PSP License – IFSCA: Complete Payment Service Provider Authorisation Guide for GIFT IFSC

The above details are indicative and must be evaluated based on the applicant's payment service model, IFSC structure, safeguarding mechanism, capital plan, AML framework, nodal bank arrangement, technology architecture and latest IFSCA directions at the time of filing.

PSP License – IFSCA is the authorisation granted by IFSCA to a company incorporated in IFSC for providing specified payment services under the IFSCA Payment Services Regulations, 2024. It applies to payment service businesses operating in or from IFSC and covers front-end payment service activities such as wallet / e-money services, escrow services, cross-border money transfer and merchant acquisition. The authorisation remains valid unless revoked by IFSCA or surrendered by the PSP in accordance with the applicable regulations. A pure Payment Gateway providing only technical support without possession or control of funds is excluded from the payment services definition. However, where the business handles payment funds, e-money, escrow, remittance or merchant acquisition, PSP authorisation must be carefully evaluated.

Full Form: Payment Service Provider - Payment System Operator Nature: Front-end payment service provider - Back-end payment system / clearing / settlement infrastructure operator Typical Activity: Wallet, e-money, escrow, cross-border transfer, merchant acquisition - Operating payment system infrastructure Applicable Framework: IFSCA Payment Services Regulations, 2024 - IFSCA Payment and Settlement Systems Regulations, 2024 Customer Interaction: Direct or front-end service role - System / infrastructure role Regulatory Treatment: PSP authorisation - PSO authorisation / approval as applicable IFSCA has clearly separated front-end payment services and back-end payment system operations. The business model should be mapped correctly before filing.

Regulator: International Financial Services Centres Authority Primary Regulation: IFSCA Payment Services Regulations, 2024 Related Regulation: IFSCA Payment and Settlement Systems Regulations, 2024 AML / KYC Framework: IFSCA AML, CFT and KYC Guidelines, 2022 FEMA Applicability: Applicable where Indian promoter, cross-border flows or foreign currency transactions are involved Authorisation Type: Payment Service Provider Authorisation Core Regulatory Focus: Customer fund safeguarding, AML compliance, cross-border payment discipline, governance, risk management and consumer protection The regulatory objective is to ensure financial stability, customer fund protection, cross-border compliance and robust risk governance for payment services conducted in or from IFSC.

1: Account Issuance Service - Issuance of payment accounts, including e-money accounts 2: E-Money Issuance Service - Issuance of stored value / e-money instruments in permitted foreign currency 3: Escrow Service - Holding or managing funds in permitted escrow arrangement for payment service users 4: Cross-Border Money Transfer Service - Facilitating permitted cross-border money transfer in or from IFSC 5: Merchant Acquisition Service - Acquiring or onboarding merchants for payment acceptance services Payment Gateway technical support only is excluded. Banks / IBUs / IBCs are exempt where specified. Cryptocurrency or virtual digital asset storage is not permitted. E-wallet cannot hold INR. PSP cannot lend money or extend credit.

IFSC Banking Units: Exempt from separate PSP authorisation where applicable IFSC Banking Companies: Exempt where specified Credit Card Issuers licensed in IFSC: Exempt where specified Others specified by IFSCA: Exemption depends on regulatory direction Exemption should not be assumed merely because the business is payment-related. The specific entity type and service scope must be reviewed.

Legal Form: Company only Registered Office: Must be in IFSC Place of Business: Physical place of business in IFSC required LLP: Not eligible Foreign Parent: May set up IFSC subsidiary Application Before Incorporation: Parent may initiate process, but company must be incorporated in IFSC before final authorisation Outside IFSC Activity: Requires prior approval of IFSCA PSP authorisation is not suitable for LLP, partnership firm or individual applicant structures.

Regular PSP: At commencement of operations - USD 100,000 Regular PSP: By end of third financial year - USD 200,000 Significant PSP: Within 90 days of designation - USD 250,000 Significant PSP: By end of third financial year - USD 500,000 Capital may be maintained in equivalent specified foreign currency. Net worth must be continuously monitored and reported.

Single service monthly average transaction value: USD 2 million Two or more services monthly average transaction value: USD 4 million E-money stored daily average value: USD 3 million IFSCA designates an entity as Significant PSP based on prescribed thresholds. The PSP cannot voluntarily self-classify as Significant PSP merely by choice. Once designated, enhanced net worth requirements apply.

Paid-up Equity: Included Compulsorily Convertible Preference Shares: Included if compulsorily convertible and withdrawal is restricted Free Reserves: Included Share Premium: Included Capital Reserves: Included except revaluation reserves Revaluation Reserves: Excluded Borrowed Funds: Not treated as net worth Accumulated Losses: Deducted as applicable Net Worth = Paid-up Equity + Eligible CCPS + Free Reserves + Share Premium + Eligible Capital Reserves - Exclusions / Deductions Incorrect capital classification is a common reason for regulatory queries. Borrowed funds should not be treated as regulatory net worth.

