India

Licensing, Authorisation & Market Access

The Reserve Bank of India's consolidated Regulation of Payment Aggregators Directions, 2025, effective 15 September 2025, rationalises and repeals what had previously been three separate regulatory frameworks — the 2020 and 2021 PA-PG Guidelines and the 2023 cross-border payment-aggregator framework — into a single directions document. The consolidated framework establishes three distinct licensing categories: PA-Online, PA-Cross-Border and PA-Physical, replacing what had been a fragmented, incrementally-built licensing architecture with a single coherent instrument.

The consolidation carries substantive compliance consequences with hard deadlines. PA-P entities that did not submit an authorisation application to the RBI by 31 December 2025 are required to wind up their PA-P operations entirely by 28 February 2026 — a genuine market-exit consequence for non-compliant entities, not merely a procedural lapse. Separately, payment aggregators were given an extended customer-due-diligence remediation timeline running to 15 September 2026 for merchants that had been onboarded before 31 December 2025, reflecting a rolling compliance window built into the same 2025 Directions rather than a new, unrelated obligation.

Taken together, these developments mark a maturing, more prescriptive supervisory posture for India's payment-service-provider sector. The consolidation itself is a structural simplification, but the accompanying deadlines — a hard wind-up date for non-compliant PA-P entities and a rolling merchant-KYC remediation timeline — indicate that the RBI is treating the new framework as an enforceable compliance architecture rather than a restatement of existing practice. Non-bank payment institutions and e-money institutions bear the primary compliance burden of this consolidation, distinct from bank-operated payment aggregators, which sit within existing prudential supervision.

Outlook

The 28 February 2026 PA-P wind-up deadline and the 15 September 2026 extended CDD remediation deadline are the two concrete compliance markers to track through the remainder of this cycle and into early 2026. Both are confirmed, dated obligations under the same 2025 Directions rather than open proposals, and non-compliance carries a genuine market-access consequence for affected payment aggregators.

Licensing, Authorisation & Market Access

The Reserve Bank of India's Draft Master Direction on Prepaid Payment Instruments, 2026 tightens governance requirements for non-bank PPI issuers, mandating fit-and-proper promoter and director criteria and bringing PPI customer onboarding directly within the RBI's own KYC framework rather than leaving it to issuer-level policy. This consolidates non-bank payment regulation under a same-activity, same-risk, same-regulation principle, narrowing the gap between how banks and non-bank prepaid-instrument issuers are governed. The direction remains in draft form, so its final scope and effective date are not yet settled, and this assessment is probable rather than confirmed.

Separately, the Payment Aggregator authorisation regime under the Payment and Settlement Systems Act 2007 continues without material change: more than 60 entities hold in-principle or final RBI Payment Aggregator authorisation as of 2026, and the net-worth threshold for that category remains at ₹15-25 crore. This is a distinct authorisation category from PPI issuance and from banking licensure, and its continuity this cycle indicates a stable, if still-maturing, market-access structure for payment aggregation specifically, even as the PPI governance standard is being actively raised.

The bank-versus-non-bank distinction is material here: the PPI tightening applies specifically to non-bank PI/EMI issuers, since banks are already subject to RBI's banking-license-level KYC and governance standards. The effect of the Draft Master Direction, if finalised as proposed, would be to narrow rather than eliminate this bank/non-bank regulatory gap.

Outlook

The key near-term development to track is whether the Draft Master Direction is finalised in its current form, amended following industry consultation, or delayed. Any change to the promoter fit-and-proper criteria or the KYC-integration requirement between draft and final stage would materially affect non-bank PPI issuers' market-access planning.

Licensing, Authorisation & Market Access

The Reserve Bank of India's rewritten Payment Aggregator Directions, reference RBI/DPSS/2025-26/141 and notified 15 September 2025, constitute a confirmed, high-impact, comprehensive rewrite of the licensing and market-access framework for payment aggregators in India. The central structural innovation is the introduction of an Offline PA category for the first time, bringing offline-context payment aggregation into an authorisation regime that had previously applied only to online aggregation. The directions explicitly repeal the prior 2020 intermediary-transactions circular except for decisions already pending authorisation, a confirmed finding that establishes a clean regulatory handover rather than an overlapping dual regime.

The new framework carries distinct compliance timelines for different aggregator sub-categories. Existing offline PAs were required to apply for RBI authorisation by 31 December 2025, a probable-confidence deadline; critically, this leeway is not available for merchants onboarded after 1 January 2026, who face the new requirements immediately upon onboarding rather than benefiting from any transition window. This bifurcation means firms operating offline-PA business lines must track two distinct compliance populations -- pre-existing merchants under a grace period, and new merchants under immediate compliance -- within the same regulatory category.

