Payment Gateway License- An Overview

A payment gateway license is a RBI-mandated regulatory permit that allows companies to provide financial services that facilitate digital payment transactions via debit & credit cards, net banking, and payment through mobile wallets.

A payment gateway basically transfers transaction data from issuing banks to acquiring banks. It essentially acts as an intermediary between merchants and customers. With the help of Enterslice’s experts, you can easily:

Draft a business plan and various website policies

Apply for the payment gateway license

Prepare legal documentation

Obtain PCI-DSS compliance certification

Establish the RBI-mandated IT Infrastructure

Fulfil your post-registration compliance

RBI License for Payment Gateway with Enterslice

Get RBI license for payment gateway with Enterslice and take your fintech business dreams to new heights.

get_started_img

Categories of Providers with a Payment Gateway License

The main categories of providers with a payment gateway license are as follows:

req_icon

Second Hand Provider

This provider has a direct agreement with a bank such as ICICI, HDFC, or Axis. It has high infrastructure and setup costs, but low transaction fees. It is highly recommended for large companies and public corporations.

req_icon

Third-Party Provider

Businesses use a third-party provider instead of installing their own payment system. These providers act as intermediaries between the merchant and customer.

Benefits of Getting a Payment Gateway License by the RBI

The benefits of getting a payment gateway license by the RBI include compliance with the regulatory authority, brand recognition, and fraud prevention.

Brand Identity

A payment gateway license can help you establish yourself as a game changer in the market by incorporating top-notch infrastructure for data security required for operating as a PG in India.

Credibility

With assurance on data protection, customers tend to use online payment methods more compared to traditional cash for buying products and services.

Compliance

A payment gateway license by the RBI assures the public, including merchants, customers, and investors, that your company is compliant with the Reserve Bank of India.

Fraud Detection & Prevention

The transactions are secured through protocols like two-factor authentication, such as an SMS based one-time password. A payment won’t be completed without an OTP. The payment gateway company that establishes IT systems in place can enable the customer to alert the former in case a transaction was carried out without the latter’s consent.

Fast Settlements

After obtaining the payment gateway license by the RBI, you can expand your brand amongst the small businesses and MSMEs in India by demonstrating how fast the system processes the settlement of funds and streamlines the cash flow.

Promotes Cashless Economy

Licenses like payment gateways and payment aggregators are the future of digitalization in India because they support and contribute towards the cashless economy objective of the country. With the rise of online business, a license for a payment gateway is the key.

How to Get a License for Payment Gateway with Enterslice?

Take a look and understand how Enterslice helps entities like you to obtain a license for payment gateway:

Step 1: Understand Your Business Requirements

Have a 30-minute consultation with our associate to understand the basic criteria for obtaining the payment gateway license. You must’ve at least INR 15 crore net worth before applying for the permit from the RBI.

Step 2: Company Registration

The first step is to incorporate your business with the Ministry of Corporate Affairs (MCA) if your company isn’t registered already. This process also involves opening a bank account and tax/GST registration.

Step 3: Fulfil PCI-DSS Compliance

With our expert assistance, you’ll be able to determine your PCI level, conduct a GAP analysis, incorporate security controls, and conduct SAQ & QSA audits. We’ll help you obtain the certification through an authorized QSA entity.

Step 4: Preparation of Documents

Gather documents, including a copy of the incorporation certificate, directors’ digital signature & identification number, MOA & company’s charter, business plan, software patch reports, and related documents with Form A.

Step 5: Establishment of IT Infrastructure

We’ll help you establish the IT system, servers, and network architecture, and all the work that is mandatory to operate as a payment gateway.

Step 6: Application Filing

Our associates will file your application and documents with the Department of Payment and Settlement System of the RBI.

Step 7: Examination by the RBI

The Reserve Bank of India will examine the application and review your IT compliance.

Step 8: In-principle Approval by the Authority

Once the application is approved by the RBI, they’ll grant you an in-principle approval for six months, during which you’ll have to meet the technical and bank account requirements.

