Payment Aggregator Licence in India: What RBI's 2025 Directions Actually Require

"Get a PSP licence in India" is, again, a search query rather than a regulatory category. What the Reserve Bank of India actually authorises is a specific activity — Payment Aggregator (PA) — and as of 15 September 2025 that authorisation has been restructured into three distinct categories under a single consolidated Direction. If your last research pass on this topic predates that date, it's already describing a superseded framework: the two-part 2020/2023 regime it likely cited has been repealed and folded into one rulebook.

RBI's notification is RBI/DPSS/2025-26/141 — the Reserve Bank of India (Regulation of Payment Aggregators) Directions, 2025, dated September 15, 2025. It repeals the March 2020 PA Guidelines (RBI/DPSS/2019-20/174), their November 2020 amendment, and the October 2023 PA-Cross Border circular (RBI/2023-24/80), and replaces all three with one Master Direction covering PA-Online, PA-Cross Border, and a genuinely new category, PA-Physical. This guide works through what the consolidation actually restructured, what carried forward unchanged, and what a foreign merchant or PSP entering India in 2026 needs to check before assuming the framework they researched last year still applies.

The Three Categories Now

The 2025 Direction splits PA authorisation into three categories, each defined by how the transaction is presented rather than by the merchant's industry:

PA-Online (PA-O) covers the category most foreign operators already think of as "the" PA framework — aggregation where the acceptance device and the payment instrument are not physically close together at the point of transaction. This is standard e-commerce checkout aggregation, and it's the direct successor to what the 2020 Guidelines regulated.

PA-Physical (PA-P) is the structurally new piece. It covers aggregation where the acceptance device and payment instrument are physically present in close proximity — point-of-sale card and QR aggregation. Before this Direction, physical/POS aggregation sat outside the formal PA licensing perimeter in a way online aggregation didn't; RBI has now brought it inside the same authorisation regime, with its own filing deadline (below) precisely because entities running this business previously had nothing to apply for.

PA-Cross Border (PA-CB) covers aggregation of cross-border payments tied to current-account transactions — import and export of goods and services conducted through e-commerce — for onboarded merchants, split into inward and outward subcategories. PA-CB previously sat in its own October 2023 circular; it's now one of three categories in the same rulebook as PA-O and PA-P, not a separate bolt-on authorisation.

An entity can hold more than one category, but each is authorised on its own terms, and an existing PA-O authorisation does not extend automatically to PA-CB or PA-P activity — a point that matters directly for the migration deadlines covered further down.

What Superseded What

Three instruments collapsed into one. The March 2020 PA Guidelines (RBI/DPSS/2019-20/174, updated November 2020) established the original online-only PA framework, including the net worth glide path still in force today. The October 2023 circular (RBI/2023-24/80) then carved out PA-CB as a separate regime, regulating entities that had previously operated as online payment gateway service providers (OPGSPs) or collection agents for cross-border e-commerce transactions under older foreign-exchange circulars — those older FEMA-era instruments were themselves repealed by the 2023 circular, with a savings clause protecting PA-CB applicants who had already filed by April 30, 2024 and had a decision still pending.

The September 2025 Direction repeals both the 2020 Guidelines and the 2023 PA-CB circular outright and restates their substance — plus the new PA-P category — as one Master Direction. Net worth, escrow mechanics, KYC, and audit obligations carried forward largely unchanged from the 2020 framework; what changed structurally is having one rulebook with three named categories instead of a base regime plus a bolt-on cross-border circular, and having PA-P inside the licensing perimeter for the first time. A grandfather clause preserves existing authorisations: approvals and actions taken under the repealed circulars remain valid and are deemed granted under the new Direction.

Net Worth, Escrow, and Settlement

The net worth bar is unchanged from 2020 and applies uniformly across all three categories: ₹15 crore minimum at the time of applying for authorisation, rising to ₹25 crore by the end of the third financial year after authorisation is granted, maintained on an ongoing basis after that. A statutory auditor's net-worth certificate is due annually by September 30.

Domestic PAs (PA-O and PA-P) must maintain escrow accounts with a Scheduled Commercial Bank in India, in rupees, with the day-end balance never falling below funds already collected but not yet settled to merchants. A "core portion" of the escrow balance can earn interest once the PA has 26 fortnights of operating history and audited full-year accounts — calculated as the average of the lowest fortnightly balances over that period — but no loan is permissible against that core amount. Quarterly, an auditor's certificate confirming escrow-balance compliance is due by the 15th of the month following quarter-end.

Settlement timing itself isn't fixed by the Direction — it runs "as per the agreement between the PA and the merchant," which must be fair, equitable, and transparent about the timelines it sets. Existing PAs had until December 31, 2025 to bring their account structures into the format the Direction requires.

The PA-CB Path for Cross-Border Merchants

PA-CB is the category that matters directly to a foreign PSP or merchant collecting on behalf of Indian exporters, or paying overseas sellers on behalf of Indian importers, through an e-commerce flow. It carries obligations the domestic categories don't:

A ₹25 lakh maximum per transaction applies to both inward and outward PA-CB flows. Inward transactions (foreign currency into India, typically export receipts) settle through an Inward Collection Account (InCA); outward transactions (rupees leaving India for overseas sellers, typically import payments) settle through a separate Outward Collection Account (OCA). Both must sit with an Authorised Dealer (AD) Category-I bank, and the Direction is explicit that inward and outward funds cannot be co-mingled or netted against each other under any circumstance. A PA-CB also cannot buy or sell foreign currency from or to any counterparty other than an AD bank — there's no route around the AD-bank chokepoint for the FX leg of a cross-border collection.