Cross-border payment aggregators (PA-CBs) see a combined liberalisation and tightening. Their permissible scope is liberalised: PA-CBs may now process any permissible current-account transaction under FEMA, rather than being restricted to trade transactions alone, a probable-confidence expansion of their addressable business. This liberalisation is paired with a new INR 25 crore net-worth requirement, due by 31 March 2026, meaning the broadened scope of permissible activity is conditioned on a materially higher capital base than may have previously applied to smaller cross-border aggregators. Separately, non-bank payment aggregators, including the newly created offline PA-P category, are confirmed as PMLA reporting entities that must register with FIU-IND, carrying this finding through from the AML-adjacent scope of the same directions rather than from original AML analysis produced here.

Throughout this framework, the distinction between bank-affiliated PSPs and non-bank payment institution/e-money-institution aggregators remains operationally significant: the net-worth threshold, authorisation deadlines and PMLA registration obligations bear most directly on the non-bank PI/EMI population, which had previously operated under lighter-touch oversight relative to bank-affiliated payment processors.

Outlook

The compliance calendar is front-loaded through the first three quarters of the 2025-26 to 2026-27 window: the offline-PA authorisation deadline of 31 December 2025 has already passed, an extended merchant-CDD compliance deadline runs to 15 September 2026 for merchants onboarded before 31 December 2025, and the PA-CB net-worth threshold falls due 31 March 2026. Supervisory attention through this period is likely to concentrate on authorisation-status verification for offline PAs and net-worth compliance for cross-border aggregators. Watch for RBI guidance clarifying the merchant-CDD extended-deadline population and for any enforcement action against aggregators that miss the passed 31 December 2025 offline-PA authorisation deadline.

Conduct, Safeguarding & Financial Promotions

This cycle's most consequential conduct-side development for the Indian payments industry is direct and confirmed at the highest source tier: banks and financial institutions that promote or facilitate financial transactions for online money gaming will be guilty of an offence, effective from 1 May 2026. This statement, made explicitly by the government, converts what had previously been an indirect exposure for the payments industry into a direct criminal-liability standard tied to a specific prohibited activity.

The Online Gaming Rules, 2026 operationalise this penal-liability announcement into a concrete transaction-blocking mechanism: a designated authority is empowered to instruct banks and payment service providers to halt transactions linked to specified games, with penalties attaching to delayed compliance. This is a confirmed, though Tier 2-sourced, development that gives the conduct obligation an enforceable operational form rather than leaving it as a general prohibition. Both banks and non-bank payment service providers fall within scope of this obligation, a rare instance where the conduct standard is deliberately drawn across the bank/non-bank line rather than differentiated by institution type.

A further, less-corroborated development concerns merchant-category-code tagging: reporting sourced only at a low evidentiary tier indicates a designated authority mandated a unique gaming merchant-category code for UPI-based gaming transactions specifically to enable real-time monitoring and deposit-limit enforcement. This remains an uncertain finding pending stronger-tier corroboration, and should be read as a plausible but unconfirmed elaboration of the broader transaction-blocking framework rather than a settled fact.

Outlook

The practical enforcement pattern under the new penal-liability regime, and specifically whether and how often the designated authority exercises its transaction-blocking power against banks or PSPs, is the central indicator to watch through the remainder of 2026. Independent corroboration of the gaming merchant-category-code mandate would also be a significant confirming development if it emerges.

Conduct, Safeguarding & Financial Promotions

The 2025 Payment Aggregator Directions impose a confirmed, high-impact conduct and safeguarding obligation on all payment aggregators operating in India: a board-approved dispute-resolution policy with clear refund timelines is now mandatory, alongside maintenance of PCI-DSS/PA-DSS data-security standards. This combines a customer-facing conduct requirement -- ensuring merchants and consumers have a defined, governed path to dispute resolution and refunds -- with a technical data-security baseline that aggregators must demonstrably maintain rather than merely aspire to.

The safeguarding mechanism specified is procedural rather than a discrete asset-segregation rule: the requirement centres on the board-approved policy itself and the underlying PCI-DSS/PA-DSS compliance posture, rather than, for example, a specific customer-funds-segregation mechanism of the kind seen in some other jurisdictions' payment-institution safeguarding regimes. Security-incident reporting is bound to this same conduct framework: aggregators must report security incidents to RBI within stipulated timeframes, including a monthly cyber-incident reporting cadence, meaning conduct obligations and operational-security obligations are woven together in the same directive rather than sitting in separate regulatory tracks.