Step 9: Certificate of Registration

Once the RBI is satisfied with your compliance with their rules, they’ll issue the final certificate of registration for payment license online.

Documents Required for License for Payment Gateway

The documents required for license for payment gateway are as follows:

KYC – Directors & Shareholders

Certificate of incorporation

KYC Details of the Applicant and Directors

GST and PAN of the Company

A Proof of Registered Office Address

Company’s Bank Account Details

Business Plan for Five Years

Director Identification Number of All Directors

Digital Signature Certificate

PAN of the Applicant

Board Resolution

Criteria for Payment Gateway License Online

Check out the below-mentioned criteria for payment gateway license online, including IT infrastructure and compliance with PCI-DSS.

  • The company seeking the license must be a registered business under the Companies Act of 1956 or 2013 (old or new entities are both eligible).
  • At least two directors and shareholders must be members of the company.
  • The corporation must have a valid permanent account number (PAN).
  • A current bank account must be up and running before the application.
  • A detailed business plan with an organizational chart.
  • A lease or virtual office address agreement as proof of business address must be submitted.
  • A code testing report must be submitted by a certified agency.
  • A PCI-DSS certificate demonstrating adherence to the said compliance requirements.
  • The company must’ve at least INR 15 crore as net worth during the application process. It must maintain an INR 25 crore net worth within three years post grant of the license.

Conditions for RBI Payment Gateway License as Per PSS Act

You must comply with the following regulatory conditions in accordance with the Payments and Settlements Act of 2007 to obtain an RBI payment gateway license online:

  • Demonstrate to the RBI that you need the payment mechanism or service.
  • You must follow all the RBI-mandated technical infrastructural requirements.
  • The applicant must follow all the security measures to operate the system, including data protection, security, encryption, and fraud prevention.
  • You must implement a transparent system for fund transfer.
  • Enable a procedure for netting transactions.
  • Ensure all directors and promoters have complied with “fit and proper” criteria.
  • Draft terms & conditions, privacy, and refund policy.
  • Compliance with RBI’s credit and monetary policy.
  • Timeline for proper implementation of the payment gateway system.
compliances_img

Points to Remember for Payment Gateway License

Scroll down and find out the key points to remember for securing a payment gateway license online:

Checklist for PCI Audit & Final Certification Exercise

  • Scoping and GAP assessment
  • Formal risk assessment
  • Policy and procedural review
  • Complete final audit and certification
  • Attestation of Compliance (AOC) review
  • Report on Compliance (ROC)
  • Certificate of Compliance (COC)
  • Application secure code and VAPT testing for web, Android, and iOS
  • Approved scanning vendors (ASV) for up to 5 IPs before certification
  • Internal VA for up to 10 IPs (prior to certification)
  • External penetration test for 5 IPs (prior to certification)
  • Internal penetration test for 10 IPs (prior to certification)

Infrastructure Setup for Payment Gateway License by the RBI

  • OS hardening
  • Database (DB) hardening
  • DMZ and internal zone configuration
  • Centralized antivirus server
  • Regular patch updates
  • NTP server configuration
  • Multi-Factor Authentication (MFA) server
  • VPN server setup
  • File Integrity Monitoring (FIM) server
  • Firewall rules management

Network Architecture Diagram for RBI Payment Gateway License

The documentation for network architecture for RBI payment gateway license online includes the following policies:The documentation for network architecture for RBI payment gateway license online includes the following policies:

Firewall configuration & Antivirus

DMZ and internal

Patch management

DB access

Asset inventory information

Change control

Privacy, data control, and user-access

Data retention and disposal

Physical security

Board Resolution

PCI-DSS awareness training

Login and password

Security and events log

IT Essentials for Securing a Payment Gateway License

Explore how Enterslice will help you set up the IT essentials for securing a payment gateway license online, as explained below:

