Payment Gateway License in India

Payment Gateway License in India: The Correct Regulatory Position

The expression “Payment Gateway License” is widely used by fintech founders, consultants and merchants. However, the RBI framework does not treat every payment gateway as a separately licensed fund-handling entity. The regulatory question depends on what the business actually does with payment instructions and customer money.

Under the RBI 2025 Master Direction, a Payment Gateway (PG) provides technology infrastructure to route and facilitate processing of a payment transaction without handling funds. A Payment Aggregator (PA), by contrast, aggregates payments made by customers to merchants through one or more payment channels and subsequently settles the collected funds to those merchants. This distinction should be identified before incorporation, fundraising, bank integration or launch.

Legal basis: Payment and Settlement Systems Act, 2007 requires RBI authorisation for operating a payment system where the statutory framework applies.

Who Needs a Payment Gateway License (RBI PA Authorisation)?

A non-bank entity should examine RBI authorisation where its platform receives or pools customer funds on behalf of merchants and later settles those funds. The legal analysis should follow the actual transaction flow rather than the product name used in marketing.

• An online checkout or merchant-acquiring platform that collects customer funds before onward settlement to merchants.
• A physical merchant-acquiring model that aggregates funds for onboarded merchants at or near the point of sale.
• A cross-border aggregation model facilitating permitted inward or outward e-commerce payments under the PA-CB framework.
• A marketplace group that proposes a separate payment aggregation business. RBI requires PA business to be separated from marketplace business, so structure should be reviewed carefully.

Banks do not require a separate PA authorisation for carrying on PA business under the 2025 Directions. A non-bank entity does. A pure technology PG that never handles funds does not fall within the PA Master Direction, though contracts, security, outsourcing and banking arrangements still require careful design.

Payment Gateway License Eligibility in 2026-27

• Indian company required. A non-bank PA must be a company incorporated in India under the Companies Act, 2013. The Memorandum of Association should cover the proposed PA activity.
• Correct object clause. The constitutional documents should support payment aggregation, payment technology and connected permitted activities without creating a conflict with restricted or unrelated business.
• Minimum net worth. The applicant must have at least ₹15 crore net worth when the application is tendered and must reach at least ₹25 crore by the end of the third financial year from grant of authorisation. The applicable minimum must be maintained on an ongoing basis.
• Fit-and-proper management. Promoters and directors should demonstrate integrity, sound reputation, financial soundness and absence of prescribed disqualifications.
• Technology and security capability. The business should have a credible technology architecture, information-security framework, fraud controls, business continuity processes and merchant/security controls suitable for a regulated payment operation.
• Regulatory NOC where applicable. If the applicant is already regulated by a financial-sector regulator, the relevant NOC requirement should be checked and complied with before/while filing as prescribed.
• FDI and ownership compliance. Where foreign investment is involved, the applicant must align with applicable FDI policy, FEMA requirements and RBI restrictions concerning investment from FATF non-compliant jurisdictions.

Net-Worth Requirement: ₹15 Crore to ₹25 Crore

Capital readiness is one of the most important pre-application checks. Under the RBI 2025 PA Directions, an entity seeking authorisation must have a minimum net worth of ₹15 crore at the time of application and attain ₹25 crore by the end of the third financial year after authorisation. The applicable level must then be maintained continuously.

For 2026–27 applications, net worth should be computed with the current RBI authorisation framework in mind. The 2026 Authorisation Directions describe net worth broadly through paid-up equity, compulsorily convertible preference shares, eligible reserves and share premium, adjusted for accumulated losses, intangible assets, deferred revenue expenditure and deferred tax assets. A statutory auditor certificate is required to evidence compliance.

Documents Required for Payment Gateway License

The exact document list can vary with the applicant’s ownership, stage, business category and RBI queries. A strong file is usually prepared as a regulatory dossier rather than a simple form submission.

Payment Gateway License Application Process

• Regulatory classification — Map the exact transaction flow and determine whether the activity is a PG only or a PA-O, PA-P and/or PA-CB business.
• Incorporation and object review — Use an Indian company and ensure the MoA permits the proposed regulated activity.
• Capital readiness — Confirm the applicable ₹15 crore net-worth position and prepare statutory auditor evidence.
• Governance and fit-and-proper review — Compile promoter, director, group and ownership information and resolve avoidable red flags before filing.
• Build the regulatory dossier — Prepare the business plan, policies, technology architecture, merchant due diligence, escrow and grievance frameworks.
• Submit on PRAVAAH — File the application through the RBI PRAVAAH portal in the prescribed manner, with applicable supporting information.
• RBI scrutiny and queries — Respond to clarifications, additional-document requests, technology/compliance questions or supervisory observations within the stated timelines.
• Authorisation and operational readiness — After authorisation, implement all conditions, escrow arrangements, reporting, audits, merchant controls and security requirements before scaling operations.

RBI authorisation is not an automatic approval merely because a company is incorporated or capitalised. RBI may assess the applicant’s financial strength, ownership, governance, technology, risk controls, compliance readiness and overall suitability. Under the 2026 Authorisation Directions, new payment-system authorisations may be granted on a perpetual basis, subject to continued compliance and RBI supervisory powers.

Merchant KYC and Due Diligence

Merchant due diligence is a core operating obligation. The 2025 Directions require PAs to conduct customer due diligence of merchants in accordance with RBI KYC requirements, retrieve or verify CKYCR records as applicable, undertake background and antecedent checks, correctly assign merchant identifiers/category codes, monitor transactions against the merchant’s business profile and maintain safeguards so settlement reaches eligible merchant accounts.