This conduct and safeguarding tightening applies across the newly authorised online, offline and cross-border aggregator categories established by the same directions, meaning the non-bank PI/EMI population bears the primary weight of these new board-governance and data-security obligations, consistent with the directions' overall focus on non-bank aggregator oversight rather than bank-affiliated PSP conduct specifically.

Outlook

Watch for RBI supervisory guidance detailing the specific stipulated timeframes for security-incident reporting beyond the monthly cyber-incident cadence already specified, and for any published enforcement action addressing aggregators found not to have implemented a board-approved dispute-resolution policy. As the broader PA Directions rewrite beds in through 2026, conduct-related supervisory findings are likely to surface alongside the authorisation and net-worth compliance actions tracked under the licensing module.

Operational Resilience & Critical Infrastructure

The 2025 Payment Aggregator Directions formalise a confirmed operational-resilience obligation requiring payment aggregators to present reports on risk assessment, security-compliance posture, security audits and incidents to their board, and to report the same to RBI. This sits alongside the confirmed PCI-DSS/PA-DSS data-security standard and the monthly cyber-incident reporting cadence carried within the same directions, together constituting a materially strengthened operational-resilience framework for the payment-aggregator sector relative to the prior 2020 regime.

The structural significance of formalising board-level presentation of security and risk-assessment reporting is that it embeds operational-resilience accountability at governance level rather than leaving it purely as a technical-compliance function reporting only to management. Combined with the monthly cyber-incident reporting obligation to RBI, this creates a dual accountability channel -- internal board oversight and external regulatory reporting -- operating on overlapping but distinct cadences.

This resilience obligation applies to the newly authorised online, offline and cross-border aggregator categories alike, meaning the non-bank PI/EMI population that dominates the payment-aggregator sector in India now faces board-governance and regulatory-reporting obligations for operational resilience that more closely approach, though do not necessarily match, the standards historically expected of bank-affiliated payment infrastructure.

Outlook

Watch for the first cycle of monthly cyber-incident reports to RBI under the new framework, and for any RBI commentary on aggregate incident volumes or patterns across the newly regulated offline-PA population, which entered the authorisation regime for the first time this cycle. Any high-profile security incident at a payment aggregator in the coming cycles would be the first real test of whether the board-reporting and RBI-notification cadence functions as intended under the new directions.

Product Innovation & Market Development

The Reserve Bank of India's FY2025-26 Annual Report signals a deliberate expansion of its central bank digital currency programme. The Report states RBI will explore bilateral and multilateral cross-border CBDC pilots during FY2026-27, extending the e-Rupee programme beyond its current domestic pilot footprint into cross-border settlement use cases. Domestically, the Report also signals a widening of existing CBDC pilots into direct-benefit-transfer and business-application use cases, broadening the programme's functional scope beyond its initial retail and wholesale pilot design.

Separately, and on thinner sourcing, RBI is reported to have launched a deposit-tokenisation pilot around October 2025 using its Unified Markets Interface, applying blockchain-based settlement to tokenised Certificates of Deposit. This pilot, if confirmed by further reporting, would represent a distinct product-innovation track from the e-Rupee CBDC programme, applying distributed-ledger settlement mechanics to an existing wholesale-market instrument rather than to a sovereign digital currency. Both developments sit within the bank/PSP side of India's payments infrastructure, reflecting RBI's own central-bank-led experimentation rather than non-bank product innovation.

Outlook

Watch for RBI's FY2026-27 activity on cross-border CBDC pilots as the most concrete near-term marker of this programme's direction, and for any further confirmation or expansion of the deposit-tokenisation pilot beyond its October 2025 launch, which currently rests on a single lower-tier source.

Product Innovation & Market Development

The Reserve Bank of India's 2025-26 Annual Report commits to a substantial expansion of e-rupee central-bank-digital-currency experimentation during 2026-27. The programme spans cross-border bilateral and multilateral CBDC pilots, asset tokenisation experimentation via the Unified Multi-Ledger Infrastructure, programmable-money direct-benefit-transfer pilots running in Gujarat, Puducherry and Chandigarh, and a digital-assets cooperation pact with the Monetary Authority of Singapore. This is a confirmed institutional commitment rather than a speculative proposal, reflecting the RBI's stated annual-report-level prioritisation of CBDC development.