In-principle approval does not guarantee final authorisation. Final authorisation is granted only after full compliance with conditions.

Safeguarding is one of the most critical pillars of PSP License – IFSCA. A PSP must ensure that customer funds and applicable funds are properly segregated, protected and reconciled in accordance with Schedule VI and related regulatory requirements. Undertaking from Safeguarding Institution: Written undertaking from eligible institution for fund protection Bank Guarantee: Guarantee-based safeguarding mechanism where applicable Trust Account: Customer funds held through trust structure Escrow Account with IBU: Escrow with IFSC Banking Unit / permitted institution No Lending: Customer funds cannot be lent No Working Capital Use: Escrow / safeguarded funds cannot be used for business expenses No Interest on E-Wallet Balance: Wallet balances cannot earn interest for holders No Cash Withdrawal: Cash withdrawal from wallet is prohibited Escrow Balance Alignment: Escrow balance must match outstanding e-money / applicable liability Separate Safeguarding: Separate safeguarding may be required per payment service Deposit Timeline: Funds to be deposited by next business day after receipt, where applicable Safeguarding lifecycle: Customer funds received → funds segregated → escrow / safeguarding deposit by next business day → daily reconciliation → merchant settlement / refund / permitted use → escrow balance alignment.

Documented Governance Framework: Mandatory Board-approved Risk Policy: Required Operational Risk Controls: Required for payment service processes Third-party Risk Assessment: Required for outsourced or vendor-dependent services Exit Strategy: Required for outsourced providers Capital Monitoring: Quarterly net worth review and ongoing capital monitoring Safeguarding Oversight: Daily reconciliation and fund protection monitoring Technology Risk Controls: Cybersecurity, access controls and audit trail Regulatory Inspection Rights: Third-party agreements should permit regulatory access A PSP that handles foreign currency payment services must demonstrate institutional-grade governance from the application stage itself.

AML / CFT Compliance: Mandatory under IFSCA AML, CFT and KYC Guidelines KYC: As per IFSCA Guidelines and PMLA-related obligations AML Monitoring: Required from day one Transaction Record Retention: Minimum 10 years Transaction Logs: Retain for at least 10 years Suspicious Activity Monitoring: Required Customer / Merchant Due Diligence: Required based on service model Regulatory Action Reporting: As required by IFSCA Failure to safeguard customer funds and AML non-compliance are primary regulatory risks under PSP License – IFSCA.

Grievance redressal is mandatory even for B2B PSP structures where payment service users include merchants or institutional users.

ICT Risk: Cyber resilience and service continuity Financial Risk: Vendor solvency and financial reliability Data Risk: Encryption, access controls and confidentiality Subcontracting: Nth-party oversight Business Continuity: Exit plan and contingency readiness Inspection Rights: Regulatory inspection rights in third-party contracts Vendor Register: Third-party relationship register Due Diligence: Pre-onboarding and ongoing vendor due diligence Outsourcing is permitted, but the PSP remains fully responsible for regulatory compliance. Vendor agreements should be drafted with audit rights, inspection support, data protection obligations, service levels and exit arrangements.

Promoter and Shareholding Documents: Certificate of incorporation of parent / applicant, MOA, AOA, shareholding pattern, group structure chart and board resolution approving PSP application Fit and Proper Documents: Declarations of no economic offence conviction, insolvency declaration, regulatory action disclosure, financial soundness declaration and wilful defaulter confirmation Business Plan: 3-year revenue projection, transaction volume forecast, break-even analysis, capital deployment strategy, cost structure and risk management matrix Technology Documents: IT architecture note, cybersecurity policy, data protection framework, business continuity plan and third-party risk policy Safeguarding / Escrow Documents: Nodal bank confirmation, escrow account agreement, safeguarding mechanism, daily reconciliation process and written concurrence from safeguarding institution AML / Compliance Documents: AML / CFT policy, KYC framework, transaction monitoring policy, record retention process and suspicious transaction escalation framework Governance Documents: Board-approved governance framework, risk policy, outsourcing policy, grievance redressal policy and operational SOPs Application Documents: Prescribed application form, non-refundable application fee proof, declarations and IFSCA-prescribed annexures

