How Do You Check if a Payment Aggregator Is RBI Authorised?
- Author:
- Manoj Sharma
- Verified by:
- Editorial team
- Published:
- Last modified:
Short answer
To check if a payment aggregator is RBI authorised, search its full company name in RBI's list of Certificates of Authorisation. Then check RBI's status-of-applications page. An entity marked 'in-principle authorisation granted' is not yet authorised. Exporters receiving foreign payments should look for the PA-CB-I or PA-CB-I & O code.
| Applies to | Governed by | Deadline | Penalty | Last verified |
|---|---|---|---|---|
| Indian freelancers and exporters choosing a non-bank provider to collect payments, especially cross-border (PA-CB) collections | Payment and Settlement Systems Act, 2007 (section 4) and RBI's Master Direction on Regulation of Payment Aggregators dated 15 September 2025 (RBI/DPSS/2025-26/141) | Not applicable. RBI updates both lists from time to time, so check the date shown on each page | Not applicable to the exporter as a filing penalty. Operating a payment system without RBI authorisation is an offence under the PSS Act, 2007, and RBI can revoke an authorisation | 8 Oct 2026 |
What does RBI authorisation of a payment aggregator mean?
RBI authorisation means the Reserve Bank has issued a Certificate of Authorisation (CoA) to a non-bank company to operate as a payment aggregator under the Payment and Settlement Systems Act, 2007. Without it, a non-bank entity cannot lawfully start payment aggregation in India.
- Legal basis: Under section 4 of the PSS Act, no person other than RBI can commence or operate a payment system in India unless RBI authorises it.
- Offence: RBI's PSS Act FAQ (Q10) says any unauthorised operation of a payment system is an offence under the Act and liable for penal action.
- Definition: A payment aggregator collects payments made by customers to merchants and then settles the collected funds to those merchants (paragraph 4(i), Master Direction on Payment Aggregators).
- Categories: RBI has three categories: PA-Online (PA-O), PA-Physical (PA-P) and PA-Cross Border (PA-CB). PA-CB has inward and outward sub-categories (paragraph 4(i)).
- Banks: A bank does not need authorisation to carry out payment aggregation business (paragraph 5(a)). Banks will not appear in the payment aggregator section of RBI's list.
- Non-banks: A non-bank payment aggregator must be a company incorporated in India and must apply through RBI's online portal (paragraphs 5(b) and 5(c)).
- Net worth: An applicant needs a minimum net worth of Rs 15 crore when applying and Rs 25 crore by the end of the third financial year after authorisation (paragraph 6(a)).
- Gateways: A payment gateway that only provides technology to route payments, without handling funds, is outside the Master Direction (paragraphs 4(j) and 10(g)).
In practice, authorisation tells you RBI has vetted the company that holds and settles your money. It does not tell you about fees, exchange rates or service quality, which you still need to compare yourself. For the cross-border rules in full, see the RBI PA-CB guidelines guide.
Who needs to check whether a payment aggregator is RBI authorised?
Anyone who lets a non-bank company collect money on their behalf should check its RBI authorisation. For Indian freelancers and exporters, this matters most for cross-border collections, where the provider receives foreign currency for you and settles it to your bank account.
| Who | Check needed | Why | Best for |
|---|---|---|---|
| Freelancer paid by foreign clients through an online provider | Yes | The provider holds client money before settling it, so it must be authorised as a PA-CB facilitating inward transactions | Individuals invoicing overseas clients |
| Exporter of goods selling online | Yes | PA-CB rules cover cross-border e-commerce for goods and services, and the provider must support EDPMS closure | Online sellers shipping abroad |
| Exporter paid directly by bank wire to an Indian bank account | Usually no aggregator check | An AD bank receives the funds, and a bank needs no PA authorisation | Larger invoices paid by SWIFT transfer |
| Indian business collecting domestic online payments | Yes, for PA-O | Domestic online collection by a non-bank needs PA-O authorisation | Businesses with Indian customers |
| Business using only a technology gateway | Check the role in the contract | A pure payment gateway that never handles funds is outside the Master Direction | Firms with their own bank merchant account |
How do you check if a payment aggregator is RBI authorised, step by step?
