In short
The Reserve Bank of India regulates the businesses that move money: banks, card networks and payment aggregators. An online store or marketplace is not licensed by the RBI, but its payment aggregator must pass RBI rules down to it through the merchant agreement. The rules that matter most are simple to state: never store card numbers, let the issuer authenticate every payment, follow the e-mandate rules for subscriptions, and reverse failed payments on time. Most of the work sits in checkout code, order systems and reconciliation.
Who it applies to
- Payment aggregators (PAs), the gateways that collect payments for merchants. Under the RBI (Regulation of Payment Aggregators) Directions, 2025, banks need no separate authorisation and non-bank PAs must be authorised by the RBI. These Directions replaced the 2020 and 2021 PA guidelines and the 2023 cross-border PA directions.
- Online merchants and marketplaces, through their PA agreements. The PA must check their KYC, keep their systems to set security standards and enforce refund and dispute terms.
- Subscription businesses, through the e-mandate rules that apply to the banks and payment apps processing recurring debits.
- Software vendors whose systems handle payments for an authorised entity, for the payment data storage rule.
What it means for your website
- No card numbers on your servers. Saved cards must be tokens created through your PA. Token creation needs the customer’s explicit consent and an extra authentication step validated by the card issuer. Customers must be able to remove saved cards.
- Guest checkout is allowed. When a customer types card details for a one-off payment, the merchant or its PA may keep them only for settlement, for at most T+4 days or until settlement, whichever is earlier.
- Two factors on every payment. From 1 April 2026 the Authentication Directions, 2025 require at least two authentication factors for digital payments. Your checkout must hand over cleanly to the issuer’s step, whether OTP, app approval or biometrics. Small contactless card payments, recurring e-mandate debits and gift prepaid instruments are exempt.
- Show extra charges before payment. The PA Directions require any charge beyond the price of the goods to be displayed distinctly to the payer before the transaction, for example a convenience fee.
- Refunds go back to the original method. Refunds must be made to the original payment method unless the customer asks for another of their own payment modes. Say so in your refund policy.
- Clear subscription screens. Customers register an e-mandate once, can set a maximum amount, and can change or withdraw it at any time. Show the amount, frequency and how to cancel before they sign up.
The display of return, refund and seller details is a consumer protection matter; see Consumer protection rules for e-commerce.
What it means for your software
Card data and tokens
The RBI’s circular of 7 September 2021 allows only card issuers and card networks to store actual card data. Its circular of 28 July 2022 required everyone else to purge card-on-file data before 1 October 2022. Merchants may keep only the last four digits and the issuer’s name for tracking and reconciliation.
Your order system, ERP and CRM should hold the PA’s token or payment reference, never the card number or expiry date. Check exports, logs, call-centre notes and backups for old card data too. The PA Directions, 2025 repeat the rule: card credentials must not be stored in any database or server the merchant can access.
Merchant onboarding and security
From 1 January 2026, PAs must onboard merchants under the 2025 Directions, using the RBI’s KYC rules. Merchants onboarded by 31 December 2025 have one year to be brought into line, so expect fresh KYC requests from your PA. Small merchants with annual turnover up to ₹40 lakh get a simpler process: PAN check, contact point verification and an identity document of the proprietor.
The PA must ensure merchant systems meet security standards such as PCI-DSS and PCI-SSF, as applicable. Your PA agreement must also set out refunds, failed transactions, return policy, grievance handling and reconciliation. Build your back end to those terms. See PCI DSS.
Marketplaces
The PA Directions say a PA business may not run a marketplace, and a PA must ensure a marketplace it onboards does not accept payments for sellers not onboarded on that marketplace. Your seller master must therefore be the single record of who may be paid. Block payments for products of inactive or unverified sellers, and settle each order to the right seller.
Refunds and failed transactions
The RBI’s Turn Around Time circular of 20 September 2019 sets outer limits for reversing failed payments and requires compensation to be paid to the customer automatically. For a UPI merchant payment where the customer is debited but the merchant gets no confirmation, reversal is due within T+5 days, then ₹100 a day. PAs must follow these timelines in their dispute process.
The order system should not cancel an order on a timeout alone. It should read the final status from the PA’s webhook or status API, reconcile daily settlement files, and raise refunds against the original payment. Under the PA Directions, refunds go through the PA’s escrow account unless the merchant manages the refund directly and the customer knows.
Recurring payments and subscriptions
The Digital Payments – E-mandate Framework, 2026 took effect on 21 April 2026 and replaced eight earlier circulars. It covers cards, prepaid instruments and UPI. Registration needs additional authentication, and so does the first debit, which may be combined with registration. Later debits up to ₹15,000 each need none; for insurance premiums, mutual fund subscriptions and credit card bills the limit is ₹1 lakh.
The customer’s bank or app must send a notice at least 24 hours before each debit, and the customer may opt out of one debit or the whole mandate. No charge may be levied on customers for the e-mandate facility. Your billing system should store the mandate reference, maximum amount and schedule, request debits early enough for the pre-debit notice, and handle opt-outs and failed debits without retrying blindly.
Payment data stored in India
The RBI’s circular of 6 April 2018 requires the entire data relating to payment systems to be stored only in India. Its FAQs extend this to service providers, intermediaries, payment gateways and third-party vendors working for authorised entities. Data processed abroad must be deleted there and brought back within one business day or 24 hours, whichever is earlier.
Merchants are not named in the circular. If your software provides payment services for a PA or bank, assume the rule reaches you. Keep payment records and logs in Indian hosting regions and say so in vendor contracts.
Checklist
- Search every system, log and backup for full card numbers and expiry dates, and delete them.
- Use your PA’s tokenised saved-card feature; keep only the token, last four digits and issuer name.
- Test checkout against the two-factor flows of the main banks and UPI apps.
- Show every extra charge clearly before the customer pays.
- Update KYC documents with your PA before its 2026 deadline.
- Drive order status from PA webhooks and daily settlement files, not from browser redirects.
- Send refunds to the original payment method and track them to completion.
- For subscriptions, store mandate details, respect the ₹15,000 and ₹1 lakh limits, and handle opt-outs.
- For marketplaces, allow payments only for onboarded, active sellers.
- Host payment records in India and write that into vendor contracts.
How Kreon helps
We build e-commerce sites, marketplaces and ERPs that use Indian payment aggregators’ tokenised checkouts, so card data never reaches your servers. We build the order and ERP side to match: payment webhooks, settlement reconciliation, refunds to the original method and, where needed, e-mandate subscriptions. For an existing store, we can trace where payment data sits and say what needs to change.