title: India Payments Regulation Monitor | World Payments Monitor canonical: https://payments.gi/jurisdictions/india/ date_modified: 2026-10-21 publisher: Asymmetric Intelligence # India IN schema world-payments-v1 trajectory: not yet assessed Last updated 2026-10-21 · 14 modules · 61 sourced findings · 131 sources in the cumulative register 14 Modules baseline.modules[] 61 Findings modules[].findings[] 12 Tier-1 sources run_metadata.t1_source_count Confidence mix (sums to 14 rendered modules; click to filter) No modules moved this cycle. ## Jurisdiction brief ###### Latest update · 18 October 2026 #### Lead Signal India's dominant payments story this cycle is the deferral of the merchant discount rate planned for the Unified Payments Interface. The National Payments Corporation of India had set a 0.4 percent merchant discount rate on person-to-merchant UPI payments above Rs2,000, capped at Rs300 for transactions at Rs75,000 and above, with a flat Rs5 fee for railways, telecom, insurance and fuel payments, a reduced 0.02 percent rate for capital-market payments, and no charge for peer-to-peer transfers or small merchants processing Rs1 lakh or less per month. The rule was enabled by a Gazette notification of 14 September 2026 amending section 10A of the Payment and Settlement Systems Act, 2007, and was due to take effect on 15 October 2026. On 13 October 2026, two days before go-live, the scheme deferred implementation to a date after Diwali, with no new date yet set, following public and political pushback; the Finance Ministry has denied that the deferral reflects external pressure. #### Other Developments **India fintech funding and M&A concentration.** Tracxn data reported through quality press shows Indian fintech companies raised approximately 2.2 billion dollars across the first nine months of 2026, up 14 percent on the same period in 2025, even as deal count fell sharply. Five mega-rounds accounted for roughly 48 percent of all capital raised, with CRED's 540 million dollar round the single largest of the period. The period's largest fintech acquisition was Indiabulls Group's 110 million dollar purchase of Fintech Cloud. #### Cross-Monitor Connections The UPI merchant discount rate deferral has an illicit-finance dimension that sits with financial-integrity monitoring rather than with this brief: any shift in merchant-side cost structures on India's dominant retail payment rail could, in principle, affect merchant onboarding incentives and informal-sector payment routing, a question for financial-integrity analysis rather than a payments-structure conclusion drawn here. The fintech funding and acquisition pattern reported this cycle, including a regtech-oriented acquisition by Indiabulls Group, is also a point of potential interest to financial-integrity trackers following beneficial-ownership and control concentration in payment-adjacent technology providers. #### Outlook The central near-term question is when, and on what revised terms, the National Payments Corporation of India will relaunch the merchant discount rate go-live. The underlying scheme rule and its enabling statutory amendment to the Payment and Settlement Systems Act remain in place even though implementation has been deferred, so the structural change itself has not been reversed, only its timing. A future cycle should watch for a post-Diwali circular confirming a new go-live date, and for any adjustment to the rate structure made in response to the public and political pushback that prompted the deferral. _5 earlier updates not shown here._ ###### Standing brief · as of 27 June 2026 _Written before the update above. Where they differ, the update is the more recent position._ #### Lead Signal This cycle establishes the full India (IN) payments baseline across all fourteen modules of the spine, and the defining feature is unambiguous: India operates a uniquely state-rail-centric payments architecture in which the Reserve Bank of India is simultaneously the authorising authority, the settlement operator, and the conduct supervisor. UPI handles roughly 86% of India's digital transaction volume, processing more than 23 billion payments per month at around INR30 lakh crore. That volume runs on rails where merchant discount revenue has been statutorily zero since January 2020 for RuPay debit cards and BHIM-UPI, under Section 10A of the PSS Act and Section 269SU of the Income-tax Act, funded instead by a government incentive scheme paid to acquiring banks. The architecture is CBDC-led rather than stablecoin-permissive: the Digital Rupee retail and wholesale pilots are live, while RBI advocates prioritising central bank digital currency over privately issued stablecoins and maintains no in-force stablecoin framework. This concentration of public infrastructure power is the structural fact distinguishing India from the EU, UK and US payments markets. The live commercial tension running through that architecture is the funding gap. The government incentive scheme is assessed to cover only around 11% of industry cost, leaving PSPs and banks to absorb the remainder, and in 2026 a parliamentary Finance Committee is pushing to reintroduce MDR on large UPI merchants, citing precisely that shortfall. Credit cards carry no regulatory MDR cap, and a roughly 1.1% interchange applies to PPI-routed UPI merchant transactions over INR2,000, but the zero-MDR core remains the single highest-probability source of material change across the 2026-27 horizon. RBI separately caps debit-card MDR at up to 0.90% and NPCI caps UPI P2M MDR at up to 0.30%, framing where any reintroduced pricing could land. #### Other Developments The licensing perimeter has settled into operation. The RBI (Regulation of Payment Aggregators) Directions, 2025, issued 15 September 2025 and effective immediately, require non-bank payment aggregators to obtain RBI authorisation under the PSS Act, with INR15cr net worth at application rising to INR25cr by the end of the third financial year, escrow-only settlement, and Companies Act 2013 incorporation. As of June 2026 the transition period has closed, with the PA-P wind-up deadline having passed on 28 February 2026; the regime is now roughly nine months operative and fully in force, gating market access for over 60 authorised PA entities and structurally separating aggregators that touch the money from gateways that handle data only. On conduct and safeguarding, the draft PPI Master Direction 2026, released 22 April 2026 with comments closing 22 May 2026, would add codified fit-and-proper criteria, multilingual disclosure, nodal-officer grievance redress and co-branding liability rules atop India's mandatory single-bank INR escrow safeguarding model. That model — segregated escrow with a day-end balance floor not below outstanding PPI liabilities and acquirer dues, quarterly statutory-auditor certification, and designated-payment-system status under Section 23A(3) of the PSS Act — contrasts sharply with the EU/UK segregation-plus-insurance approach. The final Master Direction remains pending. Consumer protection is moving on a near-term clock. Draft Third Amendment Directions 2026, proposed 6 March 2026 and effective 1 July 2026, would give a customer suffering genuine fraud loss up to INR50,000 either 85% of net loss or up to INR25,000, whichever is lower, once per lifetime, at commercial banks, reported within five days — with RBI bearing roughly 65% of cost and the remainder split between sending and receiving banks. This capped, once-per-lifetime, central-bank-funded design is structurally divergent from the UK FSMA 2023 / PSR model of full reimbursement up to GBP85,000 split 50:50 between PSPs with no central-bank role. Market structure is shifting beneath the regulation. PhonePe (46.2%) and Google Pay (32.7%) combined fell to around 79% in May 2026 — the first time below 80% — as challengers including Navi, Flipkart's super.money, BHIM and WhatsApp Pay gain ground, while Amazon and Meta have joined lobbying over duopoly dominance. NPCI's proposed 30% per-app volume cap has been deferred to 31 December 2026. On the legal front, a 2026 RBI Ombudsman order shifted liability onto banks whose receiving-side KYC, AML and transaction-monitoring systems failed, departing from the prior contributory-negligence OTP-disclosure defence — a material precedent for fraud-loss allocation. #### Cross-Monitor Connections Cross-border UPI activity is the principal cross-monitor surface this cycle. The UPI-PayNow linkage, launched February 2025 and expanded to 19 participating Indian banks, is a real-time India-Singapore remittance corridor governed by FEMA under the LRS limit; separately, UPI merchant acceptance is live in eight-plus countries, and RBI has joined BIS Project Nexus. These corridors create FEMA and FATF-list interaction risk and sanctions/illicit-finance exposure that is routed to the Financial Intelligence Monitor rather than concluded here. The Sentinel-fed W11 picture supports this: per the FATF September 2024 Mutual Evaluation Report, India is compliant or largely compliant on 37 of 40 Recommendations and sits in regular follow-up, but rates only moderate on AML/CFT supervision effectiveness, with FATF finding penalties on financial institutions generally not proportionate or dissuasive. Original AML and sanctions analysis on the corridor and supervision surfaces is referred to FIM. #### Outlook The near-term calendar is dense. The APP-fraud compensation scheme takes effect 1 July 2026; the final PPI Master Direction is expected in the second half of 2026; the NPCI 30% per-app cap is nominally due 31 December 2026, though implementation feasibility is uncertain while PhonePe and Google Pay both sit well above the threshold; cross-border CBDC pilots are flagged for 2026-27; and any reintroduction of large-merchant UPI MDR would most plausibly land in 2027. The commercial pipeline reinforces the maturation signal, with Razorpay's confidential IPO filing and a broader listing pipeline accreting against falling fintech deal counts. The throughline is an RBI consolidating authorisation, settlement, consumer protection and digital-currency expansion concurrently, leaving the zero-MDR funding question as the most consequential unresolved variable. trust tier: ai_unverified ###### Latest update · 11 October 2026 #### Regulatory Status India's payment-regulation environment tightened incrementally this period across conduct, product-innovation, and consumer-protection lines. The Reserve Bank of India's phased authentication mandate reached full coverage as the cross-border card-not-present two-factor authentication deadline arrived on 1 October 2026, completing a rollout that began with domestic card-not-present transactions in April 2026 under the Authentication Mechanisms for Digital Payment Transactions Directions, 2025. Separately, the RBI published draft Know Your Customer Amendment Directions, 2026, at consultation stage from 8 October 2026, proposing a standardised AI-flagged, amount-limited debit-hold mechanism for suspected mule-account transactions of one thousand rupees or more, with an expected effective date in the first quarter of 2027. On the product-innovation side, a reported merchant discount rate of 0.4 percent on select UPI merchant payments above two thousand rupees, said to take effect 15 October 2026, would be the first MDR applied to UPI merchant transactions since the scheme's zero-MDR mandate; this finding rests on a single source and is treated as uncertain pending further corroboration. India's UPI scheme continues to maintain a stable cross-border acceptance and remittance footprint across eleven foreign countries, per government factsheet data, with no new corridor launch identified in the current window. #### Outlook The completion of the phased authentication rollout removes a bifurcated compliance timeline between domestic and cross-border card-not-present transactions. The draft mule-account hold mechanism, if finalised substantially as proposed, would formalise currently fragmented bank-level fraud-response practice into a national standard by the first quarter of 2027, pending consultation outcomes. The reported UPI MDR change, if corroborated, would mark a significant shift in scheme economics warranting continued monitoring in subsequent periods. _1 earlier update not shown here._ ###### Standing brief · as of 5 September 2026 _Written before the update above. Where they differ, the update is the more recent position._ #### Regulatory Status India's payment-aggregator