TL;DR: A Payment Aggregator (PA) enables merchants to accept digital payments through channels such as cards, UPI, and net banking. Businesses that want to operate as a payment aggregator in India must meet the applicable Reserve Bank of India (RBI) requirements and obtain the necessary authorization. The process involves company structure, financial eligibility, governance, technology, risk management, KYC, data security, and detailed documentation.
What Is a Payment Aggregator?
A Payment Aggregator (PA) is a business that facilitates online payments for merchants. It allows customers to pay through different payment methods without requiring each merchant to establish separate arrangements with multiple payment networks.
Depending on the payment services offered, customers may use:
- Credit and debit cards
- UPI
- Net banking
- Prepaid instruments and other permitted payment methods
The payment aggregator receives or facilitates the movement of payment funds and settles the amount with the merchant according to the applicable arrangement.
For example, when a customer purchases a product from an online store and pays through UPI or a card, the payment flow can involve a payment aggregator before the funds reach the merchant.
This makes the PA an important part of the digital payments ecosystem.
Payment Aggregator vs. Payment Gateway
Payment aggregators and payment gateways perform different roles.
A payment gateway primarily provides the technology that securely facilitates a payment transaction between the merchant, customer, and relevant payment participants.
A payment aggregator provides a broader payment acceptance and settlement service for merchants. Depending on its business model and regulatory classification, a PA may handle payment funds and merchant settlement.
This distinction matters when planning a payment business.
If your proposed model involves handling customer funds or providing merchant payment aggregation services, you should assess the RBI authorization requirements before starting operations.
Why Do You Need RBI Authorization for a Payment Aggregator?
Payment services involve customer funds, sensitive financial information, and significant operational risks. RBI regulates payment systems to promote the safety, security, and reliability of digital payments.
The applicable regulatory framework helps address areas such as:
- Customer fund protection
- Merchant onboarding
- KYC and AML controls
- Data security
- Cybersecurity
- Fraud risk management
- Grievance redressal
- Governance and internal controls
- Merchant settlement
Operating a regulated payment business without meeting the applicable RBI requirements can create serious legal and regulatory risks.
Who Can Apply for a Payment Aggregator Authorization?
The first step is to determine whether your proposed business qualifies as a payment aggregator under the RBI framework.
The regulatory requirements can depend on the nature of the proposed activity.
A prospective applicant should assess:
Company Structure
The applicant should have an appropriate corporate structure that meets the applicable RBI requirements.
A business should not assume that a proprietorship, partnership, or ordinary technology company can automatically operate as a payment aggregator.
Financial Strength
RBI prescribes financial and net-worth requirements for payment aggregators.
The applicable requirement can depend on the category and nature of the PA activity. Therefore, applicants should verify the current RBI framework before relying on an older net-worth figure.
Governance and Management
RBI expects regulated entities to maintain appropriate governance arrangements.
The management structure should support:
- Risk management
- Compliance
- Information security
- Internal controls
- Customer protection
- Business continuity
Technology and Security
A payment aggregator handles highly sensitive payment information.
The applicant therefore needs appropriate technology, security controls, monitoring systems, and risk-management processes.
Depending on the payment model, relevant security and payment-card standards may also apply.
KYC and AML
The business must establish appropriate customer and merchant due diligence procedures.
The compliance framework should address areas such as
- Customer identification
- Merchant verification
- Transaction monitoring
- Suspicious activity
- Fraud prevention
- Record keeping
Documents Required for Payment Aggregator Authorization
The exact documentation depends on the applicant and its proposed business model. However, an application generally requires detailed corporate, financial, operational, and compliance information.