Fees and Security Deposit Application Fee: Non-refundable application fee as specified by IFSCA Security Deposit: Discretionary; may be required under Regulation 10(4) Security Deposit Basis: Business model complexity, cross-border exposure, transaction volume and risk profile Use of Security Deposit: May be used toward legitimate outstanding customer claims in specific situations Refundability: Subject to regulatory conditions Security deposit is not insurance. It is a regulatory safeguard and may be appropriated by IFSCA toward outstanding customer claims where applicable. Timeline Application Preparation: Case-specific based on documentation readiness IFSCA Processing: Authority endeavours to process within around 6 months In-Principle Approval: Case-dependent Final Authorisation: Subject to fulfilment of conditions Commencement: Within 6 months from Certificate of Authorisation Extension: One-time extension up to 3 months may be possible

Daily: Escrow / safeguarding reconciliation Ongoing: AML monitoring and customer / merchant due diligence Ongoing: Third-party risk monitoring Quarterly: Net worth review / quarterly net worth statement Annual: Audited financial statements submission within 3 months of finalisation Annual: Governance and risk policy review Event-Based: Change in ownership / control reporting Event-Based: Prior approval for merger, restructuring or acquisition Event-Based: Regulatory action disclosure Event-Based: Surrender process where business closure is proposed

Lending: Not permitted Credit Extension to Wallet Users: Not permitted BNPL Facility: Not permitted Public Deposit Acceptance: Not permitted Interest on Wallet Balances: Not permitted Cash Withdrawal from E-Wallet: Not permitted INR Wallet Holding: Not permitted Crypto / VDA Storage: Not permitted Use of Escrow Funds for Working Capital: Not permitted Operating Outside IFSC: Prior approval required Services Other Than Payment Services: Prior permission required Payment Gateway Technical Support Only: Excluded from payment service definition where no fund possession/control exists

Jurisdiction: IFSC / GIFT City - Domestic India Regulator: IFSCA - Reserve Bank of India Currency: Specified foreign currency - INR Wallet INR Holding: Not permitted - Not the same framework Capital Requirement: USD-based - INR-based Cross-Border Flexibility: Higher within IFSC framework - Regulated separately Merchant Acquisition: Covered as payment service - Core PA activity Escrow / Safeguarding: IFSCA safeguarding framework - RBI escrow framework Payment Gateway Technical Support: Excluded if only technical support - Payment gateway distinction under RBI framework

Regulatory Non-Compliance: IFSCA may revoke authorisation Customer Interest Compromised: Revocation or restrictions possible AML Violation: Serious regulatory action Governance Failure: Corrective or enforcement action Misleading Disclosure: Revocation risk Net Worth Erosion: Corrective measures or enforcement action Voluntary Surrender: Requires regulatory approval Surrender Documents: Board resolution, CA certificate, no-liability confirmation and public notice if operational Security Deposit Use: May be used toward legitimate customer claims IFSCA generally provides reasonable opportunity of hearing before revocation, subject to applicable regulatory provisions.

Weak business model: In-principle approval delay Inadequate capital planning: Net worth non-compliance No nodal bank confirmation: Application hold Poor AML framework: Rejection or regulatory query Improper escrow design: Compliance breach Confusing PSP with PSO: Wrong application route Assuming Payment Gateway needs PSP: Incorrect regulatory assessment Including INR wallet functionality: Regulatory issue Including crypto storage: Prohibited activity concern Hybrid lending plus PSP model: Regulatory rejection risk No third-party exit plan: Outsourcing compliance gap No 10-year record retention plan: Compliance deficiency

Design escrow / safeguarding model early Align business model strictly to Schedule I payment services Avoid hybrid lending and PSP models Prepare stress-tested capital plan Document AML and KYC framework in detail Identify nodal bank / IBU early Prepare technology architecture and cybersecurity documentation Create third-party risk and exit strategy Plan quarterly and annual compliance from day one Avoid any INR wallet or crypto wallet feature Regulation is not merely about permission; it is about building a structure strong enough to protect trust. A PSP that respects governance from day one rarely faces enforcement on day hundred. CS Devyani Khambhati - Compliance Expert

faqs.map((faq) => ( faq.q faq.a ))

Reviewed by: CS Devyani Khambhati Designation: Compliance Expert | Estabizz Fintech Private Limited Expertise: IFSCA, RBI, SEBI, IRDAI, GIFT City registrations, PSP authorisation, payment services regulations, AML/KYC, safeguarding framework, escrow structuring and post-authorisation compliance. This content has been prepared from a regulatory advisory perspective to help payment companies, fintech founders, remittance operators, wallet businesses, merchant aggregators and foreign payment groups understand the broad IFSCA framework for Payment Service Provider authorisation in GIFT IFSC. This content is for general informational purposes only and should not be treated as legal, regulatory, tax, financial or investment advice. IFSCA requirements, application formats, fee structures, capital thresholds, safeguarding conditions, AML/KYC obligations, technology expectations and approval processes may change from time to time. Applicants should verify the latest regulatory position and obtain professional advice before filing any application with IFSCA.