regulatory regime underwent its most significant structural overhaul to date this cycle, driven by the Reserve Bank of India's rewritten Payment Aggregator Directions (RBI/DPSS/2025-26/141, notified 15 September 2025). The directions introduce an Offline PA category for the first time, explicitly repeal the prior 2020 intermediary-transactions circular except for pending authorisation decisions, and impose a combined licensing, conduct, data-security and operational-resilience framework across online, offline and cross-border payment-aggregator categories. Existing offline PAs faced an authorisation deadline of 31 December 2025, with no equivalent leeway for merchants onboarded from 1 January 2026 onward. Cross-border payment aggregators gained liberalised scope to process any permissible current-account FEMA transaction, subject to a new INR 25 crore net-worth requirement due 31 March 2026. Non-bank payment aggregators, including the new offline PA-P category, are confirmed as PMLA reporting entities required to register with FIU-IND. Separately, board-approved dispute-resolution policies, PCI-DSS/PA-DSS data-security standards, and monthly cyber-incident reporting are now mandatory for payment aggregators, alongside board-level presentation of risk-assessment and security-audit reporting. On the consumer-protection side, RBI's digital-fraud compensation framework requires zero-liability compensation for unauthorised transactions reported promptly by non-negligent customers, with the bank bearing the burden of proving negligence, alongside provisional-credit and quarterly aggregate fraud-reporting obligations for banks. #### Outlook The compliance calendar through the first three quarters of the 2026 window is dense, with the offline-PA authorisation deadline already passed, an extended merchant-CDD deadline of 15 September 2026, and the PA-CB net-worth threshold due 31 March 2026. A structural coverage gap worth flagging is the absence of any UPI-specific product delta this cycle, despite UPI's dominant position in India's instant-payment landscape -- an under-indexing risk for future cycles to address. 14 of 14 modules Signal Density Selections OR within a group, AND across groups. Press / to search. ### W1a Licensing, Authorisation & Market Access Confirmed confirmed 2026-06-24 RBI's consolidated Payment Aggregator Directions, 2025 (effective 15 Sept 2025) rationalised and repealed the 2020/2021 PA-PG Guidelines and the 2023 cross-border PA framework, creating PA-Online, PA-Cross-Border and PA-Physical categories, with rolling compliance deadlines through 2026. Standing sub-brief · as of 27 June 2026 247 words · last cycle 2026-10-04 #### Licensing, Authorisation & Market Access India's payment-aggregator licensing perimeter has moved from transition into full operation. The RBI (Regulation of Payment Aggregators) Directions, 2025, issued 15 September 2025 and effective immediately, require non-bank payment aggregators to obtain RBI authorisation under the PSS Act, carrying a Payment Aggregator authorisation under Section 7 with no exemption available. The prudential ladder sets net worth at INR15cr at application, rising to INR25cr by the end of the third financial year, alongside escrow-only settlement and Companies Act 2013 incorporation. The bank-PSP versus non-bank distinction is structurally embedded: the Directions apply to both bank and non-bank entities but the authorisation gate and escrow regime separate aggregators that touch customer money — settling via escrow on a T+1 basis — from gateways that handle data only. As of June 2026 the transition period has closed, with the PA-P wind-up deadline having passed on 28 February 2026; the regime is roughly nine months operative and fully in force. It now gates market access for over 60 authorised PA entities, including Razorpay, Pine Labs, Cashfree, Stripe India, Amazon Pay and Google. A caveat applies: the standing baseline initially reads as newly-in-force, but the Directions are mature rather than new. #### Outlook The W1a trajectory is established. With the transition window closed and the authorised-entity cohort settled, the live questions shift from market entry to conduct and prudential maintenance under the adjacent W1b conduct regime. No further immediate licensing change is flagged in the horizon for this module. Periodic update · new data 2026-09-28 #### Licensing, Authorisation & Market Access The Reserve Bank of India's Payment Aggregator Master Directions, 2025 bring offline Payment Aggregators under authorisation for the first time, closing a gap in the licensing perimeter that had previously applied only to online payment aggregation. Offline PAs — those handling point-of-sale acceptance and same-location instrument transactions — must now apply for RBI authorisation, with existing offline PAs required to submit applications by 31 December 2025 or wind down operations entirely by 28 February 2026. This is a scope-widening development rather than a tightening of existing rules: it extends the authorisation perimeter to a category of non-bank payment intermediary that had not previously required it. A parallel development affects the PA-CB (cross-border Payment Aggregator) authorisation category: its permitted scope has been liberalised to cover processing of permissible current-account transactions under FEMA, where it had previously been confined to trade transactions only. This is a market-access widening for cross-border payment aggregators, expanding the transaction types they may lawfully process under their existing authorisation. On the compliance-timeline side, an extended deadline to 15 September 2026 has been granted for merchant customer-due-diligence compliance, but only for merchants onboarded up to 31 December 2025; no equivalent leeway applies to merchants onboarded from 1 January 2026, who face immediate CDD compliance expectations. Non-bank PAs, including the new offline PA-P category, are confirmed as PMLA reporting entities required to register with FIU-IND — an AML-compliance overlap that connects to financial-integrity's coverage of India's reporting-entity architecture but is not analysed further here. Throughout this domain, the bank-versus-non-bank distinction is structurally significant: these authorisation and CDD obligations fall on non-bank payment institutions and e-money institutions, not on banks directly. #### Outlook The two dates to track are 31 December 2025, the offline-PA authorisation application deadline, and 28 February 2026, the wind-down deadline for non-compliant offline PAs. The 15 September 2026 merchant-CDD extended-compliance deadline is the third near-term milestone, after which no further leeway is anticipated for merchants onboarded from 1 January 2026 onward. **3 earlier distinct update(s)** Periodic update · new data 2026-09-22 #### Licensing, Authorisation & Market Access The Reserve Bank of India's consolidated Regulation of Payment Aggregators Directions, 2025, effective 15 September 2025, rationalises and repeals what had previously been three separate regulatory frameworks — the 2020 and 2021 PA-PG Guidelines and the 2023 cross-border payment-aggregator framework — into a single directions document. The consolidated framework establishes three distinct licensing categories: PA-Online, PA-Cross-Border and PA-Physical, replacing what had been a fragmented, incrementally-built licensing architecture with a single coherent instrument. The consolidation carries substantive compliance consequences with hard deadlines. PA-P entities that did not submit an authorisation application to the RBI by 31 December 2025 are required to wind up their PA-P operations entirely by 28 February 2026 — a genuine market-exit consequence for non-compliant entities, not merely a procedural lapse. Separately, payment aggregators were given an extended customer-due-diligence remediation timeline running to 15 September 2026 for merchants that had been onboarded before 31 December 2025, reflecting a rolling compliance window built into the same 2025 Directions rather than a new, unrelated obligation. Taken together, these developments mark a maturing, more prescriptive supervisory posture for India's payment-service-provider sector. The consolidation itself is a structural simplification, but the accompanying deadlines — a hard wind-up date for non-compliant PA-P entities and a rolling merchant-KYC remediation timeline — indicate that the RBI is treating the new framework as an enforceable compliance architecture rather than a restatement of existing practice. Non-bank payment institutions and e-money institutions bear the primary compliance burden of this consolidation, distinct from bank-operated payment aggregators, which sit within existing prudential supervision. #### Outlook The 28 February 2026 PA-P wind-up deadline and the 15 September 2026 extended CDD remediation deadline are the two concrete compliance markers to track through the remainder of this cycle and into early 2026. Both are confirmed, dated obligations under the same 2025 Directions rather than open proposals, and non-compliance carries a genuine market-access consequence for affected payment aggregators. Periodic update · new data 2026-09-14 #### Licensing, Authorisation & Market Access The Reserve Bank of India's Draft Master Direction on Prepaid Payment Instruments, 2026 tightens governance requirements for non-bank PPI issuers, mandating fit-and-proper promoter and director criteria and bringing PPI customer onboarding directly within the RBI's own KYC framework rather than leaving it to issuer-level policy. This consolidates non-bank payment regulation under a same-activity, same-risk, same-regulation principle, narrowing the gap between how banks and non-bank prepaid-instrument issuers are governed. The direction remains in draft form, so its final scope and effective date are not yet settled, and this assessment is probable rather than confirmed. Separately, the Payment Aggregator authorisation regime under the Payment and Settlement Systems Act 2007 continues without material change: more than 60 entities hold in-principle or final RBI Payment Aggregator authorisation as of 2026, and the net-worth threshold for that category remains at ₹15-25 crore. This is a distinct authorisation category from PPI issuance and from banking licensure, and its continuity this cycle indicates a stable, if still-maturing, market-access structure for payment aggregation specifically, even as the PPI governance standard is being actively raised. The bank-versus-non-bank distinction is material here: the PPI tightening applies specifically to non-bank PI/EMI issuers, since banks are already subject to RBI's banking-license-level KYC and governance standards. The effect of the Draft Master Direction, if finalised as proposed, would be to narrow rather than eliminate this bank/non-bank regulatory gap. #### Outlook The key near-term development to track is whether the Draft Master Direction is finalised in its current form, amended following industry consultation, or delayed. Any change to the promoter fit-and-proper criteria or the KYC-integration requirement between draft and final stage would materially affect non-bank PPI issuers' market-access planning. Periodic update · new data 2026-09-08 #### Licensing, Authorisation & Market Access The Reserve Bank of India's rewritten Payment Aggregator Directions, reference RBI/DPSS/2025-26/141 and notified 15 September 2025, constitute a confirmed, high-impact, comprehensive rewrite of the licensing and market-access framework for payment aggregators in India. The central structural innovation is the introduction of an Offline PA category for the first time, bringing offline-context payment aggregation into an authorisation regime that had previously applied only to online aggregation. The directions explicitly repeal the prior 2020 intermediary-transactions circular except for decisions already pending authorisation, a confirmed finding that establishes a clean regulatory handover rather than an overlapping dual regime. The new framework carries distinct compliance timelines for different aggregator sub-categories. Existing offline PAs were required to apply for RBI authorisation by 31 December 2025, a probable-confidence deadline; critically, this leeway is not available for merchants onboarded after 1 January 2026, who face the new requirements immediately upon onboarding rather than benefiting from any transition window. This bifurcation means firms