  • Security assessment of your customers to identify risks and take effective measures.
  • Reporting any type of security breaches, including credit/debit card theft or fraud, to the Reserve Bank of India.
  • Filing of quarterly and annual cybersecurity audit reports to the IT committee.
  • Reporting of bi-annual Vulnerability Assessment or Penetration Test reports.
  • Submission of AOC and ROC with corrective measures and closure schedules.
  • Selecting an encryption algorithm as a well-established international standard, which must be verified by the global cryptographers’ community.
  • Establishing an internal jurisdiction for data storage.
  • Drafting agreements for third parties, including appointed agencies and auditors to conduct security audits.
  • Submission of security audit reports for third parties.
  • Development of a payment application in accordance with PCI-DSS guidelines and compliance.
  • Review of PCI-DSS compliance status as part of the merchant onboarding process.

Why Trust Enterslice for RBI Payment Gateway License?

Enterslice has proved its mettle as one of the leading business consulting and compliance management service providers. Given below are the key reasons why you should trust Enterslice for the RBI payment gateway license:

  • Join the group of 1 lakh businesses globally that partnered with us.
  • Fully remote process- there’s absolutely no requirement to visit the RBI.
  • Get live tracking updates on your application process for the RBI license for the payment gateway.
  • Monitor your compliance easily via your individual case manager.
  • File error-free KYC-AML compliance reporting with our experts.
  • Complete transparent pricing- no additional or hidden charges.
  • End-to-end support from application filing & IT setup to final approval and post-compliance.
  • Avoid penalties by tracking your compliance in real-time with us.
  • Lifetime consultation once you sign up with us.
  • Get expert guidance in drafting legal agreements for third-party vendors & miscellaneous.
  • Business plan drafting in 4 to 5 days by top-experienced financial specialists.
  • 24/7 customer support, so your services remain uninterrupted.

FAQs on Payment Gateway License Online

Payment gateways are intermediaries that provide a technical infrastructure between a merchant and the end customer to facilitate payment and transfer of funds through secure servers and networks.

Go through the following reasons to acquire a payment gateway license:

  1. A payment gateway license is mandatory, as per the Reserve Bank of India, to operate a company as a payment gateway.
  2. You can raise capital by demonstrating your seriousness and authenticity to the investors and credit institutions in the market.
  3. It helps you build a separate brand identity in the market because customers trust a brand or company that follows all the governmental mandates.

The process for a license for payment gateway is as follows:

  1. Draft legal documents like the MOA and the AOA
  2. Obtaining a director identification number (DIN) and a digital signature certificate (DSC)
  3. Registration of the company with the MCA.
  4. Establishment of IT infrastructure in accordance with the Reserve Bank of India (RBI).
  5. Filing of the application with mandatory documents.
  6. Examination of the application and subsequent issuance of authorization of the certificate in Form B, permitting the applicant to operate as a payment gateway operator. (in-principle approval).
  7. Final registration of the certificate is granted by the RBI for payment gateway license after the end of the six-month period.

Yes, operating without authorization will amount to serious legal actions, including cancelation of your company’s registration and possible criminal/civil charges.

The entire process takes from preparing documents, filing the application, establishing the technical infrastructure, and in-principle approval takes around six months. Once you fulfil all the conditions during the six months, the RBI will grant you the certificate of registration.

The list of documents needed for a payment gateway license is as follows:

  1. Memorandum of Association
  2. Articles of Association
  3. A certificate of registration (ROC) from the MCA
  4. Director’s identification number
  5. Digital signature certificate
  6. A fit and proper certification for all directors and promoters
  7. A goods and services tax (GST) certificate
  8. PCI-DSS compliance declaration
  9. A lease agreement or rental space agreement as address proof.
  10. Details of your current bank accounts.

This compliance includes a set of policies and rule that determine the procedure to optimize the digital payment through credit cards, net banking, and debit cards simultaneously taking effective measures to prevent fraud and suspicious activities.

Any Indian company registered under the Companies Act of 1956/2013 with a minimum net worth of INR 15 crore, a five-year business plan, with an RBI-mandated technical infrastructure.