Common documents and information may include:
- Certificate of Incorporation
- Memorandum and Articles of Association
- Details of directors and key management personnel
- Shareholding and ownership information
- Financial statements
- Net-worth certificate or applicable financial certification
- Board resolutions
- Detailed business plan
- Payment flow and fund-flow structure
- Merchant onboarding policy
- KYC and AML policies
- Risk-management framework
- Information-security policies
- Cybersecurity controls
- Data-protection and privacy framework
- Grievance-redressal mechanism
- Business continuity and disaster-recovery plan
- Technology architecture and system details
- Details of banks, payment networks and other relevant partners
- Any additional documents requested by RBI
Do not prepare the application using an old checklist alone. RBI may require additional information based on the nature of the proposed business.
Payment Aggregator License Process in India
The application process requires more than submitting a form. RBI evaluates the applicant's business model, financial position, governance, and compliance framework.
Step 1: Assess Your Business Model
Start by defining exactly what your payment business will do.
Identify:
- Who will use the platform?
- Which merchants will you onboard?
- Which payment methods will you offer?
- How will customer funds move?
- Who will hold the funds?
- How will merchant settlements work?
- Which banks or payment partners will you use?
- What technology will support the transactions?
This assessment helps determine the regulatory requirements that apply to your business.
Step 2: Establish the Required Corporate Structure
Set up the business structure required under the applicable RBI framework.
Review the company's objects, ownership, management structure, and proposed activities before submitting the application.
Step 3: Meet Financial Requirements
Review the current RBI financial and net-worth requirements applicable to your PA category.
Obtain the necessary financial certifications and maintain proper accounting records.
Step 4: Build the Compliance Framework
Your business should have documented policies covering areas such as:
- KYC
- AML
- Risk management
- Information security
- Cybersecurity
- Data protection
- Merchant onboarding
- Grievance handling
- Fraud monitoring
- Business continuity
A strong compliance framework can also make the regulatory review more efficient.
Step 5: Prepare the Application
Prepare the corporate, financial, technical, and operational documents required for the application.
The business plan should clearly explain how the payment platform will operate and how the company will manage financial, operational and cybersecurity risks.
Step 6: Submit the Application to RBI
Submit the application through the applicable RBI process along with the required documents and information.
The application should remain consistent across the business plan, financial documents, corporate records, and technology information.
Incomplete or inconsistent information can lead to additional queries and delays.
Step 7: RBI Assessment
RBI reviews the application and evaluates the applicant against the applicable regulatory requirements.
The review may involve questions or requests for additional information.
The applicant should respond accurately and within the required timelines.
Step 8: Authorization and Commencement of Operations
If RBI grants the required authorization, the company can commence the regulated activity subject to the conditions and ongoing requirements applicable to its authorization.
Receiving authorization does not end the compliance responsibility. The PA must continue meeting RBI requirements during its operations.
Post-Authorization Compliance for Payment Aggregators
Payment aggregators need continuous compliance after receiving authorization.
Key areas include:
Merchant Due Diligence
The PA should conduct appropriate due diligence before onboarding merchants and continue monitoring them based on the applicable risk framework.
Customer Fund Management
Customer funds require careful handling and settlement controls.
The PA must follow the applicable requirements for escrow or other prescribed arrangements and merchant settlement.
Cybersecurity
Payment businesses face significant cybersecurity and fraud risks.
Regular monitoring, security testing, incident management, and appropriate technical controls form an important part of ongoing operations.
KYC and AML Compliance
The company must maintain appropriate KYC and AML procedures and monitor transactions according to applicable requirements.
Grievance Redressal
Customers and merchants should have a clear mechanism to raise complaints and receive appropriate resolution.
Audits and Reporting
A regulated Payment Aggregator must maintain proper records and complete applicable audits, reporting and compliance activities within the prescribed timelines.
Common Challenges in Payment Aggregator Licensing
Starting a payment aggregation business involves more than obtaining regulatory approval.
Businesses commonly face challenges related to:
Regulatory compliance: RBI requirements can cover several areas of the business.
Technology: Payment infrastructure needs strong security, reliability and scalability.
Fraud prevention: Digital payment platforms can become targets for fraud and cyberattacks.
Merchant onboarding: The business needs effective due-diligence and monitoring systems.
Fund management: Payment flows and merchant settlements require robust controls.