You check RBI authorisation by finding the exact legal name of the company and searching two RBI pages: the list of Certificates of Authorisation and the status of applications from payment aggregators. The first shows who is authorised. The second shows who is still waiting or has been turned down.
- Find the legal entity name. Look in the provider's terms of service, merchant agreement or website footer for the full company name, such as 'XYZ Payments Private Limited'. A brand or app name is not enough.
- Open RBI's Certificates of Authorisation list and note the date shown at the top. Scroll to the section headed 'Payment Aggregators (PA-O, PA-P & PA-CB)'.
- Search for the legal name with your browser's find function. Check the 'Payment System Authorised' column for the category codes against that name.
- For foreign client payments, look for PA-CB-I (cross-border inward) or PA-CB-I & O (inward and outward). PA-CB-O alone covers only outward payments, so it does not cover export receipts.
- If the name is missing, open RBI's status of applications from payment aggregators and find which table lists the company. Each table states whether entities in it can operate.
- Check the revoked and ceased sections at the end of the Certificates of Authorisation list. An entity there no longer holds a valid authorisation.
- Confirm the provider settles into a bank account in your own name, and that its website shows the officer who handles merchant issues and an escalation matrix for grievances, which authorised PAs must display prominently (paragraph 8(d)).
- Keep a dated screenshot of what you found, and repeat the check before renewing a contract, since RBI updates both pages.
What does in-principle authorisation from RBI mean for a payment aggregator?
In-principle authorisation means RBI has approved the application at a first stage. It is not final authorisation. RBI's status page note (iii) says in-principle authorisation shall not be construed as authorisation unless the entity is granted authorisation under section 7 of the PSS Act.
- A new PA with in-principle authorisation cannot commence operations until it receives final authorisation (note (ii)).
- The status page groups new PA-CB applicants, including those with in-principle authorisation, under a table marked 'Cannot operate'.
Why can some payment aggregators operate while their application is still pending with RBI?
Some entities already doing payment aggregation before the rules began were allowed to continue while RBI decides their applications. RBI's status page note (ii) says existing PAs that applied within the stipulated timelines can continue business unless RBI advises otherwise.
- For cross-border, the Master Direction saves the older OPGSP circulars only for an existing PA-CB that applied on or before 30 April 2024 and is awaiting RBI's decision (paragraph 19).
- On the status page, look for the table titled 'Existing PAs-CB which can operate'. Read the remarks and footnotes beside each name, since RBI can restrict an existing PA, for example from onboarding new merchants.
What do the PA-CB codes on RBI's Certificate of Authorisation list mean?
The codes show which cross-border activity RBI has authorised. The list's footnote explains PA-CB-I as cross-border inward transactions, PA-CB-O as cross-border outward transactions, and PA-CB-I & O as both.
- Inward means inflow of foreign exchange, which is what export receipts are (paragraph 4(d)).
- PA-O and PA-P codes cover domestic online and physical payments only.
What does each RBI status for a payment aggregator mean for an exporter?
Each RBI status tells you whether the entity can operate today. Only a Certificate of Authorisation, or listing as an existing PA allowed to continue, permits operation. In-principle, under-process, returned, withdrawn, refused and revoked entries are statuses where a new provider cannot operate or authorisation has ended.
| Status on RBI page | Where it appears | Can it operate? | Best for |
|---|---|---|---|
| Listed with a PA-CB-I or PA-CB-I & O code | Certificates of Authorisation list | Yes, authorised for cross-border inward | Exporters wanting a fully authorised provider |
| Existing PA-CB, in-principle granted or under process | Status page, table of existing PAs-CB | Yes, unless RBI advises otherwise | Users of providers that ran before the 2023 rules |
| New PA-CB, in-principle granted or under process | Status page, table of new PAs-CB | No, marked 'Cannot operate' | Spotting providers that cannot yet take payments |
| Application returned, withdrawn or refused | Status page, returned or refused tables | No, marked 'Cannot operate' | Checking a provider you already use |
| Certificate revoked or operations ceased | Certificates of Authorisation list, sections B and C | No | Checking older or rebranded providers |
| Not listed anywhere | Neither page | Treat as not authorised for PA activity | Unknown or newly launched providers |
What happens if an exporter uses a payment aggregator that is not RBI authorised?
