BENGALURU: The Reserve Bank of India in its new draft directions on regulation of Payment Aggregators (PAs) has said from August 1, 2025, no entity in the card transaction, except for the card issuer and card networks, will be allowed to store data.
It said any such data stored previously will be purged and for transaction tracking or reconciliation purposes, entities can store the last four digits of card number and card issuer’s name. The RBI has issued draft directions on regulation of PAs and sought public comments on the same.
Under the regulation of PAs- Physical Point of Sale (PA-P), the central bank said non-banks providing PA-P services should have a minimum networth of Rs 15 crore at the time of submitting application to the RBI for authorisation and a minimum networth of Rs 25 crore by March 31, 2028.
It also said that existing non-bank PA-P that are not able to comply with the networth requirement or do not apply for authorisation within the stipulated time frame, can cease PA-P operations by July 31, 2025. Banks shall close accounts (used for PA activity) of non-bank PA-P (existing as on the date of this circular) by October 31, 2025 unless such PAs produce evidence regarding application for authorisation submitted to the RBI.
Also, in order to regulate PA-P, it said companies providing this service should intimate to RBI within 60 days about their intention to seek authorisation. Now, players such as MSwipe and Pine Labs need to apply for authorisation by May 31, 2025.
Ankit Ratan, co-founder & CEO, Signzy, said in its guidelines, the regulator has emphasised that compliance is an area where PAs can’t adopt a ‘one size fits all’ approach. They need to have mechanisms in place that continuously monitor the transaction activity of the merchants, incorporate risk-based payment limits and flag off potential risk at an early stage.