Payment aggregator rules: what changed in 2025 for startups

A payment aggregator sits between customers and merchants. When a shopper pays for a pair of shoes on a website, the aggregator collects the money through a card, UPI or net banking, holds it for a short time, then settles it to the merchant. Razorpay, Cashfree and PayU are well-known examples of the model.

The merchant gets one integration and one settlement instead of dealing with each bank and network. The RBI regulates aggregators because they hold other people's money, even for a short while.

It differs from a payment gateway, which only passes payment data between the customer, the merchant and the bank without holding money. The 2025 directions deal with the entities that handle funds. Many companies offer both services, so a startup's description often blends the two terms.

The RBI issued the Master Directions on Regulation of Payment Aggregators on 15 September 2025. They pull earlier circulars and guidelines into one document and build on the earlier guidelines for payment aggregators.

The main change is a clear split into three kinds of aggregator, each with its own authorisation. As of November 2026, law-firm summaries say the directions took effect straight away.

The change also matters because of timing. Applicants who had been working under earlier rules had to move to the new framework and show they met the capital and governance standards. A news story about a licence is usually the result of this process.

The three types are defined by where and how the payment happens.

• PA-O (online): handles remote payments, such as a website or app checkout.
• PA-P (physical): handles payments made in person, for example at a shop counter through a card machine or a QR code.
• PA-CB (cross-border): handles payments between India and other countries, split into inward flows (a foreign customer pays an Indian merchant) and outward flows (an Indian customer pays an overseas merchant).

A non-bank company applying to become a payment aggregator needs a minimum net worth of ₹15 crore at the time of applying and must reach ₹25 crore by the end of the third financial year after getting authorisation. It must keep that level on an ongoing basis. Net worth, as defined in the summaries, also counts compulsorily convertible preference shares, which matters because many startups raise money that way.

Banks can run payment aggregation without a new authorisation. Non-bank aggregators had to apply to the RBI by 31 December 2025, and those that did not were expected to wind down by 28 February 2026, according to law-firm notes. Applications go through the RBI's Pravaah portal.

The licence is not free of conditions. The RBI can ask for reports, audits and changes in ownership, and a change in control normally needs prior approval, so investors reading a startup's cap table should check whether a large share transfer could trigger that approval.

All money collected by a payment aggregator has to sit in an escrow account with a scheduled commercial bank. The account cannot be used for cash-on-delivery transactions. A statutory auditor must separately certify that the aggregator follows the escrow rules.

Cross-border aggregators must keep separate collection accounts for inward and outward flows, with authorised dealer banks, and may not mix the two. A summary also says each cross-border transaction is capped at ₹25 lakh, but this figure should be checked against the RBI text.

The escrow rule is the most important safeguard. If an aggregator fails, the money in the escrow account is meant to be separate from its own debts, so merchants and customers have a better chance of getting paid. The settlement timelines are in the full RBI text.

Aggregators must check who their merchants are, following the RBI's KYC Master Direction of 2016. For smaller merchants, with annual domestic turnover below ₹40 lakh or annual export turnover below ₹5 lakh, simpler checks apply, such as PAN verification, contact point verification or an officially valid document.

Non-bank aggregators must also register with the Financial Intelligence Unit of India (FIU-IND). Banks that sign up merchants follow their own merchant acquiring policies.

A startup that only sells a product and uses an aggregator does not need a licence. A startup that collects money on behalf of others, such as a marketplace paying out to sellers or a platform that settles to vendors, may fall into the aggregator definition. That needs authorisation, capital and an escrow account.

The ₹25 crore net worth is a big step up for a young company. Investors look at whether the company has the capital, whether its investors can add more, and whether it uses a licensed aggregator partner while it builds up.

The three-way split also changes who competes. A PA-P can build a business around in-store payments, a PA-CB around exporters and freelancers, and a PA-O around online checkout, each with its own regulatory file.

Some startups choose to pay a licensed aggregator a small fee instead of getting their own licence, at least in early years. The decision to apply is partly about economics: owning the licence saves a margin on every payment but adds cost, capital and compliance.

When a story says a payments startup has received a payment aggregator licence, look for the type (online, physical or cross-border), whether it is an in-principle approval or a final authorisation, and the date. Also check whether a company says licence when it means it has applied. This guide is general information, not legal advice. Check with a professional before acting.