Authorisation and scope
Determine whether the model is online PA, physical PA, cross-border PA or technology-only gateway.
Payment Aggregators
Paragraph-wise corpus with Finin2min interpretation, examples, evidence controls and practical Q&A. Source: Master Direction on Regulation of Payment Aggregator, 15 September 2025.
13 unitsPSS Act, 2007; PMLA and IT overlaysCurrent-source controlled
Module register
Net-worth and capital maintenance
Track initial/continuing net-worth, auditor certificate and shortfall escalation.
Governance and fit-and-proper
Screen promoters/directors, ownership/control changes and conflicts.
Merchant onboarding and KYC
Verify business, beneficial ownership, website/app, prohibited goods, settlement account and risk rating.
Merchant monitoring
Monitor abnormal transaction, refund, chargeback and customer-complaint patterns.
Escrow account and permissible flows
Reconcile collections, settlement, refunds, fees and permitted debits daily.
Settlement timeline
Apply merchant agreement and regulatory outer limits; preserve cut-off and exception evidence.
Customer disclosures
Show merchant identity, payment status, refund route and complaint contact.
Data security and card credentials
Do not store prohibited authentication data; comply with tokenisation, PCI and RBI security controls.
Dispute, refund and chargeback
Use documented responsibility, timeline, evidence and ageing controls.
Outsourcing and service providers
Map critical vendors, cloud, gateway, fraud, reconciliation and customer support contracts.
Cross-border payments
Separate import/export collection, FEMA, merchant due diligence and settlement currency controls.
Audit, reporting and change control
Submit statutory/system audit, cyber incident, escrow and regulator returns and pre-clear material changes.