A surprising number of Indian software products drift into being payment aggregators without anyone deciding to. If your platform collects money from a customer and later passes it to a merchant — a marketplace, a booking product, a services platform taking payment on behalf of providers — you are handling funds that are not yours, and the Reserve Bank has a specific view about who is allowed to do that. The framework began with the PA-PG guidelines of 17 March 2020 and was expanded in November 2024 to bring offline payment aggregators and cross-border aggregators inside the perimeter.
The capital requirement is the first hard gate. An applicant needs a net worth of fifteen crore rupees at the time of submitting Form PA, and must reach twenty-five crore within three years of authorisation and hold it permanently thereafter, evidenced by an annual net worth certificate. For a young product company this is not a compliance line item, it is a fundamental question about whether to hold the licence at all or to build on top of an already-licensed aggregator. That decision belongs at board level, early, because it shapes the architecture.
The technical prerequisites are equally concrete. PCI-DSS certification is expected before application. All customer funds must flow through an escrow account with a scheduled commercial bank, settlement to merchants must complete within one working day of collection, and interest earned on the escrow may not be used by the aggregator. Board-approved policies for merchant onboarding, KYC and AML, information security and grievance redressal must exist as documents, not intentions. Application to authorisation typically runs four to six months, with a due diligence exchange in the middle.
Merchant onboarding carries obligations that engineering teams usually discover late. Every merchant needs verification before onboarding — PAN, bank account, and proof the business exists via GST registration, shop establishment licence or equivalent. Merchants with annual turnover above forty lakh rupees require enhanced due diligence including physical or video verification. That is a workflow, a document store, an audit trail and a review queue, and it is rarely in the original product plan.
The aggregator is also responsible for what its merchants do with card data, and merchants may not store cardholder credentials or sensitive authentication data at all. This constrains the whole platform design: any feature that quietly caches a card number for convenience, any log line that records a payload verbatim, any support tool that displays full credentials, is a problem you own even when a merchant's developer created it. Designing so that the data never reaches those systems is far easier than policing them afterwards.
Operating without authorisation is a contravention of the Payment and Settlement Systems Act, 2007, with fines up to ten lakh rupees and a further one lakh per day while the violation continues. The per-day component is what makes this different from most compliance risk — it does not sit still while you arrange a fix. If you are unsure whether your product is inside the perimeter, the question to answer honestly is not what you call yourself but whether money belonging to someone else ever rests in an account you control.
