Payment Apps
Behind almost every payment app is somebody else's licence — usually a bank, a PPI issuer, or a payment aggregator.
If you move money in India, you run a regulated activity under the Payment and Settlement Systems Act. Even apps that look like a thin front-end — a UPI app, a wallet app — sit on top of a licensed entity. That entity is a bank, a PPI issuer, or a payment aggregator.
That underlying licence is not a background detail. It decides what data can flow. It decides how funds are held. It decides what user experiences you are allowed to build on top. So a choice that looks like pure UX is often a licence question in disguise.
Am I a Data Fiduciary?
Payment apps carry both PSS Act duties and DPDP duties on the same user — run the self-check to line up the DPDP side first.
Run it nowIf you are a payment aggregator
A payment aggregator sits between a merchant and the payment system, collecting money on the merchant's behalf. Since 15 September 2025 there is one rulebook for all of them.
The Reserve Bank of India (Regulation of Payment Aggregators) Directions, 2025 replaced the 2020 guidelines and the 2023 cross-border rules (para 21 and Annexure 3). They took effect immediately (para 2(a)).
Source: Master Direction on Regulation of Payment Aggregator (PA), CO.DPSS.POLC.No.S-633/02-14-008/2025-26, 15 September 2025, opened on rbi.org.in on 9 October 2026. Status checked 2026-10-09.
What changed most:
- Physical payment aggregation is regulated too now, not just online.
- If you are not a bank, you need RBI authorisation. You need ₹15 crore of net worth when you apply, and ₹25 crore by the end of the third financial year after you are authorised (para 6(a)).
- Your promoters and directors must meet fit-and-proper standards.
- Cross-border work needs separate accounts, and there are caps on it.
- You must check your merchants properly. You can pull their KYC record from the Central KYC Records Registry with their consent.
- There are fixed timelines for resolving disputes, and cybersecurity requirements.
Payment aggregators are also inside the scope of RBI's payment data localisation rules — see our payments page.
RBI (Regulation of Payment Aggregators) Directions, 2025
Issued 15 September 2025. Made under the Payment and Settlement Systems Act, 2007 with the relevant FEMA provisions; effective immediately on issue. Repeals the PA/PG Guidelines of 17 March 2020 and the 2023 cross-border payment aggregation directions, with limited savings for in-flight applications. Cited by name and date only — no primary-source URL has been retrieved and the text has not been opened.
Status unverified — no status check recorded
If you build the product, start your first design conversation there. Ask which regulated entity sits underneath. Everything from onboarding to complaints depends on that answer.
This page summarises finance and fintech expectations for orientation. For binding rulings on your product, consult qualified counsel and the primary source below.
Consolidated text on India Code. Amendment currency not individually checked.