Introduction
The Reserve Bank of India (“RBI”), in a landmark regulatory move, on September 15, 2025 issued the Master Direction on Regulation of Payment Aggregators (PA) (“Master Directions 2025”). The Master Directions 2025 consolidate earlier circulars and guidelines, rationalizing the regulation of entities aggregating payments on behalf of merchants through various payment channels. This regulatory intervention underscores RBI’s commitment to fostering innovation in fintech while safeguarding the interests of consumers and other stakeholders in the digital payments space.
Historically, the RBI had issued:
- Guidelines on Regulation of Payment Aggregators and Payment Gateways, 2020 (“Payment Aggregators Guidelines”);
- Amendment directive issued on March 31, 2021;
- Regulation of Payment Aggregator – Cross Border (PA – Cross Border), 2023.
While these laid an initial framework, the growing complexity of digital payments necessitated a comprehensive and updated regulatory approach, which the Master Directions 2025 now embodies.
Salient Features of the Master Directions
| Features | Description | |
| 1. | Definition and Scope of – Payment Aggregator (“PA”) | The Master Directions 2025 defines a ‘Payment Aggregator’ as an entity that facilitates aggregation of payments made by customers to merchants through one or more payment channels via a merchant’s physical or virtual interface. It categorizes PAs into three distinct types:
The regulatory scope extends to all bank and non-bank entities undertaking PA business in India. |
| 2. | Licensing Framework and Eligibility Criteria
|
|
| 3. | Key Compliance Requirements
|
|
| 4. | Restrictions, Penalties, and Enforcement |
|
Comparative Analysis with Existing Legal Framework
The Master Directions 2025 significantly extends and clarifies regulatory requirements compared to the Payment Aggregators Guidelines:
| Basis | Guidelines on Regulation of Payment Aggregators and Payment Gateways, 2020 | Master Directions 2025 |
| Enforcement Powers | Advisory in nature; limited explicit enforcement. | Explicit enforcement powers under Payment and Settlement Systems Act, 2007; comprehensive reporting and auditing norms. |
| Scope | Covers both Payment Aggregators and Payment Gateways with some overlap. | Focuses solely on Payment Aggregators; clarifies non-application to prepaid wallets and marketplace operations. |
| Technology and Data Security | Advisory recommendations. | Mandatory technology infrastructure standards, data security audits, and empowered dispute resolution mechanisms. |
Impact on Stakeholders
Payment Aggregators
- Face increased compliance costs due to licensing, capital, and extensive audit and reporting requirements.
- Must invest in enhanced governance structures and merchant due diligence.
- Greater regulatory certainty, but also a heavier operational and legal burden.
Merchants & E-commerce Platforms
- More rigorous onboarding procedures with enhanced KYC and monitoring.
- Guaranteed transparency on settlement timelines and fund flow.
- Stricter risk and fraud management obligations with potential impact on transaction speeds.
Consumers
- Improved protection through explicit dispute resolution frameworks.
- Enhanced transparency on charges and refunds.
- Stronger data protection standards reduce exposure to fraud and data breaches.
Investors, VCs, and Fintech
- Clear regulatory framework reduces uncertainty, aiding investment decisions.
- Business model recalibrations are required to meet capital and compliance norms.
- Opportunities to innovate within a stable compliance ecosystem.
Legal and Commercial Considerations
- The regulation raises interpretational issues regarding hybrid PA models combining cross-border and domestic activities.
- Possible overlaps or conflicts with state-level laws and sectoral regulations (e.g., e-commerce and data protection statutes) need navigation.
- The framework sets the stage for India’s payments ecosystem evolution towards greater regulatory oversight, balanced with fintech innovation.
Conclusion
The Master Directions 2025 strikes a pragmatic balance between fostering innovation in digital payments and ensuring robust consumer protection. Its comprehensive due diligence, governance, and audit requirements, while demanding, are necessary to mitigate risks inherent in growing fintech operations. Stakeholders should focus on establishing meticulous compliance and governance frameworks to adapt smoothly to these changes.
Key takeaways include early application for authorization by non-bank PAs, reassessment of operational systems for segregation of funds and data security, and the institution of transparent merchant onboarding and grievance mechanisms.