operating offline-PA business lines must track two distinct compliance populations -- pre-existing merchants under a grace period, and new merchants under immediate compliance -- within the same regulatory category. Cross-border payment aggregators (PA-CBs) see a combined liberalisation and tightening. Their permissible scope is liberalised: PA-CBs may now process any permissible current-account transaction under FEMA, rather than being restricted to trade transactions alone, a probable-confidence expansion of their addressable business. This liberalisation is paired with a new INR 25 crore net-worth requirement, due by 31 March 2026, meaning the broadened scope of permissible activity is conditioned on a materially higher capital base than may have previously applied to smaller cross-border aggregators. Separately, non-bank payment aggregators, including the newly created offline PA-P category, are confirmed as PMLA reporting entities that must register with FIU-IND, carrying this finding through from the AML-adjacent scope of the same directions rather than from original AML analysis produced here. Throughout this framework, the distinction between bank-affiliated PSPs and non-bank payment institution/e-money-institution aggregators remains operationally significant: the net-worth threshold, authorisation deadlines and PMLA registration obligations bear most directly on the non-bank PI/EMI population, which had previously operated under lighter-touch oversight relative to bank-affiliated payment processors. #### Outlook The compliance calendar is front-loaded through the first three quarters of the 2025-26 to 2026-27 window: the offline-PA authorisation deadline of 31 December 2025 has already passed, an extended merchant-CDD compliance deadline runs to 15 September 2026 for merchants onboarded before 31 December 2025, and the PA-CB net-worth threshold falls due 31 March 2026. Supervisory attention through this period is likely to concentrate on authorisation-status verification for offline PAs and net-worth compliance for cross-border aggregators. Watch for RBI guidance clarifying the merchant-CDD extended-deadline population and for any enforcement action against aggregators that miss the passed 31 December 2025 offline-PA authorisation deadline. **Sources and findings (4)** 1. T1 RBI (Regulation of Payment Aggregators) Directions 2025 (15 Sep 2025) (rbi.org.in) 2. T1 RBI PA Directions 2025 — ₹15cr/₹25cr net worth (rbi.org.in) 3. T3 [https://www.mondaq.com/india/corporate-and-company-law/877826/part-i-rbi-proposes-regulation-licensing-of-payment-aggregator-and-gateways [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://www.mondaq.com/india/corporate-and-company-law/877826/part-i-rbi-proposes-regulation-licensing-of-payment-aggregator-and-gateways [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]) 4. T3 [https://www.businesstoday.in/latest/corporate/story/rbi-grants-payment-aggregator-licence-to-32-entities-heres-the-full-list-370397-2023-02-15 [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://www.businesstoday.in/latest/corporate/story/rbi-grants-payment-aggregator-licence-to-32-entities-heres-the-full-list-370397-2023-02-15 [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]) ### W1b Conduct, Safeguarding & Promotions Confirmed confirmed 2026-06-24 Customer-fund safeguarding for both PAs and non-bank PPI issuers rests on a mandatory escrow account held with a single scheduled commercial bank, with no co-mingling, day-end balance floors, and quarterly statutory-auditor certification. For escrow purposes the non-bank PPI issuer/PA is deemed a 'designated payment system' under the PSS Act. Conduct is supervised by RBI's DPSS; the draft PPI MD 2026 adds codified fit-and-proper criteria, multilingual disclosure and grievance-redress obligations. [CAVEAT: draft PPI Master Direction released 22 Apr 2026, comments to 22 May 2026; not yet finalised as of late Jun 2026.] Horizon · 2026-H2 (±half_year) Final RBI Master Direction on Prepaid Payment Instruments 2026_consultation · T2_ Standing sub-brief · as of 27 June 2026 212 words · last cycle 2026-10-11 #### Conduct, Safeguarding & Promotions India's safeguarding model for non-bank PPI issuers and payment aggregators rests on a mandatory single-bank INR escrow account held with a scheduled commercial bank, with no co-mingling, a day-end balance floor not below outstanding PPIs plus acquirer dues, and quarterly statutory-auditor certification. The non-bank PPI issuer or PA is deemed a designated payment system under Section 23A(3) of the PSS Act, and the PPI issuer holds a perpetual, conditional Certificate of Authorisation. This escrow-based approach contrasts with the EU/UK segregation-plus-insurance models, carrying the bank versus non-bank distinction explicitly through the safeguarding mechanism. The live development is the draft PPI Master Direction 2026, released 22 April 2026 with comments closing 22 May 2026. It adds codified fit-and-proper criteria, multilingual (English/Hindi/local) disclosure, nodal-officer grievance redress and co-branding liability rules — raising the conduct burden on non-bank wallet issuers. The comment period has now closed and the final Master Direction is pending as of late June 2026; cited provisions remain draft. #### Outlook The W1b trajectory is escalating. The final notification of the PPI Master Direction is expected in the second half of 2026 and would repeal and replace the 2021 PPI MD, codifying the conduct, disclosure and grievance architecture. Until finalisation, the cited fit-and-proper and co-branding provisions remain at draft status. Periodic update · new data 2026-10-11 #### Conduct, Safeguarding & Financial Promotions The compliance deadline for cross-border card-not-present two-factor authentication arrived on 1 October 2026 under the Reserve Bank of India's Authentication Mechanisms for Digital Payment Transactions Directions, 2025. This deadline follows the earlier commencement of the domestic card-not-present 2FA requirement in April 2026, meaning that by October 2026 the additional-authentication mandate under these Directions extends across both domestic and cross-border card-not-present transaction flows involving Indian-issued cards. The finding rests on a single trade-press source and is assessed as probable rather than confirmed, since no independently corroborating primary notification was retrieved this cycle. The structural significance of the cross-border extension is that it closes what had been a gap in authentication coverage: international e-commerce and card-not-present transactions, which are frequently a higher-risk category for fraud given the absence of physical card presentation and the greater difficulty of applying domestic authentication infrastructure across borders, now fall within the same additional-authentication requirement that already governed domestic transactions. For payment service providers and card issuers operating in India, this means authentication-related conduct obligations now apply uniformly across the card-not-present transaction population regardless of transaction origin, removing what had been a bifurcated compliance timeline between domestic and cross-border flows. This development should be read as the completion of a phased rollout rather than as a new standalone rule: the underlying Directions were already in force from April 2026 for domestic transactions, and the cross-border deadline represents the scheduled second phase of the same instrument reaching its commencement date rather than the introduction of a materially new obligation. #### Outlook With both the domestic and cross-border phases of the Authentication Mechanisms Directions now in effect, no further phased milestones under this specific instrument are indicated in current reporting. Attention in this module going forward is likely to shift toward how consistently payment service providers and card networks implement the cross-border authentication requirement in practice, particularly given the greater technical complexity of applying strong authentication across international payment rails compared to the domestic card-not-present environment addressed from April 2026. **2 earlier distinct update(s)** Periodic update · new data 2026-09-14 #### Conduct, Safeguarding & Financial Promotions This cycle's most consequential conduct-side development for the Indian payments industry is direct and confirmed at the highest source tier: banks and financial institutions that promote or facilitate financial transactions for online money gaming will be guilty of an offence, effective from 1 May 2026. This statement, made explicitly by the government, converts what had previously been an indirect exposure for the payments industry into a direct criminal-liability standard tied to a specific prohibited activity. The Online Gaming Rules, 2026 operationalise this penal-liability announcement into a concrete transaction-blocking mechanism: a designated authority is empowered to instruct banks and payment service providers to halt transactions linked to specified games, with penalties attaching to delayed compliance. This is a confirmed, though Tier 2-sourced, development that gives the conduct obligation an enforceable operational form rather than leaving it as a general prohibition. Both banks and non-bank payment service providers fall within scope of this obligation, a rare instance where the conduct standard is deliberately drawn across the bank/non-bank line rather than differentiated by institution type. A further, less-corroborated development concerns merchant-category-code tagging: reporting sourced only at a low evidentiary tier indicates a designated authority mandated a unique gaming merchant-category code for UPI-based gaming transactions specifically to enable real-time monitoring and deposit-limit enforcement. This remains an uncertain finding pending stronger-tier corroboration, and should be read as a plausible but unconfirmed elaboration of the broader transaction-blocking framework rather than a settled fact. #### Outlook The practical enforcement pattern under the new penal-liability regime, and specifically whether and how often the designated authority exercises its transaction-blocking power against banks or PSPs, is the central indicator to watch through the remainder of 2026. Independent corroboration of the gaming merchant-category-code mandate would also be a significant confirming development if it emerges. Periodic update · new data 2026-09-08 #### Conduct, Safeguarding & Financial Promotions The 2025 Payment Aggregator Directions impose a confirmed, high-impact conduct and safeguarding obligation on all payment aggregators operating in India: a board-approved dispute-resolution policy with clear refund timelines is now mandatory, alongside maintenance of PCI-DSS/PA-DSS data-security standards. This combines a customer-facing conduct requirement -- ensuring merchants and consumers have a defined, governed path to dispute resolution and refunds -- with a technical data-security baseline that aggregators must demonstrably maintain rather than merely aspire to. The safeguarding mechanism specified is procedural rather than a discrete asset-segregation rule: the requirement centres on the board-approved policy itself and the underlying PCI-DSS/PA-DSS compliance posture, rather than, for example, a specific customer-funds-segregation mechanism of the kind seen in some other jurisdictions' payment-institution safeguarding regimes. Security-incident reporting is bound to this same conduct framework: aggregators must report security incidents to RBI within stipulated timeframes, including a monthly cyber-incident reporting cadence, meaning conduct obligations and operational-security obligations are woven together in the same directive rather than sitting in separate regulatory tracks. This conduct and safeguarding tightening applies across the newly authorised online, offline and cross-border aggregator categories established by the same directions, meaning the non-bank PI/EMI population bears the primary weight of these new board-governance and data-security obligations, consistent with the directions' overall focus on non-bank aggregator oversight rather than bank-affiliated PSP conduct specifically. #### Outlook Watch for RBI supervisory guidance detailing the specific stipulated timeframes for security-incident reporting beyond the monthly cyber-incident cadence already specified, and for any published enforcement action