For certain smaller merchants, the 2025 Directions provide an alternative process where annual turnover does not exceed ₹40 lakh or annual export turnover does not exceed ₹5 lakh, subject to specified PAN/Form 60 verification, contact-point verification and officially valid document requirements. This should be implemented exactly as permitted and not treated as a blanket KYC exemption.

Escrow Account and Settlement Requirements

A non-bank PA must maintain funds collected on behalf of merchants in a separate escrow account with a Scheduled Commercial Bank in India. The 2025 Directions define permitted credits and debits, day-end balance expectations, additional escrow account conditions, transfer controls and auditor certification requirements. PA-CB businesses use separate Inward Collection Account and Outward Collection Account structures as applicable.

• Escrow money should be used only for authorised PA business and permitted settlement/refund flows.
• The merchant agreement should transparently state settlement timelines and responsibilities.
• Refunds generally go back to the original payment method unless the payer specifically chooses another mode belonging to the same payer.
• Escrow arrangements do not replace proper reconciliation, chargeback management, audit trails and merchant-level accounting.
• Domestic and cross-border pools must be kept appropriately separate where the business undertakes both activities.

Cyber Security, Payment Data and Technology Controls

Payment businesses are technology businesses with regulatory consequences. The 2025 PA Directions require adequate information and data-security systems, fraud detection and prevention, a board-approved Information Security Policy, merchant infrastructure compliance with standards such as PCI-DSS/PCI-SSF where applicable, payment-data localisation compliance and annual system/cyber-security audit by CERT-In empanelled auditors.

Authorised non-bank PSOs are also governed by RBI’s 2024 Master Directions on Cyber Resilience and Digital Payment Security Controls. Those directions use phased implementation based on PSO size. By 2026, the compliance framework is already relevant for large and medium non-bank PSOs, while smaller PSOs have a later implementation date under that framework.

Data Protection and Privacy in 2026–27

A payment business may process identity, device, transaction, merchant and support data. In addition to RBI-specific payment-data requirements, the organisation should map obligations under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 according to their phased commencement. Privacy notices, data inventories, processor contracts, access controls, retention practices and breach-response processes should align with the provisions that are in force on the relevant date.

Dispute Resolution, Refunds and Failed Transactions

A PA should maintain a clear dispute-management framework covering failed transactions, refunds, chargebacks, merchant disputes, reason codes, responsibilities and escalation. The website or app should prominently disclose merchant policies, privacy terms and grievance-redressal details. Contracts with acquiring banks, merchants and service providers should clearly allocate operational responsibilities.

Cross-Border Payment Aggregator (PA-CB)

Businesses facilitating e-commerce collections for permitted cross-border current-account transactions require a separate PA-CB analysis. The 2025 framework recognises inward and outward PA-CB activity and imposes FEMA, collection-account, transaction-identification and reporting requirements. The maximum value per PA-CB transaction under the 2025 Directions is ₹25 lakh.

PA-CB funds for inward and outward transactions cannot be co-mingled or netted. The business must work with Authorised Dealer banks, maintain required InCA/OCA structures, support EDPMS/IDPMS closure where applicable and respect FEMA restrictions on underlying transactions.

Payment Gateway License Compliance After Authorisation

• Maintain prescribed net worth and submit regulatory/financial reports in the form and periodicity required by RBI.
• Maintain escrow/collection accounts and obtain statutory-auditor certifications at the prescribed periodicity.
• Conduct annual system and cyber-security audit by an eligible CERT-In empanelled auditor and close observations promptly.
• Maintain merchant CDD, ongoing transaction monitoring, prohibited-business controls and FIU-IND reporting where applicable.
• Maintain board-approved policies for information security, fraud risk, outsourcing, grievance redressal and business continuity.
• Keep customer/merchant disclosures, privacy terms, refund rules, escalation details and contracts updated.
• Obtain prior RBI approval where a takeover/acquisition of control, change in management or sale/transfer of payment-system activity triggers the applicable requirement.
• Continuously monitor RBI circulars, master directions, FEMA updates, KYC rules, cyber-security requirements and statutory changes.

Common Mistakes to Avoid

• Calling a fund-handling aggregator a payment gateway and assuming that no RBI authorisation is required.
• Incorporating with an object clause that does not adequately cover the proposed PA activity.
• Applying before the ₹15 crore net-worth position is properly evidenced and sustainable.
• Using a generic business plan that does not show the real payment flow, settlement cycle, merchant categories and risk controls.
• Underestimating merchant KYC, sanctions/AML screening, transaction monitoring and prohibited-merchant controls.
• Treating cyber security as an IT vendor issue instead of a board-level regulated risk.
• Designing settlement outside the RBI escrow architecture or using collected merchant funds for unrelated business purposes.
• Ignoring data localisation, privacy, outsourcing, audit and incident-response obligations.
• Launching a cross-border model without a separate FEMA and PA-CB review.
• Promising customers or investors a guaranteed RBI licence timeline or approval.

Estimated Timeline and Professional Work

There is no fixed guaranteed licence timeline because RBI scrutiny depends on the completeness of the application, business model, ownership, technology readiness, capital position and regulatory queries. The pre-filing stage itself can require substantial work, especially where corporate objects, capital, technology documentation, merchant policies or group structure need correction.

A realistic engagement should therefore separate: (1) eligibility and structure review, (2) document and policy preparation, (3) PRAVAAH application filing, (4) regulatory query support, and (5) post-authorisation compliance implementation. Government decisions and processing periods remain outside the control of any consultant or filing platform.

Why Choose Vakilkaro for Payment Gateway License?