Using an unauthorised payment aggregator puts your export money and your compliance record at risk. The provider is outside RBI's escrow, KYC and settlement rules, and it may be unable to give your AD bank the documents needed to close your export entries.
- Fund safety: A non-bank PA must keep funds collected for merchants in a separate escrow account with a scheduled commercial bank in India (paragraphs 16 to 18). An unauthorised entity has no such duty.
- EDPMS closure: An authorised PA-CB must give your AD bank the documents needed to close your EDPMS entry (paragraph 11(h)).
- Realisation: You must still realise and repatriate service export value within nine months from the invoice date, or twelve months if invoiced or settled in rupees, unless your AD bank allows an extension (Regulation 5, FEMA export regulations 2026).
- Shutdown risk: RBI advised existing online PAs whose applications were returned to stop aggregation and close nodal or escrow accounts within 180 days (status page). Your settlements can stop.
- Forex dealing: Residents may deal in forex only with authorised persons and for permitted purposes, or face penal action under FEMA (RBI forex FAQ, Q1).
If you find your provider is not authorised, stop routing new invoices through it, ask for settlement of any balance, collect every payment advice for past receipts, and speak to your AD bank about closing pending export entries. If you suspect fraud, report it on the National Cyber Crime Reporting Portal, as RBI's forex FAQ (Q7) suggests for unauthorised forex trading platforms. Our guide to export payment fraud lists common scams.
Which RBI rule says a payment aggregator must be authorised?
The rule that a payment aggregator must be authorised comes from section 4 of the Payment and Settlement Systems Act, 2007. RBI's Master Direction on Regulation of Payment Aggregators, dated 15 September 2025, sets out who must apply, the capital needed and the extra rules for cross-border aggregators.
| Circular or regulation | Clause | Date | Plain meaning | Best for |
|---|---|---|---|---|
| Payment and Settlement Systems Act, 2007 | Section 4 | In force 12 August 2008 | Only RBI-authorised persons can operate a payment system | Understanding why authorisation matters |
| Master Direction on Regulation of Payment Aggregators (RBI/DPSS/2025-26/141) | Paragraphs 5 and 6 | 15 September 2025 | Banks need no authorisation; non-banks apply and meet net worth rules | Checking who must hold a CoA |
| Master Direction on Regulation of Payment Aggregators | Paragraph 11 | 15 September 2025 | PA-CB rules: Rs 25 lakh per transaction cap, AD-only forex, EDPMS support | Exporters comparing collection routes |
| Master Direction on Regulation of Payment Aggregators | Paragraphs 19 and 22 | 15 September 2025 | Repeals OPGSP circulars with a saving for pending PA-CB applicants; earlier authorisations stay valid | Reading older provider claims correctly |
| Status of applications from Payment Aggregators | Notes (ii) and (iii) | As on 1 October 2026 | In-principle authorisation is not authorisation; new PAs cannot operate until authorised | Interpreting 'in-principle' claims |
| Certificates of Authorisation under the PSS Act | Payment Aggregators section and footnote | Dated 30 September 2026 | Official list of authorised PAs with PA-CB-I and PA-CB-O codes | Verifying a specific provider |
What are the common mistakes and red flags when checking RBI authorisation of a payment platform?
- Brand search: Searching only the app or brand name. RBI lists legal company names, so match the name in the provider's terms.
- In-principle claims: Treating 'RBI in-principle approved' as final. RBI says in-principle authorisation is not authorisation, and new applicants cannot operate on it.
- Group confusion: Assuming a group company's listing covers the entity you contract with. RBI lists each authorised company separately, so check the exact entity named in your agreement.
- Wrong category: Accepting a PA-O or PA-CB-O listing for export receipts. Inward foreign payments need PA-CB-I or PA-CB-I & O.
- Old pages: Relying on a screenshot or article from months ago. Check the 'as on' date on RBI's pages and look at the revoked section.
- Third-party accounts: Being asked to accept settlement into someone else's account. Authorised PAs must ensure funds due to a merchant reach the merchant's own bank account (paragraph 13(g)).
- No KYC: Being onboarded with no KYC at all. Authorised PAs must carry out due diligence of merchants under RBI's KYC rules (paragraph 13(a)).
- Alert list: Assuming an entity absent from RBI's Alert List is authorised. RBI says the list is not exhaustive.
