When the Reserve Bank of India (RBI) issues new master directions, the payment ecosystem changes. This is happening now. On September 15, 2025, the RBI released the Payment Aggregators Directions, 2025. This set of rules aims to increase oversight over payment aggregators (PAs).

If you run or use payment aggregation services, whether as a merchant, fintech, or platform provider, this update matters. The new rules change how you handle compliance, onboarding merchants, managing escrow accounts, and even handling cross-border payments. Let’s break down what’s new, the risks involved, and the steps businesses need to take next.

What the RBI’s New Rules Cover

PA Classification: Online, Physical, and Cross-Border

The RBI established three categories for PAs:

• PA-O (Online): Aggregators that handle transactions where payment and acceptance are not in close proximity, like e-commerce and apps.

• PA-P (Physical/Offline): Aggregators that facilitate face-to-face or proximity payment flows.

• PA-CB (Cross-Border): Aggregators responsible for international payment flows.

Each category has specific requirements related to net worth, KYC, merchant onboarding, data security, and the use of escrow.

Net Worth and Authorization

Payment aggregators must meet minimum net worth requirements. Both existing and new PAs will need to meet financial standards to continue or start operations. The RBI aims to ensure these firms can cover risks.

Merchant Onboarding and KYC

Tightening the onboarding process for merchants is another key focus. Some of the rules include:

• Defining merchant categories based on turnover (small, medium, large)

• Different KYC requirements based on merchant size and online/offline classification

• Verifying the physical presence for PA-P merchants

• Ongoing monitoring of merchant activity to identify changes in risk.

Escrow and Settlement Mandates

These are significant changes for how money moves:

• All funds collected in escrow or similar accounts must adhere to stricter rules.

• Offline face-to-face transactions handled by PA-P must also go through escrow.

• The rules around debits and credits from escrow accounts are becoming stricter.

Data, Security, and Card-On-File Restrictions

Storing card data will face severe limitations. Only issuers and networks can store card details. Others must limit what they keep or delete existing card-on-file data by specific deadlines.

Entities must maintain strong controls over merchant data and infrastructure. Requirements for security, surveillance, and fraud detection have increased.

Cross-Border Transactions

PA-CB aggregators now have clearer regulations, especially regarding payments for importing and exporting goods or services. Enhanced KYC, authorization, and reporting obligations apply to these entities.

Why These Changes Matter: Impacts and Risks

Here’s what the changes really mean for different stakeholders:

For Payment Aggregators (PAs)

• Compliance Burden Increases: You will need stronger KYC frameworks, better monitoring tools, escrow accounts, more thorough merchant vetting, and possibly upgrade your systems.

• Cost and Capital Pressure: Meeting net worth and operational requirements may demand maintaining higher capital and stronger governance, likely resulting in increased operating costs.

• Business Flow Impact: Some merchant categories, particularly offline or small merchants, may find it tough to meet stricter onboarding or escrow standards.

For Merchants and Platforms

• Onboarding Changes: Offline merchants might need to provide more documentation or prove their business presence more clearly.

• Possible Settlement Delays: Stricter escrow and settlement rules may cause longer payout times, particularly during the transition.

• Data Handling Adjustments: Platforms and merchants need to ensure compliance with data privacy laws and avoid storing restricted card data.

For Consumers

• More Secure Payments: Better regulation leads to a lower chance of fraud, misuse of payment details, or disputes over merchant legitimacy.

• Potential Slight Friction: Stricter verification might add steps during purchase or merchant registration, but these efforts will enhance trust in the system.

What Businesses Should Do: Action Checklist

Here are practical steps businesses (aggregators, merchants, platforms) should take to adjust.

Review Your Merchant Onboarding Process

Check if you have different processes for small, medium, and large merchants. Ensure your KYC meets the new requirements.

Update Escrow and Settlement Architecture

If you haven’t set up escrow or nodal accounts according to regulation, now is the time. Ensure compliant funding flow, escrow account setups, and permissible debits/credits.

Audit Net Worth and Financial Health

Confirm you meet or can meet the required net worth thresholds. Consider future obligations and regulatory costs.

Strengthen Data Security and Card Data Practices

Delete any stored card-on-file data that isn’t allowed. Limit what you retain. Improve your cybersecurity measures.

Cross-Border Transaction Compliance

If you manage import/export or cross-border payments, make sure you understand PA-CB rules and get the reporting and authorization right.

Governance and Operational Readiness

Be prepared to respond quickly to audits. Have clear policies related to risk, fraud, grievance handling, agent relationships, and more.

How Escrow Solutions Can Help

Modern payment infrastructure like escrow services can help ease the burden:

• Escrow accounts integrated into PA workflows can automatically hold and release funds according to regulations.

• Automated KYC and merchant verification, through APIs, can speed up onboarding while keeping you compliant.

• Continuous monitoring dashboards can track merchant activity, escrow balances, and compliance status.

• Secure data storage and deletion processes can align with card data restrictions.

Castler’s services in escrow management, and compliance frameworks are well-suited to support businesses adjusting to these new rules.

Conclusion

The RBI’s Master Directions, 2025, mark a significant change for payment aggregators in India. They increase oversight, clarify classifications, demand stronger financial and operational standards, and emphasize safety and compliance.

This means aggregators, merchants, and platforms need to adapt quickly to avoid compliance risks. This isn’t just about meeting regulations; it’s about building trust. A payment ecosystem that is more secure, transparent, and resilient.

If you need infrastructure or solutions to comply with these rules, such as escrow-enabled payments, connected banking systems, or reliable compliance tools, Castler’s solutions might be exactly what you need.