RBI

PA Compliance Checklist for New Brands 2026: A Simple Guide to RBI Requirements

India’s digital payment system is growing rapidly. Now, many businesses are getting involved in online payments, from small startups to large fintech companies. However, collecting payments on behalf of others or settling money with merchants requires more than just good technology. You also need to understand the applicable rules and compliance.

Payment Aggregator (PA) compliance is not just a matter of getting regulatory approval. It involves company structure, financial capacity, merchant due diligence, escrow system, technical security, customer protection, and ongoing compliance.

It is important to clarify that working as a payment aggregator and taking payments for your business using an authorized PA are not the same thing. Not all online businesses require their own PA authorization.

This article will highlight the important compliance issues for new brands before entering the PA ecosystem.

What is a Payment Aggregator?

A Payment Aggregator or PA is a system or organization that simplifies the digital payment process between customers and merchants. A merchant can accept various types of digital payments without creating separate integrations with each payment system.

So, a customer makes a payment online. The payment aggregator facilitates that payment process and arranges settlement with the merchant through the applicable mechanism.

Term	Simple Meaning
Customer	Person making the payment
Merchant	Business selling goods or services
Payment Aggregator	Entity facilitating payment collection and settlement
Payment Gateway	Technology infrastructure that facilitates the payment transaction

Payment Aggregator and Payment Gateway are not the same thing. A payment gateway provides the technical infrastructure to complete the payment. On the other hand, the role of a PA may be related to payment collection and settlement.

So, the first task of any new business should be to understand its business model well. It is important to verify whether the business falls within the regulatory scope of the payment aggregator.

Why Is PA Compliance Important for New Brands?

PA compliance is not just about getting regulatory approval. When a payment aggregator is involved in the payment flow of customers and merchants, the security and proper management of funds become very important. A good compliance system also helps in detecting fraud and suspicious transactions.

It strengthens internal governance, reduces operational risk, and makes the business more prepared during an audit or due diligence. In addition, a compliant business can be more trustworthy to both customers and merchants.

PA Compliance Checklist for New Brands

It is a good idea to plan PA compliance before starting a payment operation. Having a strong compliance structure from the beginning can reduce regulatory gaps, operational risk, and various future problems. The following checklist highlights the important things for new brands simply.

1. Create the right Legal Entity

It is important to have the right legal structure for the business to work as a non-bank payment aggregator. The company should be properly incorporated in India, and the applicable rules of the Companies Act, 2013 should be reviewed.

It is also necessary to see whether the proposed payment activity of the company is properly mentioned in its constitutional documents, especially the Memorandum of Association (MoA). There should also be a clear arrangement regarding ownership, management, and governance structure.

2. Meet the Net Worth Requirement

Net worth is an important factor in PA compliance. New businesses should do capital planning from the beginning. It is better to make the necessary financial preparations in advance rather than planning to meet the financial requirement at the time of application.

Minimum net worth at the time of application is ₹15 crore, and required net worth by the end of the third financial year after authorization is ₹25 crore.

Certification by a CA or statutory auditor and relevant financial statements may be required, where applicable. So, it is important to prepare financial documents properly before application. The applicable net-worth requirement may also have to be maintained on an ongoing basis.

3. Create a proper Escrow Arrangement

Customer payments and the company’s own operational funds should not be managed together or uncontrollably. The applicable RBI escrow requirements and banking arrangements for payment flow should be understood well.

The necessary arrangements should be made with a qualified banking partner. The entire process of fund movement and merchant settlement should be clearly documented. In addition, having a regular reconciliation system helps to identify errors or discrepancies in transactions.

4. Create a robust Merchant Onboarding Process

Merchant onboarding is not just about filling out a registration form. The Payment Aggregator should create a systematic process to verify the necessary information about the merchant.

This may include verifying the merchant’s identity, the legitimacy of the business, and relevant ownership and control information. It is also important to understand the merchant providing goods or services. Risk-based due diligence and a system for identifying suspicious or prohibited activity are important parts of compliance.

Document Area	Examples
Corporate	Certificate of incorporation, MoA, AoA
Financial	Net-worth certificate and financial statements
Governance	Board-approved policies
Technology	Security and system documentation
Operations	Merchant onboarding and settlement processes
Risk	Fraud and risk management framework
Banking	Relevant escrow arrangements

A good onboarding process can help reduce many potential risks from the start.

5. Strengthen Technology and Cybersecurity

Technology and cybersecurity are very important in the payment business. Having a good-looking payment platform is not enough. The backend system also needs to be secure.

The business should look at secure technology architecture, access control, encryption, and secure data transmission. Multi-factor authentication and secure API systems can also be important as needed. Transaction monitoring and vulnerability management systems help to identify potential problems in advance.

• Secure APIs
• Access-control policies
• Transaction logs
• Fraud monitoring tools
• Vulnerability assessments
• Incident response plan
• Backup and business continuity measures

A payment platform’s user interface may be very good, but a weak security control can cause financial and reputational damage.

6. Follow Payment Data Storage and Security Requirements

When running a payment business, it is important to know where payment data is stored and processed. It is necessary to review the applicable RBI data storage or localization requirements carefully.

Especially if you use a third-party cloud provider or technology vendor, you should understand the data handling arrangements. It is also important to maintain appropriate access control and security measures. Applicable card security and tokenization standards may need to be followed.

However, it is not right to make a general statement that all types of business data must always be stored only in India.