How did we verify this?
Every rule, deadline and form on this page is linked to its official source, checked on the dates below.
- RBI: Status of Applications received under the Payment and Settlement Systems Act, 2007 (as on 01.10.2026), Section I, Tables A to I and Notes (i) to (iii) (checked 8 Oct 2026)
- RBI: Certificates of Authorisation issued under the Payment and Settlement Systems Act, 2007 (dated 30 September 2026), Section A (Payment Aggregators and footnote), Section B (revoked), Section C (ceased) (checked 8 Oct 2026)
- Master Direction on Regulation of Payment Aggregator (PA), RBI/DPSS/2025-26/141, Paragraphs 4, 5, 6, 8(d), 10(g), 11, 13, 16 to 19 and 22 (checked 8 Oct 2026)
- RBI: Payment and Settlement Systems overview, Section 4 of the PSS Act; Act effective 12 August 2008 (checked 8 Oct 2026)
- RBI FAQ: Payment and Settlement Systems Act, 2007 (updated 20 October 2025), Q10, Q17 and Q20 (checked 8 Oct 2026)
- RBI FAQ: Foreign Exchange (Forex) Transactions (updated 28 August 2024), Q1, Q2, Q5 and Q7 (checked 8 Oct 2026)
- RBI Alert List (updated as on 19 November 2025), Introductory note: list not exhaustive (checked 8 Oct 2026)
- Foreign Exchange Management (Export and Import of Goods and Services) Regulations, 2026, Notification No. FEMA 23(R)/2026-RB (amended up to 22 September 2026), Regulation 5(1) and its provisos (checked 8 Oct 2026)
Frequently asked questions
Where is the official RBI list of authorised payment aggregators?
The official list is RBI's page of Certificates of Authorisation issued under the Payment and Settlement Systems Act, 2007. It has a section for Payment Aggregators covering PA-O, PA-P and PA-CB. RBI's status page links to it in note (i). Read the date at the top of the page before relying on it.
Is a bank required to hold PA-CB authorisation to receive export payments?
No, a bank does not need RBI authorisation to carry out payment aggregation business, under paragraph 5(a) of the Master Direction on Payment Aggregators. Your bank still applies FEMA export rules to the receipt. Banks do not appear in the payment aggregator section of RBI's list.
Can a PA-CB with in-principle authorisation start onboarding new exporters?
A new PA-CB with only in-principle authorisation cannot commence operations. RBI's status page says new PAs cannot operate until they are granted authorisation under section 7 of the PSS Act. An existing PA-CB that applied within the timelines may continue unless RBI advises otherwise, so check which table lists it.
How long does RBI take to decide a PSS Act authorisation application?
RBI's FAQ on the Payment and Settlement Systems Act says the Reserve Bank will endeavour to dispose of applications for authorisation within six months of receipt. This is a target, not a guarantee. Some payment aggregator applications have stayed under process for longer, so check the current status page.
Can RBI revoke a payment aggregator's Certificate of Authorisation?
Yes, RBI can revoke a Certificate of Authorisation under section 8 of the PSS Act. This can happen if the provider breaches the Act or regulations, fails to follow RBI directions, or violates its authorisation terms. Revoked entities are listed in section B of RBI's Certificates of Authorisation page.
Is a payment gateway the same as a payment aggregator under RBI rules?
No. Under paragraph 4(j) of the Master Direction, a payment gateway provides technology to route and process payments without handling funds. A payment aggregator collects and settles funds to merchants. Paragraph 10(g) keeps payment gateways outside the Master Direction, so a gateway does not appear in the PA section.
What is the PA-CB per transaction limit for export receipts?
The maximum value per transaction processed by a PA-CB is Rs 25 lakh, for inward and outward transactions, under paragraph 11(d) of the Master Direction on Payment Aggregators. Larger export invoices need another route, such as a direct transfer to your AD bank. Read the full rules in the PA-CB transaction limit guide.
Where can you report an unauthorised forex or payment platform in India?
RBI's forex FAQ says complaints about unauthorised electronic trading platforms for forex can be filed on the National Cyber Crime Reporting Portal at cybercrime.gov.in. Complaints may also go to the Enforcement Directorate and state police. For fraud against your export receipts, also inform your AD bank promptly.