Payments and Wallet Data

If your app moves money in India, you must store the full transaction trail on servers located in India. That trail covers:

• Who paid.
• Who received.
• How much.
• At what time.
• From which device.

This is data localisation. It applies to the payment trail as a whole, not just a slice of it. The rule comes from RBI's circular of 6 April 2018 (RBI/2017-18/153, DPSS.CO.OD No. 2785/06.08.005/2017-2018). It is a Department of Payment and Settlement Systems instrument. So it sits outside the Department of Regulation consolidation of 28 November 2025.

What counts as payment data. RBI's FAQs of 26 June 2019 list four categories:

• Customer data
• Payment sensitive data
• Payment credentials
• Transaction data

The circular covers all data relating to the payment system. That means the full end-to-end transaction details. It also means everything collected, carried, or processed as part of the payment message or instruction.

There is no reading of that on which UPI, wallet or net-banking data sits outside the rule.

Who it applies to. The obligation reaches all payment system operators authorised by RBI under the PSS Act. It also reaches the entities in the payments ecosystem that they engage. Intermediaries, third-party vendors, and payment gateways are all included. Compliance responsibility rests on you, the authorised payment system operator, not on your vendor. If you outsource the processing, you do not outsource the duty.

Cross-border transactions. Say your transaction data has a foreign component and a domestic component. Then you may also store a copy of the domestic component abroad, if required. But the domestic trail must still sit in India. What the FAQ permits is a copy alongside it, not a substitute for it.

Storage in India is not the same as processing in India. The FAQs recognise that there is no bar on processing payment transactions outside India. But if processing happens abroad, you must delete the data from the overseas systems. You must also bring it back to India. The deadline is one business day or 24 hours from payment processing, whichever is earlier. Sharing payments data with an overseas regulator needs RBI approval. So offshore processing is not by itself unlawful — offshore retention is. Settlement flows that run near real time leave very little of that window in practice. If a payment is processed and settled within minutes, the deletion and return obligation bites the same day, not the next. Lending apps: the parallel rule

A fraud-intelligence layer sits alongside this. The Indian Digital Payment Intelligence Corporation was set up as a Section 8 company on 16 October 2025. Its job is to detect, prevent, and analyse digital payments fraud in real time. It uses AI, machine learning, and big-data analytics. It is not a regulator and issues no rules. So it adds nothing to your localisation duties. Fraud, disputes and chargebacks

Digital wallets are a separate category on top of that. If you run a wallet, you need a specific RBI licence. You also follow stricter KYC obligations and loading-limit rules than an ordinary payment app that just routes money between existing accounts. Pending confirmation

The wallet rules are being rewritten

The rules for prepaid payment instruments — wallets, prepaid cards, gift cards — come from an RBI Master Direction dated 27 August 2021. That is still the rule today. Pending confirmation

The RBI published a draft replacement on 22 April 2026 and took comments until 22 May 2026. It has not been finalised.

If it goes through as drafted, some things change: cross-border payments from wallets would stop, dormant wallets would close automatically, the cash withdrawal caps would be replaced by general RBI limits, and person-to-person transfer limits would fall. None of that is law yet.

One thing has already changed. Non-bank wallet issuers now follow the 2025 KYC Directions for commercial banks, because the old 2016 KYC rulebook was repealed in November 2025.

Cyber rules if you run a payment system

If you operate a payment system and you are not a bank, the RBI (Cyber Resilience and Digital Payment Security Controls for non-bank PSOs) Master Directions, 2024 apply to you. They were issued on 30 July 2024 under the Payment and Settlement Systems Act, 2007.

When you had to comply depends on your size (para 3). Large operators: 1 April 2025. Medium operators: 1 April 2026. Both dates have passed. Small operators have until 1 April 2028.

Source: CO.DPSS.OVRST.No.S447/06-26-002/2024-25, 30 July 2024, opened on rbi.org.in on 9 October 2026. Status checked 2026-10-09.

"Large" covers these operators:

• CCIL, NPCI, and NBBL.
• The card networks.
• Non-bank ATM operators.
• Large prepaid instrument issuers.
• TReDS operators.
• Bill payment operating units and payment aggregators.

Two things catch people out. You are responsible for the unregulated companies in your chain — your payment gateway, your third-party providers — and you have to bring them into line by agreement. And after someone changes their registered mobile number or email, you must wait 12 hours before allowing further transactions.

If you collect money on a merchant's behalf, the payment aggregator rulebook applies to you as well — see payment apps.

In practice, this means two design decisions from day one. First, where do the payment records physically live? Second, are you running a payment app on top of someone else's licence, or issuing a wallet under your own? That choice sets the compliance envelope for everything else your product does.