Compliance costs: Legal, technology, cybersecurity, audit and compliance requirements can require significant investment.
Benefits of Becoming a Compliant Payment Aggregator
A properly authorized Payment Aggregator can build a stronger foundation for operating in India's digital payments ecosystem.
Key benefits include:
- Greater credibility with merchants and business partners
- Ability to operate within the applicable RBI regulatory framework
- Stronger risk and compliance systems
- Better customer trust
- Access to broader payment-business opportunities
- A structured framework for merchant payment services
However, authorization should not be viewed only as a business certificate. It comes with continuing regulatory responsibilities.
How Much Does Payment Aggregator Licensing Cost?
There is no single fixed cost that applies to every applicant.
The overall investment can include:
- Professional advisory fees
- Legal and documentation costs
- Corporate restructuring, where required
- Technology infrastructure
- Cybersecurity implementation
- Compliance systems
- Audit and certification expenses
- RBI-related application requirements
- Ongoing regulatory compliance costs
Your actual cost will depend on the existing structure of your company and the scope of your proposed payment business.
How Long Does the Process Take?
The timeline depends on the completeness of the application, the applicant's readiness and the regulatory review process.
Businesses should avoid relying on a fixed number of days or weeks.
A better approach is to prepare the corporate, financial, technical, and compliance framework before submitting the application. This can help reduce avoidable delays.
Why Choose CorpZo for Payment Aggregator Compliance?
A payment aggregator application involves multiple areas of business and regulatory compliance.
CorpZo can assist businesses with the preparation and coordination required for the application, including:
- Regulatory assessment
- Business structure review
- Documentation
- Application preparation
- Compliance policies
- KYC and AML framework
- Business plan preparation
- Coordination for required certifications
- Post-authorization compliance support
Our team helps businesses understand the regulatory requirements and prepare their application based on their proposed payment model.
Planning to start a payment aggregator business in India? Speak with a CorpZo expert before investing in the setup.
Call +91 9999 139 391 or WhatsApp CorpZo for a consultation.
Frequently Asked Questions
Is a Payment Aggregator license mandatory in India?
If a business falls within the regulated Payment Aggregator activity under the RBI framework, it must obtain the applicable RBI authorization before carrying out the regulated activity.
What is the difference between a payment aggregator and a payment gateway?
A payment gateway primarily provides technology for facilitating payment transactions. A payment aggregator provides merchant payment aggregation and settlement services and may handle payment funds under the applicable regulatory framework.
Can a startup apply for Payment Aggregator authorization?
A startup can explore the opportunity if it meets the applicable corporate, financial, technology, governance, and regulatory requirements. The proposed business model should undergo a regulatory assessment before application.
What documents are required?
Documents can include incorporation records, constitutional documents, financial information, business plans, ownership details, compliance policies, technology information and other documents required by RBI.
Does a payment aggregator need KYC and AML policies?
Yes. Payment businesses need appropriate customer and merchant due diligence, KYC, AML, and transaction-monitoring controls as applicable to their regulated activities.
Is PCI DSS compliance relevant to payment aggregators?
PCI DSS can be relevant where the business handles payment-card data. The exact security requirements depend on the payment architecture and services provided.
Can a payment aggregator operate without RBI authorization?
A business should not start a regulated payment aggregator activity without obtaining the authorization required under the applicable RBI framework.
Is Payment Aggregator authorization permanent?
Authorization comes with continuing regulatory obligations. RBI can take regulatory action where an entity fails to meet applicable requirements or authorization conditions.
Conclusion
Starting a payment aggregator business in India requires careful planning. You need to assess the business model, corporate structure, financial requirements, technology, cybersecurity, KYC, AML, and merchant-management framework before applying.
The most important step is to verify the current RBI requirements before preparing the application. Regulations and operational requirements can change, so businesses should not rely on outdated licensing articles or old financial thresholds.
If you are planning to launch a payment aggregator business, CorpZo can help you assess the proposed model and prepare the required regulatory and compliance framework.