addressing aggregators found not to have implemented a board-approved dispute-resolution policy. As the broader PA Directions rewrite beds in through 2026, conduct-related supervisory findings are likely to surface alongside the authorisation and net-worth compliance actions tracked under the licensing module. **Sources and findings (4)** 1. T1 RBI Master Directions — PPI & PA conduct/safeguarding (rbi.org.in) 2. T2 [https://community.nasscom.in/communities/public-policy/key-highlights-rbi-draft-master-direction-prepaid-payment-instruments](https://community.nasscom.in/communities/public-policy/key-highlights-rbi-draft-master-direction-prepaid-payment-instruments) retrieved 2026-06-24 3. T3 [https://www.lexology.com/library/detail.aspx?g=741da40c-2952-4c9b-8f94-886e57b874ec [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://www.lexology.com/library/detail.aspx?g=741da40c-2952-4c9b-8f94-886e57b874ec [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]) 4. T3 [https://www.argus-p.com/updates/updates/rbi-issues-master-directions-on-prepaid-payment-instruments/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://www.argus-p.com/updates/updates/rbi-issues-master-directions-on-prepaid-payment-instruments/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]) ### W2 Stablecoins & Digital Money Confirmed confirmed 2026-06-24 India's digital-money posture is CBDC-led and stablecoin-sceptical. The RBI's Digital Rupee (e₹), a tokenised CBDC and legal tender backed by RBI, launched wholesale (Nov 2022) and retail (Dec 2022) pilots and by 2026 carries ~7-8 million retail users with programmable use-cases in welfare schemes. The RBI strongly advocates prioritising CBDCs over privately issued stablecoins; there is no in-force stablecoin framework, though the Ministry of Finance's Economic Survey 2025-26 signals possible regulation, diverging from the cautious RBI stance. Horizon · 2026-27 (±year) RBI bilateral/multilateral cross-border CBDC pilots_proposed · T2_ Standing sub-brief · as of 27 June 2026 190 words · last cycle 2026-06-27 #### Stablecoins & Digital Money India's digital-money posture is CBDC-led and stablecoin-sceptical. The Digital Rupee (e-Rupee) comprises wholesale e-Rupee-W, launched 1 November 2022 for G-sec settlement, and retail e-Rupee-R, launched 1 December 2022; the instrument is legal tender, bears no interest, and provides cash-like settlement finality. The retail user base is estimated at around 6-10 million by mid-2026, a range reflecting source variance and an unanchored primary count. RBI advocates prioritising CBDCs over privately issued stablecoins, and there is no in-force stablecoin framework, though the Economic Survey 2025-26 signals possible future regulation. The bank-PSP orientation of the e-Rupee distribution model is explicit. RBI plans bilateral and multilateral cross-border CBDC pilots in 2026-27, alongside a CBDC & Asset Tokenisation Sandbox and the Unified Markets Interface (UMI). Programmable e-Rupee deployment in welfare schemes signals state-rail expansion over private stablecoins. #### Outlook The W2 trajectory is stable on the CBDC track and stable-to-watchful on stablecoins. Cross-border CBDC pilots flagged for 2026-27, wider domestic use-cases, the tokenisation sandbox and UMI for tokenised-asset settlement in wholesale CBDC define the forward agenda. Any move toward a stablecoin framework would be a notable departure from the current sceptical stance. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T1 RBI Digital Rupee (e₹) pilot — CBDC framework (rbi.org.in) 2. T2 [https://www.business-standard.com/finance/news/rbi-cross-border-cbdc-pilots-digital-currency-2026-27-126052900721_1.html](https://www.business-standard.com/finance/news/rbi-cross-border-cbdc-pilots-digital-currency-2026-27-126052900721_1.html) retrieved 2026-06-24 3. T3 [https://coinmarketcap.com/academy/article/india-central-bank-pushes-for-prioritizing-cbdcs-over-stablecoins [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://coinmarketcap.com/academy/article/india-central-bank-pushes-for-prioritizing-cbdcs-over-stablecoins [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]) 4. T3 [https://www.cryptotimes.io/2026/04/15/rbi-urges-indians-to-join-cbdc-pilot-calls-e-rupee-future-of-money/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://www.cryptotimes.io/2026/04/15/rbi-urges-indians-to-join-cbdc-pilot-calls-e-rupee-future-of-money/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]) ### W3 Operational Resilience & Critical Infra Confirmed confirmed 2026-06-24 Operational resilience for payments rests on the RBI Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank PSOs (July 2024), the Master Direction on IT Governance, Risk, Controls and Assurance Practices (effective 1 April 2024) and the Master Direction on Outsourcing of IT Services (10 April 2023), supplemented by 2025 Outsourcing Directions for commercial banks and NBFCs. Core obligations: board-approved cyber/IT governance, business-continuity/DR, vendor (third-party/cloud) risk management and incident reporting to RBI within six hours of detection. Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/india/) Standing sub-brief · as of 27 June 2026 205 words · last cycle 2026-09-14 #### Operational Resilience & Critical Infrastructure India's operational-resilience regime for payments rests on a layered set of Master Directions rather than a single statute. These comprise the Master Directions on Cyber Resilience & Digital Payment Security Controls for non-bank PSOs (July 2024), the Master Direction on IT Governance, Risk, Controls & Assurance Practices (effective 1 April 2024), the Master Direction on Outsourcing of IT Services (10 April 2023), and the RBI (Commercial Banks — Managing Risks in Outsourcing) Directions 2025. Core obligations include board-approved cyber and IT governance, BCP/DR, vendor and cloud risk management, and cyber-incident reporting to RBI within six hours of detection; existing outsourcing arrangements must comply by 10 April 2026. The framework applies to both banks and non-bank PSOs. A structural gap stands out: no single DORA-style critical-third-party designation regime has been identified for India. Resilience obligations sit within the outsourcing and DPSC frameworks, which under-index on third-party and cloud-concentration risk relative to an explicit CTP-designation lens. #### Outlook The W3 trajectory is stable. The six-hour incident-reporting obligation and the 10 April 2026 outsourcing-compliance deadline raise compliance cost for PSOs and banks, but the absence of a DORA-equivalent critical-third-party regime remains the key structural gap versus the EU. No CTP-designation development is currently flagged. Periodic update · new data 2026-09-14 #### Operational Resilience & Critical Infrastructure The Reserve Bank of India's Authentication Mechanisms for Digital Payment Transactions Directions, 2025 mandate two-factor authentication, with at least one dynamic security element, for every digital payment transaction, including transactions on the Unified Payments Interface, effective 1 April 2026. This is a probable, system-wide resilience and fraud-control uplift that touches essentially the entire retail digital-payments ecosystem in India rather than a narrow subset of instruments or providers. The scale at stake is considerable: UPI alone processed over 14 billion transactions per month by March 2026, meaning the new authentication standard applies across an exceptionally high transaction volume, and any friction or failure in the authentication mechanism's rollout would have an outsized practical effect on the payments system's day-to-day functioning. This throughput figure is itself a probable finding, useful primarily as scale context for the authentication mandate rather than as an independent resilience development in its own right. No further critical-infrastructure-specific findings, such as outage-reporting requirements, resilience-testing obligations, or third-party risk-management standards for critical payment infrastructure, were located for India this cycle beyond the authentication mandate itself. #### Outlook The question to watch is whether the 2FA/AFA mandate, now in force since 1 April 2026, produces measurable fraud-reduction outcomes at UPI's scale without introducing friction significant enough to prompt a regulatory adjustment or exemption carve-out. Given UPI's transaction volume, even a modest friction effect could generate material user-experience or throughput consequences worth monitoring in subsequent cycles. **1 earlier distinct update(s)** Periodic update · new data 2026-09-08 #### Operational Resilience & Critical Infrastructure The 2025 Payment Aggregator Directions formalise a confirmed operational-resilience obligation requiring payment aggregators to present reports on risk assessment, security-compliance posture, security audits and incidents to their board, and to report the same to RBI. This sits alongside the confirmed PCI-DSS/PA-DSS data-security standard and the monthly cyber-incident reporting cadence carried within the same directions, together constituting a materially strengthened operational-resilience framework for the payment-aggregator sector relative to the prior 2020 regime. The structural significance of formalising board-level presentation of security and risk-assessment reporting is that it embeds operational-resilience accountability at governance level rather than leaving it purely as a technical-compliance function reporting only to management. Combined with the monthly cyber-incident reporting obligation to RBI, this creates a dual accountability channel -- internal board oversight and external regulatory reporting -- operating on overlapping but distinct cadences. This resilience obligation applies to the newly authorised online, offline and cross-border aggregator categories alike, meaning the non-bank PI/EMI population that dominates the payment-aggregator sector in India now faces board-governance and regulatory-reporting obligations for operational resilience that more closely approach, though do not necessarily match, the standards historically expected of bank-affiliated payment infrastructure. #### Outlook Watch for the first cycle of monthly cyber-incident reports to RBI under the new framework, and for any RBI commentary on aggregate incident volumes or patterns across the newly regulated offline-PA population, which entered the authorisation regime for the first time this cycle. Any high-profile security incident at a payment aggregator in the coming cycles would be the first real test of whether the board-reporting and RBI-notification cadence functions as intended under the new directions. **Sources and findings (4)** 1. T3 [https://www.getastra.com/blog/compliance/rbi-cybersecurity-compliance-checklist/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://www.getastra.com/blog/compliance/rbi-cybersecurity-compliance-checklist/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]) 2. T2 [https://taxguru.in/rbi/rbi-commercial-banks-managing-risks-outsourcing-directions-2025.html](https://taxguru.in/rbi/rbi-commercial-banks-managing-risks-outsourcing-directions-2025.html) retrieved 2026-06-24 3. T3 [https://thedigitalfifth.com/decoding-rbis-master-direction-on-it-governance/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://thedigitalfifth.com/decoding-rbis-master-direction-on-it-governance/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]) 4. T3 [https://aiplexorm.com/blog/rbi-master-direction-digital-payment-security-controls [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://aiplexorm.com/blog/rbi-master-direction-digital-payment-security-controls [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]) ### W4 Scheme & Network Compliance Confirmed confirmed 2026-06-24 UPI's zero-MDR status for merchants is in transition: NPCI's 0.4% MDR on P2M UPI payments above Rs2,000, enabled by a 14 Sept 2026 Gazette amendment to s.10A PSS Act 2007, was deferred from its 15 Oct 2026 go-live date to 'immediately post-Diwali' with no new date announced, following public and political pushback. Horizon · 2027 (±year) Possible reintroduction of MDR on large UPI merchants_proposed · T3_ Horizon · 2027 (±year) Possible reintroduction of MDR on large UPI merchants_proposed · T3_ Standing sub-brief · as of 27 June 2026 211 words · last cycle 2026-10-18 #### Scheme & Network Compliance Scheme economics in India are dominated by the zero-MDR regime. RBI caps debit-card