newly regulated offline-PA population, which entered the authorisation regime for the first time this cycle. Any high-profile security incident at a payment aggregator in the coming cycles would be the first real test of whether the board-reporting and RBI-notification cadence functions as intended under the new directions.

Consumer Protection & APP Fraud

The Reserve Bank of India's digital-fraud compensation framework, assessed at probable confidence from a lower-tier source this cycle, requires zero-liability compensation for unauthorised digital transactions where the customer reports promptly and was not negligent. Critically, the burden of proving negligence rests with the bank rather than the customer, a material consumer-protection tightening that shifts the evidentiary burden away from the party with less visibility into the transaction's authentication chain.

The operational mechanics attached to this framework require banks to issue provisional credit to affected customers within prescribed timelines, ensuring consumers are not left without access to disputed funds while a fraud investigation proceeds, and to report aggregate fraud-compensation data to RBI on a quarterly basis. This quarterly reporting obligation gives RBI a standing data feed on the scale of digital-fraud compensation across the banking sector, which could in later cycles support more granular supervisory or policy responses to APP-fraud trends.

This framework applies specifically to the bank/PSP population handling digital transactions, distinct from the non-bank PI/EMI-focused obligations formalised in the same cycle's payment aggregator directions, reflecting the different points in the payment chain at which liability and compensation obligations naturally attach. The lower source-tier basis for this framework's specifics -- relative to the payment aggregator directions material sourced more directly to RBI's own circular index -- means the precise operational parameters merit confirmation against RBI's own published framework text in a future cycle.

Outlook

Watch for the first quarterly aggregate fraud-compensation reports banks submit to RBI under this framework, which would provide the first empirical measure of the scheme's practical scale and effectiveness. Given the probable-confidence, lower-tier sourcing basis for this cycle's finding, a direct RBI primary-source retrieval in a subsequent cycle would materially strengthen confidence in the framework's exact operational parameters.