How do RBI’s payment aggregator rules apply to domestic aggregators and payment gateways?
By Ajaj Mohammad Qureshi · Published · 6 min read
Not legal, tax or investment advice.
In India a payment aggregator collects customers’ money for merchants and settles it to them, so it needs RBI authorisation if it is not a bank. A payment gateway only provides the technology to route payments and handles no funds, so RBI does not license it. RBI’s payment aggregator rules, in its Master Direction of 15 September 2025, cover online (PA-O), physical (PA-P) and cross-border (PA-CB) aggregators, requiring an escrow account at a scheduled commercial bank, merchant due diligence and no storage of card credentials.
Indian exporter or freelancer? Payzoplus gets you paid from abroad, in rupees.Open a free account →
On this page
- What is the difference between a payment aggregator and a payment gateway?
- Which kinds of payment aggregator does RBI recognise?
- Who needs RBI authorisation?
- How does the escrow account protect merchants?
- What must a PA do about merchants, cards and disputes?
- What does this mean for a merchant choosing a provider?
What is the difference between a payment aggregator and a payment gateway?
The two words are often used interchangeably, but RBI draws a sharp line between them, and the line is money. In RBI’s Master Direction on Regulation of Payment Aggregators (RBI/DPSS/2025-26/141, 15 September 2025), a payment aggregator (PA) is an entity that facilitates the aggregation of payments made by customers to merchants and then settles the collected funds to those merchants (para 4(i)). A payment gateway (PG) provides the technology infrastructure for routing and processing payments, without handling the funds (para 4(j)).
Because a gateway never touches the money, it is outside the scope of the direction (para 10(g)). RBI only encourages gateways to follow its baseline technology recommendations. An aggregator holds customers’ money, even if only for a day, and so it is regulated as a payment system under the Payment and Settlement Systems Act, 2007.
Where the money sits in an online payment through an aggregator
Customer pays
Card, UPI, net banking or wallet
Gateway routes it
Technology only; no funds
PA escrow account
At a scheduled commercial bank
Merchant is settled
On the agreed settlement timeline
Which kinds of payment aggregator does RBI recognise?
The 2025 direction brings three kinds under one text:
| Type | What it does | Typical example |
|---|---|---|
| PA-O (online) | Transactions where the acceptance device and the payment instrument are not in close proximity | An online checkout on a website or app |
| PA-P (physical) | Transactions where the acceptance device and the payment instrument are both physically present | A card machine or QR at a shop counter |
| PA-CB (cross-border) | Current-account transactions not prohibited under FEMA, in e-commerce mode, inward or outward | Collecting from a foreign buyer for an Indian merchant |
This post is about the domestic side, PA-O and PA-P. The cross-border rules, including the ₹25 lakh per-transaction cap, are in RBI’s PA-CB rules.
Who needs RBI authorisation?
Banks do not. The direction says a bank does not require authorisation to carry on PA business (para 5(a)). A non-bank PA must apply through RBI’s online portal and must be a company incorporated under the Companies Act, 2013 (para 5(b)–(c)). The net worth required is ₹15 crore at the time of application, rising to ₹25 crore by the end of the third financial year after authorisation (para 6).
Two other lines are drawn. A PA cannot run a marketplace business (para 10(b)); the roles of selling platform and payment intermediary must be separate. And a marketplace onboarded by a PA must not accept payments for sellers that are not onboarded on its own platform (para 13(f)).
Physical aggregators were the newest addition. Entities doing only PA-P business had to apply for authorisation by 31 December 2025; one that did not was required to inform its bankers and wind up the business by 28 February 2026 (para 5(d)(iii)). Since 15 June 2026, a general RBI direction on authorisation of all payment system operators also applies, covering matters such as how net worth is computed.
How RBI’s aggregator rules developed
17 Mar 2020
First PA and PG guidelines
Regulation of payment aggregators; baseline technology recommendations for gateways.
31 Mar 2021
Card storage clarified
Aggregators and merchants barred from storing customers’ card credentials.
15 Sep 2025
Master Direction
PA-O, PA-P and PA-CB consolidated into one direction.
31 Dec 2025
PA-P application deadline
Also the deadline for escrow arrangements to follow the new rules.
28 Feb 2026
Wind-down deadline
For PA-P-only entities that did not apply.
15 Jun 2026
Authorisation direction
General rules for all payment system operators.
How does the escrow account protect merchants?