The breadth of this programme — spanning cross-border settlement, asset tokenisation, and domestic social-transfer programmability — signals that the RBI regards the e-rupee as its primary vehicle for digital-money innovation, in preference to accommodating private stablecoin issuance. The digital-assets pact with Singapore's Monetary Authority is notable as an early instance of India pursuing bilateral digital-currency cooperation with another major Asian financial centre, extending the CBDC programme's ambition beyond purely domestic use cases.

Outlook

The pace and results of the Gujarat, Puducherry and Chandigarh programmable-money pilots, and the concrete shape the MAS cooperation pact takes in practice, are the two most consequential near-term markers for assessing whether this expanded CBDC programme translates into deployed product rather than continued pilot-stage experimentation.

Consumer Protection & APP Fraud

India's digital-fraud compensation framework now places the burden of proving customer negligence on banks and payment service providers rather than on the customer. Under this framework, customers who report unauthorised digital transactions promptly and are not shown to have been negligent are entitled to zero-liability compensation, reversing what would otherwise be a burden-of-proof default falling on the consumer to demonstrate they were not at fault. Banks and PSPs are additionally required to submit quarterly aggregate reporting to RBI on these compensation outcomes, creating a supervisory data trail on how frequently unauthorised-transaction claims arise and how they are resolved.

This burden-shift is a significant consumer-protection development for a market where digital-payment fraud volumes are substantial, and it applies specifically to the bank/PSP side of the payments ecosystem rather than to non-bank payment institutions, reinforcing the bank-versus-non-bank distinction that runs through this cycle's other India developments.

Outlook

Watch for the first quarterly aggregate reporting cycles under this framework, which should begin to reveal the practical scale of zero-liability compensation claims and the extent to which banks are successfully or unsuccessfully proving customer negligence under the new burden-of-proof standard.

Consumer Protection & APP Fraud

The Reserve Bank of India has issued draft amendment directions reviewing the 2017 customer-liability-limitation framework that governs how losses from unauthorised electronic-banking transactions are allocated between customers and institutions. The review is a direct response to a shift in the dominant fraud typology: where the 2017 framework was designed primarily around system-level vulnerabilities and unauthorised access, the current fraud environment is increasingly driven by social-engineering techniques that induce customers to authorise payments themselves — authorised-push-payment fraud, in the terminology used elsewhere in this monitor's coverage.

This is a probable rather than confirmed development in terms of its eventual final shape, since the directions remain in draft form, but the direction of travel — toward a liability framework better calibrated to social-engineering-driven fraud rather than purely system-vulnerability-driven fraud — is a clear signal about where Indian consumer-protection policy in payments is heading.

Outlook

Whether the draft amendment directions are finalised, and in what form the revised customer-liability allocation ultimately lands, is the key marker to track. The shift in underlying fraud typology that is driving this review is itself a durable structural trend rather than a one-off anomaly, suggesting further consumer-protection policy attention in this area is likely regardless of the specific final shape these directions take.

Consumer Protection & APP Fraud

The Reserve Bank of India's digital-fraud compensation framework, assessed at probable confidence from a lower-tier source this cycle, requires zero-liability compensation for unauthorised digital transactions where the customer reports promptly and was not negligent. Critically, the burden of proving negligence rests with the bank rather than the customer, a material consumer-protection tightening that shifts the evidentiary burden away from the party with less visibility into the transaction's authentication chain.

The operational mechanics attached to this framework require banks to issue provisional credit to affected customers within prescribed timelines, ensuring consumers are not left without access to disputed funds while a fraud investigation proceeds, and to report aggregate fraud-compensation data to RBI on a quarterly basis. This quarterly reporting obligation gives RBI a standing data feed on the scale of digital-fraud compensation across the banking sector, which could in later cycles support more granular supervisory or policy responses to APP-fraud trends.

This framework applies specifically to the bank/PSP population handling digital transactions, distinct from the non-bank PI/EMI-focused obligations formalised in the same cycle's payment aggregator directions, reflecting the different points in the payment chain at which liability and compensation obligations naturally attach. The lower source-tier basis for this framework's specifics -- relative to the payment aggregator directions material sourced more directly to RBI's own circular index -- means the precise operational parameters merit confirmation against RBI's own published framework text in a future cycle.

Outlook

Watch for the first quarterly aggregate fraud-compensation reports banks submit to RBI under this framework, which would provide the first empirical measure of the scheme's practical scale and effectiveness. Given the probable-confidence, lower-tier sourcing basis for this cycle's finding, a direct RBI primary-source retrieval in a subsequent cycle would materially strengthen confidence in the framework's exact operational parameters.