Payment aggregator licence in India: who needs RBI authorisation and why

A payment aggregator, or PA, sits between shoppers and merchants. A customer pays the aggregator, the aggregator holds the money briefly, and then it settles with the merchant.

The benefit for a small merchant is simple. It does not need its own bank set-up for cards, net banking and wallets. It signs up with the aggregator and gets one integration for all of them.

Well-known examples in India include several large payment companies that serve online shops, apps and small businesses. Some are listed on the stock exchanges, and their filings show how much money they process and how much they keep as revenue. The gap between the two is often large, because most of what flows through belongs to the merchant.

The aggregator earns a small fee on each payment, often a percent of the amount. Because margins per payment are thin, the business depends on large volumes and on keeping fraud and failed payments low.

Because the aggregator holds customer money before it reaches the merchant, a failure could leave merchants unpaid. The RBI treats this as a payments risk and regulates it under the Payment and Settlement Systems Act, 2007.

The RBI issued guidelines for payment aggregators in March 2020, with later directions and clarifications. The rules are updated from time to time, so check the current text.

Any company that collects payments from customers and settles them to merchants, and that is not a bank, needs RBI authorisation to do so. Banks are covered by their own licence.

A marketplace that collects money from buyers and pays sellers can fall into this category. This caught several startups' attention, because many had been doing so without a separate authorisation.

Startups that run marketplaces, travel booking, food orders or education platforms with many sellers or service providers are the usual cases. A business that sells only its own products and receives money into its own account is generally in a different position.

The RBI's conditions are detailed. As of November 2026, the main ideas are these, but verify the exact figures and dates in the latest directions.

• A minimum net worth. The guidelines set a first figure at the time of applying and a higher one a few years later, in the crore range.
• Funds held in a separate escrow account with a bank, used only for settling payments.
• Rules on merchant checks, security and data storage, and on handling disputes and refunds.
• Directors and owners who meet fit-and-proper tests, and rules on who may hold control.

A payment gateway is technology. It passes card or bank details securely between the shopper, the merchant and the bank. It does not hold the money.

An aggregator collects the money and settles it later. Many companies offer both. The rules mostly bite on the money-holding side, not on the technology.

A simple test helps. Ask who holds the money between the customer paying and the merchant being paid. If the answer is a company that is neither a bank nor the merchant, that company is acting as an aggregator and needs the authorisation.

A UPI app lets a person send money from one bank account directly to another through the UPI system run by NPCI. The money moves between bank accounts without sitting with the app.

UPI apps are regulated through NPCI's framework for third-party apps and the banks behind them. An aggregator can accept UPI payments from customers, but its licence is about holding and settling merchant money.

An escrow account is a bank account that holds money for a set purpose. For an aggregator, the account holds customers' payments until they are settled to merchants. The aggregator cannot use that money for its own spending.

The RBI's rules limit what can be credited to and debited from the account. Customer payments come in, and settlements, refunds and the aggregator's agreed fee go out. The idea is that merchants' money stays separate from the aggregator's own money.

Settlement timing matters too. The rules set outer limits on how long an aggregator can hold funds before paying the merchant. These depend on whether the aggregator or the merchant is responsible for delivery, so read the current directions for the exact days.

The RBI treats some aggregator activity as a separate category. A cross-border aggregator handles payments for international sales of goods and services, with extra rules on how money moves in and out of India. An offline aggregator collects payments in person, such as through card machines or QR codes in shops.

A startup should check which kind it is. A company that sells to customers abroad, or that collects at a physical store, may be under a different set of conditions from one that only takes online payments from Indian customers.

As these categories have been added and changed over the years, a founder should confirm with a lawyer or the RBI's current directions before assuming a plan fits.

The RBI publishes a list of authorised payment system operators, including payment aggregators, on its website. Reading that list is the quickest way to check whether a company has been authorised or has only applied.

News stories often use the words in principle approval. This usually means the RBI has said yes to the application, subject to the company meeting remaining conditions, and that the final authorisation has not yet come. The two are different, so read headlines with care.

Startups that take online payments now often choose between getting authorised, partnering with an authorised aggregator, or using a bank's gateway. Each has a cost in time, capital and control.

Smaller companies tend to partner. Larger payments businesses apply for their own authorisation. The authorisation process itself takes months and needs capital, so plans are made early.

This guide is general information, not legal, tax or investment advice. Check with a qualified professional.