Because PA-CB was previously its own circular with its own applicant pool, a foreign operator's existing relationship with a PA-O-authorised partner does not automatically cover PA-CB activity — confirm which category your partner's authorisation actually covers before assuming cross-border collection is included.

Partner vs. Apply Direct

Almost no foreign operator pursues PA authorisation directly, for the same reason that's true in most licensed-intermediary markets: it means incorporating in India, meeting the net worth bar, and running the compliance program below as your own obligation rather than inheriting someone else's. The standard route remains partnering with an already-authorised Indian PA and operating under its authorisation — the pattern PaymentBrief documented for Brazil's instituição de pagamento framework, where nearly every foreign entrant works through an already-licensed local participant rather than seeking direct authorisation, applies here too, even though the regulatory mechanics differ completely between the two markets.

Where the Direction gives a concrete number relevant to timeline: it sets a 45-day window for regulated-entity applicants to submit a No-Objection Certificate as part of the authorisation process — a data point worth having, though it covers only one procedural step, not the full application-to-authorisation timeline, which the Direction doesn't state as a fixed figure.

Compliance That Doesn't Show Up in the Net-Worth Headline

Net worth is the number operators remember; it isn't the number that generates the most ongoing compliance load. Non-bank PAs must register with FIU-IND, India's financial intelligence unit, and meet its reporting obligations. PAs must run customer due diligence on every merchant they onboard, including retrieving KYC records from CKYCR with the merchant's consent, plus background and antecedent checks and ongoing monitoring that transactions match the merchant's declared business profile. A simplified verification path — PAN, Contact Point Verification, and an officially valid document copy — is available for smaller merchants (annual turnover up to ₹40 lakh domestically, or export turnover up to ₹5 lakh), but the full CDD obligation applies above those thresholds.

On the security side, PAs must run an annual system audit including a cyber security audit, performed by a CERT-In empanelled auditor, maintain a board-approved Information Security Policy, and comply with RBI's July 2024 Master Directions on Cyber Resilience. None of this is new in substance — it largely carries forward the 2020 framework — but it's the part of the compliance program that determines whether an authorisation stays valid, not just whether it's granted.

If You're Already Live Under the Old Framework

Existing authorisations are grandfathered: the Direction states that approvals and actions taken under the repealed circulars remain valid and are deemed granted under the new regime. That's not a blanket pass, though — two migration deadlines carry real consequences.

First, escrow and collection-account structures had to be reformatted to the Direction's requirements by December 31, 2025. Second, and more consequential for anyone running physical/POS aggregation: because PA-P wasn't formally licensed before this Direction, an entity carrying on PA-Physical business without prior authorisation must apply by December 31, 2025, or wind that business up by February 28, 2026. Entities with pending PA-Online or PA-CB applications must separately disclose any existing PA-Physical business by the same December deadline. If your India operation includes any POS or card-machine aggregation alongside online collection, this is the deadline to check first — it's the one part of the consolidation that creates a new authorisation obligation rather than just restating an old one.

On the merchant-facing side, a one-year transition applies to CDD: merchants onboarded before December 31, 2025 must be brought into compliance with the new due-diligence requirements within a year of the Direction; merchants onboarded from January 1, 2026 must meet the new requirements immediately.

Practical Checklist for Entering India in 2026

• Identify which category you actually need. Online checkout collection is PA-O; POS or card-machine collection is PA-P; cross-border import/export collection is PA-CB. These are not interchangeable, and a partner's existing authorisation may not cover all three.
• Assume direct authorisation is the exception, not the default. Confirm which category your Indian PA partner actually holds authorisation for before routing volume through them, particularly for PA-CB.
• If any part of your India business involves POS/physical aggregation, check the December 31, 2025 filing deadline immediately — this is the one genuinely new authorisation trap in the 2025 consolidation.
• For cross-border collection, plan around the ₹25 lakh per-transaction cap and the AD-bank-only FX requirement — both are hard constraints in the Direction, not negotiable partner terms.
• Treat FIU-IND registration, CDD, and the annual CERT-In cyber audit as ongoing obligations, not one-time onboarding steps — this is where authorised PAs actually lose their authorisation, not at the initial application stage.
• Data residency is a separate, pre-existing obligation, not part of this Direction — RBI's 2018 data-localisation rule still requires payment-system data to be stored in India, and it applies regardless of which PA category you fall under. See local acquiring vs. cross-border acquiring for how that mandate is structured.
• UPI and tokenisation obligations sit alongside, not inside, PA authorisation — a PA licence doesn't substitute for either, and both carry their own compliance tracks worth checking separately.

The consolidation doesn't change the basic shape of India market entry for a foreign operator — partner with an authorised PA for the large majority of use cases, reserve direct authorisation for the rare case where control over the licence itself is worth the net worth and compliance commitment. What it changes is precision: "PA-CB" and "PA-Physical" are now named categories inside one rulebook, not a separate circular and an unregulated gap, and the deadlines attached to that restructuring are real enough to check before assuming last year's compliance mapping still holds.