The Reserve Bank of India is the primary authority that authorizes entities to operate as payment gateways.

Yes, with the fast-growing e-commerce industry, payment gateway entities are in huge demand.

The applicant company has a net worth of INR 15 crore at the time of application.

According to the available data, as of September 2023, NBFC microfinance organizations comprise 41% of the market share in India's microfinance sector, with banks accounting for 30%. It is noteworthy that since 2020, NBFCs' market share has grown considerably.

A company with a legit payment gateway license should’ve a net worth of 25 crore by the end of the third financial year as a PG in India. Any noncompliance will end in the revocation of the RBI’s permit.

Yes, in accordance with the latest RBI developments, all companies engaged in digital payment transactions must provide two-factor authentication for users and merchants. It must be something that the said customer/merchant knows of, including biometrics, password, OTP based SMS, or a pin.

The list of services other than seamless payments includes the following:

  1. Advanced visual systems check.
  2. Computer fingerprinting technology.
  3. Delivery address verification
  4. Velocity pattern analysis
  5. Identity morphing detection
  6. Computation of tax for authorization of the request transmitted to the processor.

A payment gateway acts as an intermediary between a merchant, online marketer, and customer. It facilitates payment processing between different parties. Some key features are as follows:

  • All the sensitive financial information (card details and passwords) is exchanged through encrypted servers.
  • It is capable of facilitating payment through various methods, including credit/debit cards, net-banking, mobile banking, and UPI.
  • This system can be established on any type of digital platform, including online marketplaces, e-commerce shopping apps, with the help of an application programming interface (API).
  • The system is built to support recurring and automatic payments from regular customers.

A payment gateway keeps the information secure in the following ways:

  • The transaction is done through an HTTPS web address.
  • The system acts on a signed request through the merchant. This information is kept between the merchant and the gateway.
  • Subsequently, the IP is verified to detect any fraudulent or malicious activity.
  • Followed by virtual payer authentication (VPA), which is done, meaning the person making the payment is sent a verification one-time password or a related identifier as set by the payment maker.

The PCI audit consists of the following:

  • DSS scoping
  • Formal risk assessment
  • Final audit

The fit and proper criteria set by the RBI for NBFC registration ensure that individuals appointed to key positions within an NBFC meet specific suitability standards, including a clean legal and financial record, relevant experience and qualifications, and financial soundness.

As per the data available, on average, NBFC director in India draws a salary ranging between ₹ 24.0 lakhs to ₹ 90.0 lakhs, with an average annual salary package of ₹ 43.5 lakhs.

Minimum requirements for NBFC company registration include:

  1. Two directors
  2. Two shareholders
  3. Directors and shareholders can be the same persons
  4. They should be at least 18+ years old
  5. The director must be an individual
  6. Shareholders may be the corporate body

Related Services

Our Awards Our Awards

Top 100 Companies in Asia - Red Herring
Top 100 Companies in Asia - Red Herring

Red Herring Top 100 Asia enlists outstanding entrepreneurs and promising companies. It selects the award winners from approximately 2000 privately financed companies each year in the Asia. Since 1996, Red Herring has kept tabs on these up-and-comers. Red Herring editors were among the first to recognize that companies such as Google, Facebook, Kakao, Alibaba, Twitter, Rakuten, Salesforce.com, Xiaomi and YouTube would change the way we live and work.

Top 25 in India - Consultants Review

Researchers have found out that organization using new technologies in their accounting and tax have better productivity as compared to those using the traditional methods. Complying with the recent technological trends in the accounting industry, Enterslice was formed to focus on the emerging start up companies and bring innovation in their traditional Chartered Accountants & Legal profession services, disrupt traditional Chartered Accountants practice mechanism & Lawyers.

Top 25 in India - Consultants Review

We partner with more than 100+ companies

-- Testimonials

Don't take our word for it

In the news

Get Started Live Chat