RBI payment aggregator rules: what they mean for a startup taking payments through Razorpay or Stripe

Does a startup that takes payments need its own payment aggregator authorisation?

The Directions apply to 'all bank and non-bank entities undertaking the business of Payment Aggregator' (para 3). A Payment Aggregator is an entity that 'facilitates aggregation of payments made by customers to the merchants through one or more payment channels' and then passes the money on (para 4(i)). A merchant is 'an entity or a marketplace that sells goods, provides services, or offers investment products' (para 4(f)).

Authorisation in para 5 is about running that aggregation business: a non-bank PA must be an Indian company with payment aggregation in its Memorandum of Association, and must have a net worth of ₹15 crore when it applies, rising to ₹25 crore by the end of the third financial year after authorisation (paras 5(c) and 6(a)). We found no provision that asks a merchant selling its own product through an authorised PA to be authorised itself.

How can I check that Razorpay or Stripe is authorised?

The RBI publishes the entities authorised under the Payment and Settlement Systems Act, 2007, including payment aggregators. On the list as on 16 October 2026, Razorpay Payments Private Limited (formerly Razorpay Software Private Limited) holds PA-O 'Razorpay' dated 19.12.2023, with PA-P and cross-border (PA-CB, inward and outward). Stripe India Private Limited holds PA-O 'Stripe' dated 15.01.2024.

Check the list for whichever company your agreement is with, because a brand can sit in several legal entities. Razorpay Technologies Private Limited, for example, appears separately under prepaid payment instruments.

What will the payment aggregator ask of my business?

The PA must run customer due diligence on you under the RBI's KYC Master Direction, check your background, verify that settlements go only to your own bank account, and monitor your transactions against your business profile (paras 13(a), 13(c), 13(g), 13(h)). A simplified check is allowed for merchants with annual turnover up to ₹40 lakh, or export turnover up to ₹5 lakh (para 13(b)). Merchants onboarded up to 31 December 2025 have one year from the Directions to meet these requirements.

The PA must also publish its merchant policies, privacy policy and terms, and name an officer for merchant issues with an escalation matrix (paras 8(c), 8(d)). It may not cap the amount for a particular payment mode (para 10(d)), and any charges beyond the price of the goods or services must be shown to the payer before the transaction (para 10(c)).

What if my app is a marketplace collecting money for other sellers?

The Directions define a marketplace as an e-commerce entity that provides an IT platform connecting buyers and sellers (para 4(e)) and count it as a merchant (para 4(f)). A PA must make sure a marketplace it onboards does not accept payments for a seller who is not onboarded on that marketplace (para 13(f)), and a PA may not run a marketplace itself (para 10(b)). Non-bank PAs hold merchants' funds in a separate escrow account with a scheduled commercial bank (para 16(a)).

Can my app save customers' card numbers for one-tap checkout?

No. Since 1 October 2022, 'no entity in the card transaction / payment chain, other than the card issuers and / or card networks, shall store CoF data', and data stored earlier had to be purged. The only exception is guest checkout: a merchant or its PA may keep the data for settlement for up to T+4 days or until settlement, whichever is earlier.

Saved cards work through card-on-file tokenisation instead. The 2021 circular lets entities keep 'limited data – last four digits of actual card number and card issuer's name' for tracking and reconciliation, requires explicit customer consent validated by the card issuer with an additional factor of authentication, and requires the merchant to let the cardholder de-register a token. The 2025 Directions add that card credentials must not be stored in a database or server the merchant can access (Annex 1, para 2.1).

How must refunds and disputes work?

Refunds go to the original method of payment, unless the payer asks for an alternative account that also belongs to them (para 10(f)). The PA must run a dispute mechanism with refund timelines (para 8(a)), and its agreement with you must set out who handles refunds, failed transactions, returns, grievances and reconciliation (para 8(b)).

What do card subscriptions need?

A recurring card payment runs on an e-mandate. The mandate can be registered only after successful additional-factor authentication; the card issuer notifies the cardholder at least 24 hours before each debit; and the cardholder can withdraw the mandate online at any time (August 2019 circular). Since June 2022, later debits up to ₹15,000 per transaction go through without additional authentication.