Regulatory AlertsIndia: fintech & payments regulation
RegulatedPayments regulated by RBI under PPI & Payment Services Acts; SEBI governs securities
- Lead regulator
- Reserve Bank of India (RBI)
- Also involved
- SEBI (securities) · FIU-IND (AML) · DPDP Act (data)
- Core law
- Payment and Settlement Systems Act, 2007
- Entry capital
- INR 5 crore (PPI)
- Approval timeline
- 6-12 months for PPI license
- Customer assets
- Segregated in escrow account with scheduled banks
- Data protection
- DPDP Act 2023 · MeitY
- Sandbox
- Yes - Regulatory Sandbox
The Reserve Bank of India (RBI) exclusively regulates payment systems, wallets, and remittances under the PSS Act. Securities activities are supervised by SEBI. The regulatory environment is strict, requiring full compliance with KYC, AML, and data localization norms.
Which licence do you need?
| Your activity | Requirement | Capital | Timeline | Authority |
|---|---|---|---|---|
| Payment processing / gateway | LicencePayment Aggregator (PA) License Must be a wholly-owned subsidiary of a bank or NBFC | INR 15 crore | 6-9 months | RBI |
| E-money & wallet issuance | LicencePrepaid Payment Instrument (PPI) License Full KYC required for wallets above INR 1 lakh | INR 5 crore | 6-12 months | RBI |
| Domestic money transfer | LicencePayment System Operator (PSO) License Required for operating domestic payment systems | INR 50 crore | 6-12 months | RBI |
| Cross-border remittance | LicenceMoney Transfer Service Operator (MTSO) License Strict AML/CFT compliance under FEMA | INR 25 lakh | 3-6 months | RBI |
| Agent network | RegistrationBanking Correspondent (BC) Registration Act as agent for licensed banks/NBFCs | None | 1-3 months | RBI / Partner Bank |
| Open banking / account information | Uncertainverify with regulator Account Aggregator framework under development | — | — | — |
| Foreign-exchange services | LicenceAuthorized Dealer (AD) Category I/II License Strict FEMA compliance for forex transactions | Varies | 3-6 months | RBI |
New — what changed recently
- 2023-08-01DPDP Act — Digital Personal Data Protection Act enacted, imposing strict data localization and consent requirements
- 2022-06-01PSS Amendment Rules — Enhanced KYC and AML requirements for PPIs and PAs introduced
- 2021-04-01Account Aggregator Framework — Consent-based data sharing framework launched for open banking
Market-entry checklist
- 1Obtain RBI PPI/PA LicenseApply to RBI with INR 5-15 crore capital and clean track record
- 2Establish Escrow AccountOpen segregated escrow account with scheduled commercial bank
- 3Implement KYC/AMLDeploy full KYC and AML systems compliant with FIU-IND norms
- 4Data LocalizationEnsure all payment data is stored only on servers in India
- 5Register with FIU-INDFile STRs/CTRs with Financial Intelligence Unit-India
- 6Comply with DPDP ActImplement data protection officer and consent mechanisms
This guide is compiled automatically from 0 primary-source documents published by India's regulators, reviewed by RegAlert, and refreshed monthly (last updated 2026-07-12). It is not legal advice — always confirm requirements with the regulator or local counsel before acting.