MDR at up to 0.90% and NPCI caps UPI P2M MDR at up to 0.30%, but since January 2020 MDR is statutorily zero for RuPay debit cards and BHIM-UPI via Section 10A of the PSS Act and Section 269SU of the Income-tax Act, funded by a government incentive scheme paid to acquiring banks. Credit cards carry no regulatory MDR cap, and a roughly 1.1% interchange applies to PPI-routed UPI merchant transactions over INR2,000. The regime applies across both bank and non-bank acquirers. The live pressure point is funding. A 2026 parliamentary Finance Committee is pushing to reintroduce MDR on large UPI merchants, citing that the government incentive covers only around 11% of industry cost. Zero-MDR is the structural funding tension of Indian rails: PSPs and banks bear the gap, and a reintroduction of large-merchant MDR could materially reset acquiring economics. #### Outlook The W4 trajectory is escalating, and this module is assessed as the highest-probability source of material 2026-27 change. The parliamentary push to reintroduce large-merchant UPI MDR would most plausibly land in 2027 and would reset acquiring economics if adopted. The zero-MDR funding gap remains the central unresolved commercial variable across the India baseline. Periodic update · new data 2026-10-18 #### Scheme & Network Compliance The National Payments Corporation of India introduced a merchant discount rate on person-to-merchant Unified Payments Interface transactions, departing from the long-standing zero-MDR position on UPI. The rule sets a 0.4 percent charge on transactions above Rs2,000, capped at Rs300 for transactions of Rs75,000 or more, with a flat Rs5 fee for railways, telecom, insurance and fuel payments, a reduced 0.02 percent rate for capital-market payments, and no charge for peer-to-peer transfers or for small merchants processing Rs1 lakh or less per month. Consumers remain entirely unaffected: the scheme rule applies only to the merchant side of person-to-merchant transactions. The scheme-rule change was enabled by statute rather than scheme discretion alone: a Gazette notification of 14 September 2026 amended section 10A of the Payment and Settlement Systems Act, 2007, establishing the enabling legal framework for digital-payment processing charges on a rail that had previously operated on a mandated zero-MDR basis. This statutory-basis finding carries more caution than the scheme-rule finding itself, since it rests on a secondary explainer source rather than a directly retrieved Gazette text. The rule was originally due to take effect on 15 October 2026. On 13 October 2026, two days before that date, the scheme deferred implementation to a point after the Diwali festival period, with no replacement date announced, following public and political pushback against the prospect of new merchant-side costs on India's dominant free payment rail. The Finance Ministry has denied that the deferral reflects pressure from the United States, a denial offered in response to speculation linking the deferral to external trade considerations. The underlying scheme rule and its enabling statutory amendment remain formally in place: this is a deferral of implementation timing, not a reversal of the rule itself. #### Outlook The operative question for scheme participants and merchants is when a revised go-live date will be announced and whether the rate structure will change in response to the pushback that triggered the deferral. A future cycle should watch specifically for a post-Diwali NPCI circular; the political sensitivity already displayed around this rule suggests any relaunch is likely to be managed carefully to avoid a second reversal. **Sources and findings (4)** 1. T1 [https://www.pib.gov.in/PressReleasePage.aspx?PRID=2114335®=3&lang=2](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2114335®=3&lang=2) retrieved 2026-06-24 2. T3 [https://www.medianama.com/2026/03/223-parliamentary-committee-calls-return-mdr-upi-implications-users-small-merchants/](https://www.medianama.com/2026/03/223-parliamentary-committee-calls-return-mdr-upi-implications-users-small-merchants/) retrieved 2026-06-24 3. T3 [https://razorpay.com/learn/upi-transaction-charges/](https://razorpay.com/learn/upi-transaction-charges/) retrieved 2026-06-24 4. T2 [https://www.npci.org.in/what-we-do/rupay/circulars](https://www.npci.org.in/what-we-do/rupay/circulars) retrieved 2026-06-24 ### W5 Payment Corridor Dynamics Confirmed confirmed 2026-06-24 NPCI/RBI's UPI Merchant Discount Rate reform introduces a 0.4% MDR on eligible UPI merchant transactions above ₹2,000, effective 15 October 2026. Standing sub-brief · as of 27 June 2026 189 words · last cycle 2026-09-22 #### Payment Corridor Dynamics India's corridor strategy is UPI-led and run through NPCI International (NIPL) in concert with RBI. The UPI-PayNow linkage with the Monetary Authority of Singapore, launched February 2025, is the world's first cloud-based real-time cross-border remittance corridor — a bilateral India-Singapore arrangement now expanded to 19 participating Indian banks. Daily caps run at SGD1,000 / INR60,000, governed by FEMA under the LRS USD250,000/year limit. Distinctly from that remittance corridor, UPI is accepted for merchant (P2M) payments in eight-plus countries — UAE, Singapore, Bhutan, Nepal, Maldives, Mauritius, France and Sri Lanka — backed by 23-plus DPI MoUs, and RBI has joined BIS Project Nexus. The analytical discipline here is to keep the bilateral UPI-PayNow real-time remittance corridor separate from the broader merchant-acceptance footprint; conflating the two overstates the remittance reach. The corridor framework carries both bank and non-bank participation. #### Outlook The W5 trajectory is escalating. UPI internationalisation positions India as a fast-payment-rail exporter, with corridor selection balancing remittance and tourism flows against regulatory compatibility, and Project Nexus signalling multilateral interlinkage. GCC remittance talks remain ongoing on the IN-AE axis. Cross-border AML and sanctions interaction is referred to FIM. Periodic update · new data 2026-09-22 #### Payment Corridor Dynamics NPCI and the RBI are reintroducing a Merchant Discount Rate on the Unified Payments Interface rail. A 0.4% MDR will apply to eligible UPI merchant transactions above ₹2,000, effective 15 October 2026. This is probably the most structurally significant single development in India's domestic payment-corridor economics this cycle: UPI has operated as a zero-MDR rail for small transactions since 2020, as part of a deliberate government policy of promoting digital-payments adoption by keeping merchant acceptance costs at zero. The reintroduction of even a modest 0.4% rate marks the first material departure from that decade-long zero-MDR posture. The practical effect falls on merchant acquirers and the broader UPI merchant-acceptance ecosystem, which must now build MDR collection and reconciliation into transaction processing for eligible transactions above the ₹2,000 threshold, where previously no such mechanism was required for the affected transaction band. The structural significance is less about the rate itself, which is modest by card-scheme standards, than about what it signals for the commercial economics of India's flagship instant-payment rail going forward: a shift away from an absolute zero-cost-to-merchant model toward one in which at least some transaction volume now carries an explicit cost. #### Outlook The 15 October 2026 effective date is the concrete marker to track. Whether this modest reintroduction is a one-off adjustment or the beginning of a broader recalibration of UPI's commercial-economics model is the open question that will likely become clearer only after the new MDR has been in effect for a full reporting cycle. **Sources and findings (4)** 1. T2 [https://ibsintelligence.com/ibsi-news/npci-adds-13-banks-to-upi-paynow-for-faster-cross-border-payments/](https://ibsintelligence.com/ibsi-news/npci-adds-13-banks-to-upi-paynow-for-faster-cross-border-payments/) retrieved 2026-06-24 2. T3 [https://corporate.cyrilamarchandblogs.com/2026/05/upi-goes-global-the-regulatory-reckoning-ahead/](https://corporate.cyrilamarchandblogs.com/2026/05/upi-goes-global-the-regulatory-reckoning-ahead/) retrieved 2026-06-24 3. T3 [https://thepaymentsassociation.org/article/cross-border-payments-and-upi-revolution-in-india/](https://thepaymentsassociation.org/article/cross-border-payments-and-upi-revolution-in-india/) retrieved 2026-06-24 4. T3 [https://www.policycircle.org/industry/upi-global-expansion-cross-border/](https://www.policycircle.org/industry/upi-global-expansion-cross-border/) retrieved 2026-06-24 ### W6 Industry Structure & Commercial Probable confirmed 2026-06-24 The retail-payments market is UPI-dominated (~86% of digital transaction volume, 23bn+ payments/month worth ~₹30 lakh crore) and structurally concentrated in a PhonePe/Google Pay duopoly, whose combined share fell below 80% for the first time in May 2026 (PhonePe 46.2%, Google Pay 32.7%). NPCI's proposed 30% per-app volume cap (deadline December 2026) remains far from achievable; challengers Navi, Flipkart's super.money, BHIM and WhatsApp Pay are gaining share, and Amazon/Meta are lobbying NPCI over dominance. Horizon · 2026-12-31 (±quarter) NPCI 30% per-app UPI volume cap_proposed · T3_ Standing sub-brief · as of 27 June 2026 187 words · last cycle 2026-06-27 #### Industry Structure & Commercial Dynamics The Indian payments market is structurally concentrated but eroding at the top. UPI handles around 86% of India's digital transaction volume — over 23 billion payments per month, around INR30 lakh crore. PhonePe (46.2%) and Google Pay (32.7%) combined fell to around 79% in May 2026, the first time below 80%. Challengers are gaining: Navi (from 0.21% to 3.6%), Flipkart's super.money (1.8%), BHIM and WhatsApp Pay. NPCI's proposed 30% per-app volume cap has been deferred to 31 December 2026, and Amazon and Meta have joined lobbying over duopoly dominance. UPI-enabled banks grew to 685 by December 2025. This module sits on the non-bank PI/EMI side of the market structure, with per-app share data derived from Tier-3 NPCI-sourced journalism, held at Assessed confidence. #### Outlook The W6 trajectory is escalating. The 30% per-app cap deferred to 31 December 2026 is the central structural lever, but implementation feasibility is uncertain while PhonePe and Google Pay both sit well above the threshold. Duopoly erosion and Amazon/Meta lobbying signal shifting competitive dynamics in the world's largest real-time-payments market. Per-app share signals remain under-verified against primary NPCI data. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T3 [https://www.outlookbusiness.com/economy-and-policy/phonepe-google-pay-combined-upi-market-share-drops-below-80-for-first-time](https://www.outlookbusiness.com/economy-and-policy/phonepe-google-pay-combined-upi-market-share-drops-below-80-for-first-time) retrieved 2026-06-24 2. T3 [https://www.niftytrader.in/markets/phonepe-google-pay-share-falls/](https://www.niftytrader.in/markets/phonepe-google-pay-share-falls/) retrieved 2026-06-24 3. T3 [https://techcrunch.com/2026/04/29/amazon-meta-join-fight-to-end-google-pay-phonepe-dominance-in-india/](https://techcrunch.com/2026/04/29/amazon-meta-join-fight-to-end-google-pay-phonepe-dominance-in-india/) retrieved 2026-06-24 4. T3 [https://www.oxigenwallet.com/upi/apps-market-share/](https://www.oxigenwallet.com/upi/apps-market-share/) retrieved 2026-06-24 ### W7 Legal & Litigation Probable confirmed 2026-06-24 Payments enforcement is active. The RBI imposed monetary penalties on 353 entities totalling ₹54.78cr in FY 2024-25 for compliance failures, with PSO-specific actions under Sections 30/31 PSS Act for KYC/PPI lapses (e.g. Appnit Technologies, May 2026). A landmark RBI Ombudsman order in 2026 shifted liability onto banks whose receiving-side KYC/AML systems failed, departing from the prior 'contributory negligence' defence. The PayPal/OPGSP case established broad construction of 'payment system' under PMLA. Standing sub-brief · as of 27 June 2026 169 words · last cycle 2026-06-27 #### Legal & Litigation RBI runs an active payments-enforcement posture. It imposed monetary penalties on 353 entities totalling INR54.78cr in FY2024-25, and on 15 May 2026 penalised Appnit Technologies INR5.8 lakh for KYC/PPI non-compliance under Sections 30/31 of the PSS Act. The pivotal legal development is a 2026 RBI Ombudsman order that shifted liability onto banks whose receiving-side KYC, AML, transaction-monitoring and STR systems failed, departing from the prior contributory-negligence OTP-disclosure defence. Separately, a court held that 'payment system' under PMLA must be broadly construed to include OPGSPs, in the PayPal/Abhijit Mishra case. The enforcement reach spans both bank and non-bank entities. These findings rest on Tier-3 secondary sources and are held at Assessed confidence; the vicarious-liability principle is the key precedent. #### Outlook The W7 trajectory is escalating. The Ombudsman vicarious-liability shift onto receiving banks for mule-account and KYC failures is a material precedent reshaping fraud-loss allocation and raising bank onboarding-diligence burden. Primary RBI confirmation of the Ombudsman order and enforcement statistics is pending, with confidence held at Assessed accordingly. