RBI to restrain payment aggregators from storing debit, credit card data from Aug 2025

The Reserve Bank of India (RBI) is apparently getting strict with payment aggregators (physical) with introduction of new draft regulations, which stipulate that the non-banking entities which fail to apply for authorisation and are unable to maintain the net worth of ₹15 crore at the time of applying will have to close their business down by July 31, 2025. 

The good news for users of debit and credit cards is that the payment aggregator firms will not be allowed to store card on file (COF) data from August 1 next year onwards. The only entities allowed to store the COF data will be card issuers and card network such as VISA, Mastercard and bank, says the RBI's draft circular. 

“For face-to-face / proximity payment transactions done using cards, from August 1, 2025, no entity in the card transaction / payment chain, other than the card issuers and / or card networks, shall store the CoF data,” reads the circular.

ALSO READ: RBI acts on credit card usage for P2P payments like rent and tuition fees: Will it ban them?

And the previously stored data will have to be purged. For the purpose of tracking transactions or for reconciliation, entities will be allowed to store limited data i.e. last four digits of card number and card issuer's name.   

However, since these regulations are still at the ‘draft’ stage, they would be implemented only after comments from the stakeholders are received. 

The banking regulator has also stipulated that these PAs will have to maintain the minimum net worth of ₹25 crore at all times. 

What is a payment aggregator?

Payment aggregator is a third-party service provider that enables customers to make payment to merchants. 

It is only through these payment aggregators that customers are able to make payment via debit & credit cards, UPI, bank transfer. These payment aggregators include Amazon Pay, Razorpay, Paytm, Cashfree, PhonePe and GooglePay. 

What do payment aggregators need to do?

It is clear that the commercial banks do not require special authorisation from the RBI when they provide physical payment aggregator services as part of their normal banking relationship.

All they need to do is to ensure that they comply with these instructions within three months from the date circular is issued.

ALSO READ: RBI mandates regulatory approval for PoS providers to continue operations

On the other hand, non-bank entities will inform the RBI within 2 months from the issuance of this circular.

The RBI also made it clear that an authorised non-bank payment aggregator which wants to commence physical aggregator activity will have to seek clearance from department of payment and settlement systems (DPSS) and RBI’s central office before starting such business.

The net worth requirement for this entities is ₹15 crore at the time of submitting application and they would need to attain a minimum net worth of ₹25 crore by the end of the third financial year of grant of authorisation.

ALSO READ: Personal loans vs credit cards: How to choose between the two?

The non-bank entities will have to maintain this level at all times thereafter. 

RBI has made it clear that all existing non-bank payment aggregator (physical) which are not able to comply with the net worth requirement or do not apply for authorisation will close their business by July 31, 2025. 

Amendment to the current directions

Some current set of regulations have also been proposed to be amended. These include the following:

A. Payment aggregators will need to undertake due diligence of merchants onboarded by them.

ALSO READ: RBI likely to issue license framework for point-of-sale players soon, 3rd party operators may be affected

B. They will have to ensure that marketplaces onboarded by them do not collect and settle funds for services not offered through their platform.

C. Moreover, non-bank PAs will ensure registering themselves with the financial intelligence unit-India (FIU-India).

D. The existing PAs will have to ensure that for all existing merchants the due diligence process is completed by Sept 30, 2025.