7. Create a Fraud and Risk Management System

A key objective of compliance is to prevent misuse of the payment system. So, the new PA needs to have a transaction monitoring and fraud detection system.

There needs to be a clear process for how unusual activity will be detected, how merchant risk will be monitored, and who will take action in the event of a fraud alert.

A new PA should know:

• How will a suspicious transaction be identified?
• Who will investigate an alert?
• What circumstances will a transaction be blocked?
• How will an incident be documented?
• Who will report serious issues internally?
• It is also important to review and update risk controls over time.

8. Create a Customer Grievance and Dispute System

Customer protection is a critical part of a PA’s operating model. There should be a clear system for customer complaints, refunds, disputes, or chargebacks.

Whether the complaint channel is easily accessible, who the responsible person or team is, and what the escalation process is? All these need to be clearly defined. It is also important to keep a record of each complaint and its resolution.

Area	What the Brand Should Have
Customer complaints	Defined communication channel
Disputes	Documented resolution process
Refunds	Clear operational procedure
Escalations	Responsible officer/team
Records	Complaint and resolution trail

A clear grievance system is not only convenient for the customer but also increases the accountability of the business.

9. Be prepared for Audit and Regulatory Review

PA compliance is not a one-time filing process. Internal reviews, security assessments, and applicable audits may be required even after business operations have commenced.

Information security assessments, system audits, Vulnerability Assessment and Penetration Testing or VAPT, and other independent reviews may be important in appropriate situations. It is best to keep all compliance-related documents in an organized repository.

A Compliance Repository may contain:

• Policies
• Audit reports
• Financial documents
• Merchant records
• Incident reports
• Reconciliation records
• Regulatory communications

Proper documentation helps ensure that necessary information is available quickly during audits and regulatory reviews.

10. Prepare Application and Supporting Documents

Incomplete or disorganized documentation can complicate the regulatory process. So, all necessary corporate, financial, governance, and operational documents should be prepared well before the application.

Document Area	Examples
Corporate	Certificate of incorporation, MoA, AoA
Financial	Net-worth certificate and financial statements
Governance	Board-approved policies
Technology	Security and system documentation
Operations	Merchant onboarding and settlement processes
Risk	Fraud and risk management framework
Banking	Relevant escrow arrangements

Each document and policy should be reviewed before submitting an application. It is very important that the information and documentation provided to the regulator match the way the company actually operates.

Common PA Compliance Mistakes New Brands Should Avoid

Some common mistakes when starting a new Payment Aggregator business can create compliance and operational problems in the future. For example:

• Viewing compliance as just paperwork.
• Starting payment operations without understanding the regulatory scope.
• Lagging capital and net worth planning.
• Using a weak merchant onboarding process.
• Ignoring ongoing merchant monitoring.
• Not maintaining accurate transaction records.
• Considering cybersecurity as the sole responsibility of the IT team.
• Not keeping refund and grievance processes clear.
• Creating policies that don’t align with real business practice.

The strongest compliance framework is one that actually works in day-to-day business operations, not just written in a policy document. 

A Simple PA Compliance Roadmap for New Brands

Planning a PA business’s compliance journey step by step makes the entire process much easier and more organized. New brands can follow the following roadmap:

Step 1: Assess the Business Model

First, you need to understand whether the business model falls within the PA framework.

Step 2: Establish the Correct Corporate Structure

You need to create an applicable corporate structure and governance system.

Step 3: Plan Capital and Net Worth

You need to plan in advance for the necessary capital and net worth requirements.

Step 4: Build Escrow and Operational Systems

You need to create the right system for fund flow, settlement, and reconciliation.

Step 5: Implement KYC, Security, and Risk Controls

Merchant verification, cybersecurity, and fraud control need to be strengthened.

Step 6: Prepare Documentation and Application

You need to prepare the necessary documents, policies, and application-related information.

Step 7: Maintain Ongoing Compliance

Regular compliance reviews and monitoring should continue even after authorization or operational readiness.

How Can Enterslice Help with Compliance?

Working with payment regulations requires considering legal, financial, operational, and technology-related issues together. Understanding these requirements can be complex for new businesses. Enterslice can help businesses understand the applicable compliance framework and develop a structured regulatory readiness plan.

Our Services:

• Support in understanding the regulatory position of the business model.
• Review of PA-related eligibility requirements.
• Corporate and documentation readiness review.
• Compliance gap assessment.
• Support in policy and governance framework.
• Support in preparing merchant onboarding and risk-management documentation.
• Guidance on regulatory application documentation.
• Support in managing ongoing compliance requirements.

The right professional guidance can help new brands understand the various aspects of PA compliance more clearly and take an organized approach.

Conclusion

Payment aggregation is a regulated activity, so proper planning is required from the start. New brands need to first understand whether their business model falls within the PA framework. Then, they need to consider issues such as capital, corporate structure, escrow arrangement, merchant due diligence, technology security, and customer protection together. Compliance doesn’t end with authorization. It’s an ongoing responsibility.

Planning to enter the digital payments ecosystem? Enterslice can help you understand the applicable Payment Aggregator compliance requirements and create a structured roadmap for regulatory readiness. Businesses can build sustainable payment operations while managing regulatory responsibilities more effectively with the right preparation and compliance support. So, contact us today for hassle-free compliance.

Helpful Questions About PA Compliance Checklist for New Brands