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T3 [https://www.bhavyasharmaandassociates.com/rbi-ppi-kyc-penalty-fintech-founder-checklist-2026/](https://www.bhavyasharmaandassociates.com/rbi-ppi-kyc-penalty-fintech-founder-checklist-2026/) retrieved 2026-06-24 2. T3 [https://www.multibagg.ai/market-pulse/articles/rbi-digital-fraud-compensation-rules-cmnbhiarudsmcpa0jlgnczxa7](https://www.multibagg.ai/market-pulse/articles/rbi-digital-fraud-compensation-rules-cmnbhiarudsmcpa0jlgnczxa7) retrieved 2026-06-24 3. T3 [https://clatgurukul.com/rbi-ombudsman-digital-arrest-malhotra-22-crore-kyc-clat-2027/](https://clatgurukul.com/rbi-ombudsman-digital-arrest-malhotra-22-crore-kyc-clat-2027/) retrieved 2026-06-24 4. T3 [https://www.taxtmi.com/article/detailed?id=13006](https://www.taxtmi.com/article/detailed?id=13006) retrieved 2026-06-24 ### W8 Merchant Acquiring & Risk Probable confirmed 2026-06-24 Acquiring is governed by the PA Directions (escrow settlement, merchant KYC/onboarding by the PA) and card-scheme rulebooks (Visa/Mastercard/RuPay) for the chargeback/dispute cycle. RBI mandates an Online Dispute Resolution (ODR) system for digital payments (DPSS circular 2020-21/21) and card-on-file tokenisation/eMandate rules for recurring transactions. Card chargebacks follow a 45-120 day network-driven cycle with issuer temporary credit; UPI disputes use a separate NPCI 3-day mechanism, with escalation to the RBI Integrated Ombudsman. Standing sub-brief · as of 27 June 2026 174 words · last cycle 2026-06-27 #### Merchant Acquiring & Risk Merchant acquiring in India is governed by the PA Directions — escrow settlement, merchant KYC and onboarding — together with the card-scheme rulebooks of Visa, Mastercard and RuPay for the chargeback cycle. RBI mandates an Online Dispute Resolution (ODR) system under DPSS.CO.PD No.116/02.12.004/2020-21, plus card-on-file tokenisation and eMandate rules for recurring transactions. The dispute architecture diverges by rail: card chargebacks follow a 45-120 day network cycle with issuer temporary credit, while UPI disputes use a separate NPCI 3-day mechanism, escalating to the RBI Integrated Ombudsman Scheme 2021. Both bank and non-bank acquirers are in scope. The ODR circular is Tier-1 primary, while the network chargeback-cycle detail rests partly on a Tier-4 source; the overall module confidence is High. #### Outlook The W8 trajectory is stable. Mandatory ODR, tokenisation and the UPI-versus-card dispute-cycle divergence — three-day NPCI against the 45-120-day network window — materially affect acquirer operations and merchant dispute handling. Network-rulebook primary verification of the chargeback cycle has not been obtained, leaving merchant-acquiring operations somewhat under-indexed relative to the regulatory framing. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T1 [https://www.rbi.org.in/commonperson/English/Scripts/Notification.aspx?Id=3194](https://www.rbi.org.in/commonperson/English/Scripts/Notification.aspx?Id=3194) retrieved 2026-06-24 2. T3 [https://in.nttdatapay.com/en/company/corporate-governance/grievance-redressal-policy](https://in.nttdatapay.com/en/company/corporate-governance/grievance-redressal-policy) retrieved 2026-06-24 3. T3 [https://merchantriskcouncil.org/advocacy/reserve-bank-of-india-rbi](https://merchantriskcouncil.org/advocacy/reserve-bank-of-india-rbi) retrieved 2026-06-24 4. T4 [https://righttoinformation.wiki/credit-card-chargeback-guide-india [CAVEAT: Tier 4 source — Assessed; illustrative only, verify pre-publication]](https://righttoinformation.wiki/credit-card-chargeback-guide-india [CAVEAT: Tier 4 source — Assessed; illustrative only, verify pre-publication]) ### W9 Product Innovation & Market Development Confirmed confirmed 2026-06-24 India is a global front-runner in rail and product innovation: UPI (real-time rails), UPI 123Pay/UPI Lite (feature-phone and offline low-value), the e₹ CBDC pilots with programmability and offline NFC, and an active RBI regulatory sandbox plus the CBDC and Asset Tokenisation Sandbox. Open-banking-style account aggregation and agentic/AI-powered conversational payments (Razorpay-NPCI-OpenAI) are emerging build-outs; RuPay-credit-card-on-UPI is a key product driving challenger growth. Standing sub-brief · as of 27 June 2026 170 words · last cycle 2026-10-11 #### Product Innovation & Market Development India's product-innovation frontier layers new commerce and access patterns on top of UPI rails. The thematic build-out spans UPI 123Pay and UPI Lite, offline NFC CBDC, the CBDC & Asset Tokenisation Sandbox, and the Unified Markets Interface (UMI). The emerging product frontier includes agentic and conversational payments: a Razorpay-NPCI-OpenAI tie-up enabling ChatGPT users in India to find products and instantly purchase them with UPI illustrates AI-driven product build-out around real-time rails. This thematic product-access view is distinct from discrete commercial events; the specific Razorpay-NPCI-OpenAI launch is rendered as a W13 commercial event, while the structural UPI product-rail innovation theme sits here in the W9 standing position. The module reflects non-bank PI/EMI product activity built on state rails. #### Outlook The W9 trajectory is escalating. Agentic and conversational UPI payments mark an emerging product frontier layering AI commerce onto India's real-time rails, while UPI 123Pay/UPI Lite limit raises, offline NFC CBDC and UMI extend the access surface. The pace of AI-payment integration is the principal forward variable. Periodic update · new data 2026-10-11 #### Product Innovation & Market Development A merchant discount rate of 0.4 percent has reportedly been introduced on select UPI merchant payments above two thousand rupees, effective from 15 October 2026. This is reported as the first merchant discount rate applied to UPI merchant transactions since the scheme's zero-MDR mandate was established, a policy that has underpinned UPI's merchant-acceptance growth strategy since its inception. The finding rests on a single trade source and is assessed as uncertain, reflecting both the limited sourcing and the significance of a departure from a long-standing zero-MDR commercial model. If accurate, the introduction of even a selective, threshold-based MDR represents a notable shift in the commercial economics underlying India's dominant instant-payment scheme. UPI's acceptance growth has historically been attributed in part to the absence of merchant-side transaction fees, which lowered the cost of acceptance relative to card-based payment methods and supported rapid merchant onboarding across small and micro-merchant segments. A reported 0.4 percent rate applying only above a two-thousand-rupee threshold would be a targeted rather than blanket change, potentially aimed at larger-ticket transactions where the cost-benefit calculation for scheme participants differs from the high-volume, low-value transaction profile that has characterised UPI's merchant base to date. The uncertain confidence rating attached to this finding reflects the absence of independent corroboration; a change of this commercial significance to India's flagship instant-payment scheme would ordinarily be expected to generate broader reporting, and the gap between the reported change and available corroborating sourcing warrants caution before treating the development as established fact. #### Outlook Should the reported UPI merchant discount rate be corroborated by additional sourcing or confirmed through scheme documentation, it would mark a material inflection point in UPI's commercial model and would warrant close tracking of any downstream effects on merchant acceptance behaviour, particularly among merchants processing transactions near or above the reported two-thousand-rupee threshold. Absent further corroboration, this development should continue to be treated with caution in subsequent reporting periods. **2 earlier distinct update(s)** Periodic update · new data 2026-09-28 #### Product Innovation & Market Development The Reserve Bank of India's FY2025-26 Annual Report signals a deliberate expansion of its central bank digital currency programme. The Report states RBI will explore bilateral and multilateral cross-border CBDC pilots during FY2026-27, extending the e-Rupee programme beyond its current domestic pilot footprint into cross-border settlement use cases. Domestically, the Report also signals a widening of existing CBDC pilots into direct-benefit-transfer and business-application use cases, broadening the programme's functional scope beyond its initial retail and wholesale pilot design. Separately, and on thinner sourcing, RBI is reported to have launched a deposit-tokenisation pilot around October 2025 using its Unified Markets Interface, applying blockchain-based settlement to tokenised Certificates of Deposit. This pilot, if confirmed by further reporting, would represent a distinct product-innovation track from the e-Rupee CBDC programme, applying distributed-ledger settlement mechanics to an existing wholesale-market instrument rather than to a sovereign digital currency. Both developments sit within the bank/PSP side of India's payments infrastructure, reflecting RBI's own central-bank-led experimentation rather than non-bank product innovation. #### Outlook Watch for RBI's FY2026-27 activity on cross-border CBDC pilots as the most concrete near-term marker of this programme's direction, and for any further confirmation or expansion of the deposit-tokenisation pilot beyond its October 2025 launch, which currently rests on a single lower-tier source. Periodic update · new data 2026-09-22 #### Product Innovation & Market Development The Reserve Bank of India's 2025-26 Annual Report commits to a substantial expansion of e-rupee central-bank-digital-currency experimentation during 2026-27. The programme spans cross-border bilateral and multilateral CBDC pilots, asset tokenisation experimentation via the Unified Multi-Ledger Infrastructure, programmable-money direct-benefit-transfer pilots running in Gujarat, Puducherry and Chandigarh, and a digital-assets cooperation pact with the Monetary Authority of Singapore. This is a confirmed institutional commitment rather than a speculative proposal, reflecting the RBI's stated annual-report-level prioritisation of CBDC development. The breadth of this programme — spanning cross-border settlement, asset tokenisation, and domestic social-transfer programmability — signals that the RBI regards the e-rupee as its primary vehicle for digital-money innovation, in preference to accommodating private stablecoin issuance. The digital-assets pact with Singapore's Monetary Authority is notable as an early instance of India pursuing bilateral digital-currency cooperation with another major Asian financial centre, extending the CBDC programme's ambition beyond purely domestic use cases. #### Outlook The pace and results of the Gujarat, Puducherry and Chandigarh programmable-money pilots, and the concrete shape the MAS cooperation pact takes in practice, are the two most consequential near-term markers for assessing whether this expanded CBDC programme translates into deployed product rather than continued pilot-stage experimentation. **Sources and findings (4)** 1. T2 [https://www.business-standard.com/finance/news/rbi-cross-border-cbdc-pilots-digital-currency-2026-27-126052900721_1.html](https://www.business-standard.com/finance/news/rbi-cross-border-cbdc-pilots-digital-currency-2026-27-126052900721_1.html) retrieved 2026-06-24 2. T3 [https://en.wikipedia.org/wiki/Digital_rupee](https://en.wikipedia.org/wiki/Digital_rupee) retrieved 2026-06-24 3. T3 [https://www.pymnts.com/news/ipo/2026/indian-payment-fintech-razorplay-planning-600-million-ipo/](https://www.pymnts.com/news/ipo/2026/indian-payment-fintech-razorplay-planning-600-million-ipo/) retrieved 2026-06-24 4. T3 [https://razorpay.com/learn/upi-transaction-charges/](https://razorpay.com/learn/upi-transaction-charges/) retrieved 2026-06-24 ### W10 Consumer Protection & APP Fraud Confirmed confirmed 2026-06-24 RBI's digital fraud-compensation framework (2026) requires zero-liability compensation for unauthorised digital transactions, provisional-credit issuance within prescribed timelines, and quarterly aggregate fraud-compensation reporting to RBI's Department of Payment and Settlement Systems. Horizon · 2026-07-01 (±quarter) RBI Draft Third Amendment Directions 2026 — APP-fraud compensation scheme_consultation · T3_ Standing sub-brief · as of 27 June 2026 209 words · last cycle 2026-10-11 #### Consumer Protection & APP Fraud India's APP-fraud compensation framework is moving toward an imminent effective date. Draft Third Amendment Directions 2026 (Responsible Business Conduct), proposed 6 March 2026 and effective 1 July 2026, provide that a customer suffering genuine fraud loss up to INR50,000 may receive 85% of net loss or up to INR25,000, whichever is lower, once per lifetime, for transactions on or after 1 July 2026 at commercial banks — excluding small finance banks, payments banks, RRBs and local area banks — reported within five days. RBI bears around 65% of cost, with the remainder split between sending and receiving banks. The scheme applies on the bank-PSP side. This design contrasts with the UK FSMA 2023 / PSR model of full reimbursement up to GBP85,000 split 50:50 between PSPs with no central-bank role. The fraud backdrop is significant: national cyber-crime complaints rose to 24.03 lakh in 2025, and UPI fraud grew to 13.42 lakh cases (INR1,087cr) in 2023-24. Sourcing is Tier-3; confidence is High on the proposal's existence and parameters. #### Outlook The W10 trajectory is escalating. The scheme takes effect 1 July 2026. India's central-bank-funded, capped, once-per-lifetime model is structurally distinct from the UK PSP-funded full-reimbursement regime — a key comparative datapoint for global APP-fraud policy design. Periodic update · new data 2026-10-11 #### Consumer Protection & APP Fraud The Reserve Bank of India has published draft Know Your Customer Amendment Directions, 2026, proposing a mule-account debit-hold mechanism as a consumer-protection and fraud-control measure. Under the draft, banks would be permitted to place a temporary debit hold of up to sixty days on transactions of one thousand rupees or more that are flagged by AI-based transaction monitoring systems as linked to suspected mule-account or cyber-fraud activity. The hold would be amount-limited, restricting only the disputed sum rather than the account as a whole, except in exceptional circumstances not further specified in the draft as currently reported. The proposal was published 8 October 2026 and remains at consultation stage, with an expected effective date in the first quarter of 2027; this finding is assessed as probable, resting on a single trade-press source. From a consumer-protection and authorised-push-payment-fraud perspective, the proposed mechanism addresses a recognised gap: current bank-level practice for handling suspected mule-account funds reportedly varies significantly across institutions, creating inconsistency in how quickly and how comprehensively fraud-linked transactions are intercepted. A standardised, amount-limited hold mechanism tied to a quantified monetary threshold and a capped maximum duration would give consumers a more predictable and nationally consistent experience when their transactions are flagged, while the amount-limited design is intended to avoid the disproportionate consumer impact of a full account freeze in response to a single flagged transaction. The design balances fraud-prevention objectives against consumer-protection concerns: a full account freeze in response to an automated flag risks denying a legitimate account holder access to unrelated funds, whereas restricting the hold to the disputed amount limits collateral impact while still preserving the funds at issue pending investigation. The draft's reliance on AI-based flagging as the triggering mechanism also raises an implicit question, not resolved in current reporting, about the error-rate tolerance built into the system and what recourse is available to account holders whose transactions are flagged in error. #### Outlook As a consultation-stage instrument, the draft KYC Amendment Directions remain subject to revision, and the first-quarter-2027 expected effective date should be treated as scheduled rather than settled. Key open questions for the consumer-protection reading of this development include the specificity of the appeals or reversal process available to account holders whose transactions are held in error, and whether the sixty-day maximum hold period will be retained in the finalised rule. Continued tracking through the consultation period will be needed to assess whether the mechanism, once finalised, achieves its stated fraud-prevention purpose without generating disproportionate consumer friction. **3 earlier distinct update(s)** Periodic update · new data 2026-09-28 #### Consumer Protection & APP Fraud India's digital-fraud compensation framework now places the burden of proving customer negligence on banks and payment service providers rather than on the customer. Under this framework, customers who report unauthorised digital transactions promptly and are not shown to have been negligent are entitled to zero-liability compensation, reversing what would otherwise be a burden-of-proof default falling on the consumer to demonstrate they were not at fault. Banks and PSPs are additionally required to submit quarterly aggregate reporting to RBI on these compensation outcomes, creating a supervisory data trail on how frequently unauthorised-transaction claims arise and how they are resolved. This burden-shift is a significant consumer-protection development for a market where digital-payment fraud volumes are substantial, and it applies specifically to the bank/PSP side of the payments ecosystem rather than to non-bank payment institutions, reinforcing the bank-versus-non-bank distinction that runs through this cycle's other India developments. #### Outlook Watch for the first quarterly aggregate reporting cycles under this framework, which should begin to reveal the practical scale of zero-liability compensation claims and the extent to which banks are successfully or unsuccessfully proving customer negligence under the new burden-of-proof standard. Periodic update · new data 2026-09-22 #### Consumer Protection & APP Fraud The Reserve Bank of India has issued draft amendment directions reviewing the 2017 customer-liability-limitation framework that governs how losses from unauthorised electronic-banking transactions are allocated between customers and institutions. The review is a direct response to a shift in the dominant fraud typology: where the 2017 framework was designed primarily around system-level vulnerabilities and unauthorised access, the current fraud environment is increasingly driven by social-engineering techniques that induce customers to authorise payments themselves — authorised-push-payment fraud, in the terminology used elsewhere in this monitor's coverage. This is a probable rather than confirmed development in terms of its eventual final shape, since the directions remain in draft form, but the direction of travel — toward a liability framework better calibrated to social-engineering-driven fraud rather than purely system-vulnerability-driven fraud — is a clear signal about where Indian consumer-protection policy in payments is heading. #### Outlook Whether the draft amendment directions are finalised, and in what form the revised customer-liability allocation ultimately lands, is the key marker to track. The shift in underlying fraud typology that is driving this review is itself a durable structural trend rather than a one-off anomaly, suggesting further consumer-protection policy attention in this area is likely regardless of the specific final shape these directions take. Periodic update · new data 2026-09-08 #### Consumer Protection & APP Fraud The Reserve Bank of India's digital-fraud compensation framework, assessed at probable confidence from a lower-tier source this cycle, requires zero-liability compensation for unauthorised digital transactions where the customer reports promptly and was not negligent. Critically, the burden of proving negligence rests with the bank rather than the customer, a material consumer-protection tightening that shifts the evidentiary burden away from the party with less visibility into the transaction's authentication chain. The operational mechanics attached to this framework require banks to issue provisional credit to affected customers within prescribed timelines, ensuring consumers are not left without access to disputed funds while a fraud investigation proceeds, and to report aggregate fraud-compensation data to RBI on a quarterly basis. This quarterly reporting obligation gives RBI a standing data feed on the scale of digital-fraud compensation across the banking sector, which could in later cycles support more granular supervisory or policy responses to APP-fraud trends. This framework applies specifically to the bank/PSP population handling digital transactions, distinct from the non-bank PI/EMI-focused obligations formalised in the same cycle's payment aggregator directions, reflecting the different points in the payment chain at which liability and compensation obligations naturally attach. The lower source-tier basis for this framework's specifics -- relative to the payment aggregator directions material sourced more directly to RBI's own circular index -- means the precise operational parameters merit confirmation against RBI's own published framework text in a future cycle. #### Outlook Watch for the first quarterly aggregate fraud-compensation reports banks submit to RBI under this framework, which would provide the first empirical measure of the scheme's practical scale and effectiveness. Given the probable-confidence, lower-tier sourcing basis for this cycle's finding, a direct RBI primary-source retrieval in a subsequent cycle would materially strengthen confidence in the framework's exact operational parameters. **Sources and findings (4)** 1. T3 [https://www.angelone.in/news/economy/rbi-proposes-new-rules-effective-july-1-2026-safeguards-against-digital-banking-fraud](https://www.angelone.in/news/economy/rbi-proposes-new-rules-effective-july-1-2026-safeguards-against-digital-banking-fraud) retrieved 2026-06-24 2. T3 [https://theprint.in/opinion/rbi-compensate-app-fraud-victims/2904306/](https://theprint.in/opinion/rbi-compensate-app-fraud-victims/2904306/) retrieved 2026-06-24 3. T3 [https://chahalacademy.com/indian-express-editorial-analysis/16-feb-2026/2553](https://chahalacademy.com/indian-express-editorial-analysis/16-feb-2026/2553) retrieved 2026-06-24 4. T3 [https://abclive.in/2026/03/10/rbi-digital-fraud-liability-rules/](https://abclive.in/2026/03/10/rbi-digital-fraud-liability-rules/) retrieved 2026-06-24 ### W11 AML/CFT & Financial Crime (Sentinel.gi-fed) [Sourced from Sentinel.gi ↗](https://sentinel.gi/jurisdictions/india/#sec-dom-D7) Confirmed confirmed 2026-06-24 [Sentinel.gi position] India's payments AML/CFT posture is anchored on the PMLA 2002 and UAPA, supervised by RBI/FIU-IND. The FATF 2024 Mutual Evaluation placed India in 'regular follow-up' (the highest category, alongside few G20 peers), rating it compliant/largely compliant on 37 of 40 Recommendations, but flagged only 'moderate' effectiveness in AML/CFT supervision (IO.3) and that monetary penalties on FIs are generally not proportionate or dissuasive. Cross-border UPI corridors create FEMA/FATF-list interaction risk. Standing sub-brief · as of 27 June 2026 177 words · last cycle 2026-06-27 #### AML/CFT & Financial Crime This module is carried from the Sentinel.gi feed; no original illicit-finance analysis is performed here. Per the FATF September 2024 Mutual Evaluation Report, India rated compliant or largely compliant on 37 of 40 Recommendations — partial on R.8 (NPOs), R.12 (PEPs) and R.28 (DNFBP supervision) — with 'substantial' effectiveness in six areas but only 'moderate' on AML/CFT supervision (IO.3). FATF found monetary penalties on financial institutions generally not proportionate or dissuasive. India was placed in 'regular follow-up', the highest category, alongside the UK, France and Italy among G20 members. FIU-IND fined a VDA service provider USD2.16m (INR18.2cr) in June 2024 for STR-monitoring failures, and a payments bank was fined and wound down for AML/CFT violations. The intelligence is attributed to the Sentinel feed; see Sentinel.gi for the underlying analysis. #### Outlook The W11 trajectory is stable. FATF 'regular follow-up' status supports India's cross-border DPI ambitions, while the 'moderate' supervision-effectiveness and non-dissuasive-penalties findings constitute the residual risk surface for payments. Cross-border UPI corridor AML and sanctions interaction is routed to FIM rather than concluded here. no periodic updates on record for this sub-brief ** Sources and findings (9)** 1. T3 [https://risk.lexisnexis.com/insights-resources/article/fatf-new-findings-aml-cft-compliance-india](https://risk.lexisnexis.com/insights-resources/article/fatf-new-findings-aml-cft-compliance-india) retrieved 2026-06-24 2. T? FIM (sentinel.gi) per-JID baseline profile — India — India's AML/CFT regime rests on the Prevention of Money Laundering Act 2002 (PMLA) and the Unlawful Activities (Prevention) Act 1967, supervised by FIU-IND, RBI, SEBI and the Enforcement Directorate. FATF's 2024 MER found strong technical compliance and good results on risk understanding, asset deprivation and international cooperation, but flagged prosecution delays, thin DNFBP supervision and an early-stage VASP regime. 3. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-005) — Gap: sourcing-thinness 4. T2 FIM (sentinel.gi) enforcement_action_register (issue FIM-BASE-ENF-002) — Enforcement: US DOJ / SEC / OFAC — Gautam Adani, Sagar Adani, Adani Green Energy CEO Vneet Jaain, Adani Group 5. T1 FIM (sentinel.gi) sanctions_change_register (issue FIM-BASE-SANC-004) — Sanctions: EU listing 6. T2 FIM (sentinel.gi) sanctions_change_register (issue FIM-BASE-SANC-003) — Sanctions: national wind-down 7. T2 FIM (sentinel.gi) enforcement_action_register (issue FIM-BASE-ENF-001) — Enforcement: Indian Coast Guard — Three tankers suspected of dark-fleet oil smuggling off Mumbai 8. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-003) — Gap: regulatory-failure 9. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-002) — Gap: enforcement-absence ### W12 Correspondent Banking, Settlement & Access Confirmed confirmed 2026-06-24 Central settlement runs on RBI-owned Centralised Payment Systems — RTGS (large-value, real-time, 24x7x365 since Dec 2020) and NEFT (batch, 24x7 since Dec 2019), both on the e-Kuber core banking system. Since July 2021 the RBI has opened CPS direct membership to authorised non-bank PSPs (PPI issuers, card networks, white-label ATM operators) requiring ₹25cr net worth, Indian incorporation, data-localisation and an RBI current account/IFSC; non-banks are excluded from intra-day liquidity and cannot sponsor sub-members. Standing sub-brief · as of 27 June 2026 188 words · last cycle 2026-06-27 #### Correspondent Banking, Settlement & Access The analytical spine of this module is the bank versus non-bank settlement-access asymmetry. Central settlement runs on RBI-owned Centralised Payment Systems — RTGS (large-value, real-time, 24x7x365 since December 2020) and NEFT (batch, 24x7 since December 2019), both on the e-Kuber core banking system. Since July 2021 RBI has opened direct CPS membership to authorised non-bank PSPs — PPI issuers, card networks and white-label ATM operators — under Section 10(2) read with Section 18 of the PSS Act, requiring INR25cr net worth, Indian incorporation, data-localisation, a separate IFSC, an RBI current account and INFINET/SFMS membership. The access, however, is capped: non-banks are excluded from intra-day liquidity and cannot sponsor sub-members. An LEI is required for RTGS/NEFT transactions of INR50cr or more. Direct non-bank CPS access materially advances PSP settlement independence from sponsor banks, but the intra-day-liquidity exclusion and no-sub-member rule are the structural limits on access depth. #### Outlook The W12 trajectory is stable. Non-bank CPS access since 2021 is an India-distinctive settlement-access feature, with the intra-day-liquidity exclusion as the key remaining structural limit. No change to the liquidity-exclusion or sub-member rules is currently flagged. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T2 [https://www.thenewsminute.com/money/rbi-allows-paytm-phonepe-and-other-non-banks-access-neft-rtgs-payment-systems-153159](https://www.thenewsminute.com/money/rbi-allows-paytm-phonepe-and-other-non-banks-access-neft-rtgs-payment-systems-153159) retrieved 2026-06-24 2. T3 [https://www.drishtiias.com/daily-updates/daily-news-analysis/non-bank-psps-to-join-centralised-payment-system](https://www.drishtiias.com/daily-updates/daily-news-analysis/non-bank-psps-to-join-centralised-payment-system) retrieved 2026-06-24 3. T3 [https://affairscloud.com/rbi-allowed-non-banks-to-participate-in-cps-rtgs-neft/](https://affairscloud.com/rbi-allowed-non-banks-to-participate-in-cps-rtgs-neft/) retrieved 2026-06-24 4. T3 [https://www.dnaindia.com/personal-finance/report-rtgs-neft-payment-systems-opened-up-for-non-banks-in-phases-rbi-2903037](https://www.dnaindia.com/personal-finance/report-rtgs-neft-payment-systems-opened-up-for-non-banks-in-phases-rbi-2903037) retrieved 2026-06-24 ### W13 Commercial Intelligence (M&A, Investment & Product) Probable confirmed 2026-06-24 Trailing-12-month commercial intelligence is dominated by a fintech IPO pipeline amid more selective funding. Razorpay confidentially filed a ~$600m IPO (June 2026) and obtained shareholder approval for a ₹2,700cr fresh issue; PhonePe filed in late 2025 and received listing approval in January 2026 at a $9-10.5bn target valuation; Pine Labs progressed toward its IPO. India fintech funding was $513m in Q1 2026 with a sharply falling deal count, signalling consolidation toward stronger players. Standing sub-brief · as of 27 June 2026 260 words · last cycle 2026-10-18 #### Commercial Intelligence (M&A, Investment & Product) Three discrete commercial events define this cycle's W13 entries. First, Razorpay confidentially filed for a roughly USD600m IPO in June 2026, targeting a year-end debut (last valued at around USD7.5bn in its 2021 round); it separately obtained shareholder approval in May 2026 to raise INR2,700cr (~USD283m) via the fresh-issue component plus an undisclosed offer-for-sale, with a pre-IPO placement planned before filing its RHP with SEBI. This anchors India's fintech listing pipeline and signals public-market appetite for licensed payments platforms with merchant networks. Second, the sector funding trend shows consolidation: Indian fintech funding stood at USD513m in Q1 2026 with a sharply falling deal count, indicating investors backing fewer, stronger players and favouring mature platforms with licences and merchant networks. PhonePe filed in late 2025 and received listing approval in January 2026 at a USD9-10.5bn target valuation, and Pine Labs progressed toward its IPO. Third, Razorpay partnered with NPCI and OpenAI to launch an AI-powered 'conversational payment experience' ('Agentic Payments') enabling ChatGPT users in India to purchase products instantly via UPI; this partnership's value is not publicly disclosed. All three events sit on the non-bank PI/EMI side and are held at Assessed confidence, rendered as commercial events distinct from W6 structural market analysis and the W9 thematic product view. #### Outlook The W13 trajectory is escalating. The Razorpay, PhonePe and Pine Labs IPO pipeline amid funding consolidation toward licensed scale players is the dominant signal. Some adjacent M&A detail rests on a Tier-4 source with undisclosed values and is not asserted as a structured commercial event. Periodic update · new data 2026-10-18 #### Commercial Intelligence & Fintech India's fintech sector produced two notable discrete commercial events this cycle, set against a backdrop of overall sector funding growth alongside declining deal volume. Tracxn's nine-month 2026 report shows Indian fintech companies raised approximately 2.2 billion dollars across the January-to-September period, up 14 percent on the 1.9 billion dollars raised over the same period in 2025, even as the number of completed rounds fell sharply year on year. The largest single funding event of the period was CRED's 540 million dollar round, one of five mega-rounds that together accounted for roughly 48 percent of all capital raised across the nine-month window. On the acquisition side, Indiabulls Group completed the purchase of Fintech Cloud for 110 million dollars, reported as the largest fintech acquisition of the nine-month period. Both figures are disclosed amounts drawn from vendor analytics reported through quality press rather than from primary deal filings independently verified this cycle. The pattern these two events illustrate, a small number of large transactions accounting for a disproportionate share of total sector activity, is a discrete commercial-intelligence signal distinct from any structural market-concentration thesis: it describes what happened in specific, named transactions during the period rather than asserting a durable shift in India's fintech industry structure. #### Outlook Future cycles should watch for confirmation of deal terms and strategic rationale behind the Indiabulls Group acquisition of Fintech Cloud, and for whether the funding concentration pattern, a small number of mega-rounds dominating total capital raised, persists or reverses as further 2026 data becomes available. **Sources and findings (4)** 1. T3 [https://www.pymnts.com/news/ipo/2026/indian-payment-fintech-razorplay-planning-600-million-ipo/](https://www.pymnts.com/news/ipo/2026/indian-payment-fintech-razorplay-planning-600-million-ipo/) retrieved 2026-06-24 2. T3 [https://www.medianama.com/2026/05/223-exclusive-razorpay-shareholder-approval-rs-2700-crore-ipo/](https://www.medianama.com/2026/05/223-exclusive-razorpay-shareholder-approval-rs-2700-crore-ipo/) retrieved 2026-06-24 3. T3 [https://www.newskart.com/razorpay-files-confidential-ipo-papers-can-indian-fintech-still-command-big-valuations/](https://www.newskart.com/razorpay-files-confidential-ipo-papers-can-indian-fintech-still-command-big-valuations/) retrieved 2026-06-24 4. T4 [https://tiimagazine.com/top-30-fintech-companies-in-india-to-watch-in-2026/ [CAVEAT: Tier 4 source — Assessed; illustrative only, verify pre-publication]](https://tiimagazine.com/top-30-fintech-companies-in-india-to-watch-in-2026/ [CAVEAT: Tier 4 source — Assessed; illustrative only, verify pre-publication]) ** No modules match.** Filters combine as OR inside a group and AND across groups. ## Editorial metadata Provenance only. Nothing below gates publication or affects the render. Editorial metadata for India| Field | Value | |---|---| | `trust.lawyer_review.status` | never_reviewed | | `trust.lawyer_review.reviewer` | no reviewer on record | | ` trust.content_source` | ai_generated | ## Provenance and declared absence **Disclosure model:** module cards load OPEN; standing positions render in full; sub-briefs and jurisdiction briefs load as a clamped teaser with an explicit “read full” control carrying the true word count; earlier updates stay collapsed behind a counted summary. No text is hidden without disclosing how much of it there is. **Sentinel-fed modules** receive no special rendering treatment. `sentinel_feed` is an attribution chip only: it does not suppress content, does not generate an absence reason code, and does not exclude the module from any count, filter, search index or export on this page. **Family taxonomy** is renderer-level presentation config, not a JID field. Colour is always duplicated in text and is never the sole carrier of meaning. **Suppressed by doctrine:** derived risk score; per-module RAG traffic light; `derived_scores` = `{}`. **Band honesty:** uncertainty bands are computed against a frozen build clock of 2026-10-21. A year-precision row is never promoted into a tighter band. **Orphan deltas:** 2 cycle_delta row(s) target non-module objects and are listed in the rail rather than attached to a card. **Envelope:** baseline resolved at `jurisdiction_json.baseline`; 14 module(s), 61 finding(s), 131 source(s) in the cumulative register. Think something on this page is wrong? [Report an error](https://payments.gi/legal/#contact).