Reserve Bank of India (Regulation of Payment Aggregators) Directions, 2025

What it does

A payment aggregator receives payments from customers on behalf of merchants and settles them to the merchants afterwards. It does so within the payment systems framework of the Payment and Settlement Systems Act, 2007, under which the Reserve Bank authorises and supervises such entities. The Directions, issued on 15 September 2025 under reference RBI/DPSS/2025-26/141, are the Reserve Bank's current statement of the rules that apply to that activity.

The part of the Directions that the site's notes draw on concerns authentication. Paragraph 10(e) bars a payment aggregator from offering the automated teller machine (ATM) PIN as a factor of authentication for card not present transactions. The page does not summarise the rest of the Directions, and a reader who needs a rule on authorisation, net worth, escrow, merchant onboarding or settlement should read the Directions themselves.

Who it binds

Payment aggregators, whether banks or non-banks, in respect of the aggregation business, and the merchants and customers who deal with them, to the extent the Directions require the aggregator to impose terms on them. An aggregator is also a payment system provider or participant for the Reserve Bank's separate Authentication Directions, and those apply to it to that extent.

What has changed, and when

The Directions date from 15 September 2025. They were issued ten days before the Authentication Directions of 25 September 2025, which require two distinct factors of authentication for a domestic digital payment, at least one of them dynamic unless the card is physically used at the point of transaction. The Authentication Directions required compliance by 1 April 2026.

What turns on it in practice

The site's note on the two-factor rule, in the financial technology and payments area, treats the two instruments together. For a payment aggregator the Authentication Directions apply to the extent that it is a payment system provider or participant, and its own Directions separately close off the ATM PIN as a factor for card not present payments. Where a loss arises from a transaction effected without complying with the Authentication Directions, the issuer compensates the customer in full, so a checkout design that relied on a PIN is a risk for the issuer and for the commercial relationship between the aggregator and its banks.

A merchant that integrates an aggregator should expect its contract to pass these rules down, and an aggregator that offers a payment flow should confirm that the authentication factors it permits are consistent with both instruments.