A non-bank PA must keep the money it collects in a separate escrow account with a scheduled commercial bank in India (para 16(a)). Table 1 of the direction lists what may go in and out. Credits include customers’ payments for purchases from merchants and refunds initiated by merchants. Debits include payments to onboarded merchants and the PA’s own commission. Pre-funding of the domestic escrow account is allowed.
The key safeguard is the day-end balance: it must not fall below the amount collected for merchants but not yet settled to them. The direction does not prescribe a single settlement period. Instead, settlement timelines are set in the PA–merchant agreement, which must be fair and equitable and state those timelines transparently.
What must a PA do about merchants, cards and disputes?
- Merchant due diligence. PAs check merchants under RBI’s KYC rules. Merchants onboarded until 31 December 2025 had one year from the direction’s date to be brought up to the new standard; merchants onboarded from 1 January 2026 must meet it from the start (para 13(j)).
- No card storage. Customer card credentials must not be stored in the database or server accessed by the merchant (Annexure 1, para 2.1). Card-on-file payments use tokens instead; see card tokenisation in India.
- Refunds to source. A refund goes back to the original payment method unless the payer specifically asks otherwise (para 10(f)).
- Disputes and failed transactions. A PA needs a dispute resolution mechanism with refund timelines, and must follow RBI’s turnaround-time rules for failed transactions (para 8(a)).
- A grievance officer and an escalation matrix published on the PA’s website (para 8(d)).
Payment aggregator vs payment gateway
| Payment aggregator | Payment gateway | |
|---|---|---|
| Handles funds | Yes, through an escrow account | No |
| RBI authorisation | Needed for non-banks; banks exempt | Not required; outside the direction |
| Net worth | ₹15 crore at application; ₹25 crore by year 3 | None set by RBI |
| Merchant KYC | Required | Not under the direction |
| RBI guidance | Binding direction | Baseline technology recommendations, encouraged |
What does this mean for a merchant choosing a provider?
- If a provider collects your customers’ money and settles it to you, it should be a bank or an RBI-authorised PA. Ask which.
- Read the settlement clause: the direction leaves the timeline to your agreement, so it is negotiable and must be stated clearly.
- Do not store card numbers yourself, even “temporarily”.
- Keep refund handling simple: back to the original method unless the customer asks otherwise.
- Exporters collecting from foreign buyers need a PA-CB or a bank route, not a domestic PA; see how to receive international payments.
How Payzoplus helps you
How Payzoplus works within RBI’s rules for you
- Money is held by our RBI-authorised payment partner and settled to your bank, never by us.
- The purpose code is checked when you raise the invoice, not discovered at the bank later.
- The bank’s FIRA for every settlement, with our remittance advice beside it: invoice, remitter, purpose code and rate.
- Rupees reach your own bank account on T+1 after you reconcile.
No setup fee · No monthly fee · Verification usually takes one working day
Frequently asked questions
Does a payment gateway need an RBI licence?
No. A payment gateway that only provides the technology to route and process payments, without handling funds, is outside RBI’s payment aggregator direction. RBI encourages gateways to follow its baseline technology recommendations.
What is the difference between PA-O and PA-P?
A PA-O handles transactions where the acceptance device and the payment instrument are not in close proximity, typically online. A PA-P handles transactions where both are physically present, such as a card machine or QR at a counter.
Do banks need authorisation to act as payment aggregators?
No. The 2025 direction says a bank does not require authorisation to carry out payment aggregator business. Non-banks must be companies and obtain RBI authorisation.
How fast must a payment aggregator settle to a merchant?
The direction does not fix one period. Settlement timelines are set in the PA–merchant agreement, which must be fair and equitable and state them transparently, and the escrow balance must always cover amounts not yet settled.
Sources
The primary texts this article was checked against, on 30 October 2026.
- RBI — Master Direction on Regulation of Payment Aggregators (RBI/DPSS/2025-26/141, 15 September 2025)
- RBI — Guidelines on Regulation of Payment Aggregators and Payment Gateways (17 March 2020)
- RBI — Guidelines on Regulation of Payment Aggregators and Payment Gateways: clarifications (31 March 2021)
- RBI — Master Directions on Authorisation to operate a Payment System (15 June 2026)
General information, not tax, legal or investment advice. Rules and products change: confirm the details for your business with your CA, your bank or the regulator.
How useful was this article?
Be the first to rate it.
Comments
Be kind and stay on topic. Comments with links or contact details are checked before they appear.