PPI Registration in India - Complete RBI Authorisation Guide for Prepaid Payment Instruments

Regulator: Reserve Bank of India Legal Framework: Payment and Settlement Systems Act, 2007 Applicable Direction: RBI Master Directions on Prepaid Payment Instruments, 2021, as amended from time to time Authorisation Type: Certificate of Authorisation for issuing and operating PPIs Common Instruments: Wallets, cards, gift instruments and stored value instruments PPI Types: Closed System, Semi-Closed System and Open System PPIs Non-Bank Authorisation: Required for non-bank entities issuing semi-closed PPIs Open System PPIs: Issued only by banks Cash Withdrawal: Not permitted for semi-closed PPIs; permitted for open system PPIs issued by banks as per RBI framework Interest on PPI Balance: Not payable Timeline: Indicative and subject to RBI review The above details are indicative and must be evaluated based on the applicant's business model, PPI type, KYC framework, technology architecture, merchant network, settlement design and latest RBI directions at the time of filing.

PPI Registration in India refers to RBI authorisation for entities that issue and operate Prepaid Payment Instruments. PPIs are payment instruments that facilitate purchase of goods and services, including financial services, remittance facilities and other permitted payment uses, against the value stored on such instruments. No entity can set up and operate a payment system for issuance of PPIs without prior approval or authorisation from RBI, except closed system PPIs that are outside RBI authorisation where they are used only for purchase of goods and services from the issuing entity and do not permit third-party settlement.

Regulator: Reserve Bank of India Primary Law: Payment and Settlement Systems Act, 2007 Key Provision: Section 18 read with Section 10(2) Applicable Direction: RBI Master Directions on Prepaid Payment Instruments, 2021, as amended from time to time Applicable Entities: PPI issuers and system participants Authorisation Issued: Certificate of Authorisation, where applicable Core Regulatory Focus: Customer fund safety, KYC, AML, cyber security, interoperability, grievance redressal and settlement discipline The RBI PPI framework provides the regulatory structure for authorisation, regulation and supervision of entities issuing and operating PPIs in India.

A Prepaid Payment Instrument is a payment instrument that allows the holder to purchase goods and services, including financial services and remittance facilities, using value stored on the instrument. PPIs may be issued in the form of wallets, cards or other permitted instruments.

• 'Wallet-based PPI', 'Card-based PPI', 'Gift instrument', 'Transit or mobility PPI', 'Semi-closed merchant network instrument', 'Bank-issued open system PPI'

Closed System PPI: Issued by an entity for purchase of goods and services only from that entity - Generally does not require RBI authorisation where no third-party settlement is involved - Not permitted Semi-Closed System PPI: Used at a group of clearly identified merchant locations or establishments having a specific contract with issuer - RBI authorisation required for non-bank issuers - Not permitted Open System PPI: Can be used at any merchant for purchase of goods and services - Issued only by banks - Permitted as per RBI framework Closed system PPIs should not be confused with semi-closed PPIs. If the instrument is accepted by third-party merchants or involves payment settlement outside the issuing entity's own goods and services, RBI authorisation must be carefully evaluated.

Core Activity: Issuance and operation of stored value instruments - Aggregation of customer payments and settlement to merchants Regulator: RBI - RBI Instrument: Wallet, card or stored value instrument - Payment collection and settlement infrastructure Customer Fund Position: Customer stores value with issuer - PA collects funds for merchant settlement Escrow / Settlement: Customer fund protection and settlement framework applies - Escrow framework for merchant settlement applies Typical Business: Wallet, prepaid card, gift card, transit wallet - Online checkout, POS aggregation, merchant payment settlement Authorisation: PPI issuer authorisation - PA authorisation Some fintech models may require both PPI and Payment Aggregator analysis depending on fund flow, wallet structure, merchant settlement and technology model.

Banks and non-banks have different permissions. Open system PPIs are issued only by banks, while non-bank entities generally require authorisation for semi-closed PPI issuance.

Entity Type: Company incorporated in India - Non-bank applicants should be properly incorporated and structured Authorisation Requirement: Required for non-bank issuers of semi-closed PPIs - Application must be made to RBI Business Model: Must clearly fall within permitted PPI activity - Wallet or stored value model must be clearly explained Net Worth: Must meet RBI-prescribed minimum net worth - Capital readiness must be demonstrated Fit and Proper: Promoters and directors should satisfy integrity expectations - Clean regulatory and financial track record is important KYC / AML Framework: Required - Customer onboarding, due diligence and monitoring must be demonstrated Technology Readiness: Required - Secure systems, audit controls and cyber resilience are expected Customer Protection: Required - Grievance redressal, transparency and refund mechanisms must be in place

RBI prescribes minimum net worth requirements for non-bank PPI issuers. The exact requirement should be verified from the latest RBI Master Directions and applicable circulars before filing. Minimum Net Worth: As prescribed under RBI PPI framework Certification: Statutory auditor / CA certificate may be required Ongoing Maintenance: Net worth must be maintained continuously Net Worth Review: RBI may review financial strength during application and supervision The latest net worth threshold must be verified at the time of filing. This page avoids relying on old capital thresholds and uses the current RBI PPI framework as the reference point.

Customer Due Diligence: PPI holders must be onboarded according to applicable KYC norms Minimum Detail PPI: Limited-use instruments may have restrictions and limits Full-KYC PPI: Higher usage, interoperability and broader functionality may be permitted PMLA Compliance: AML obligations apply as applicable Suspicious Transaction Monitoring: Transactions must be monitored for risk indicators Record Maintenance: KYC and transaction records must be preserved Periodic Updates: KYC updates must be undertaken as prescribed FIU-IND Reporting: Applicable reporting obligations must be evaluated

Form of PPI: Cards, wallets or other permitted instruments Loading Channels: Cash, bank account, debit card, credit card and other permitted instruments Currency: INR for domestic PPIs Interest on Balance: No interest payable on PPI balances Cash Loading: Subject to RBI-prescribed monthly and instrument limits Gift Instruments: Generally non-reloadable and subject to value limits Validity: Minimum validity and redemption norms apply Refunds: Must follow RBI-prescribed norms and customer protection framework Loading, reloading, cash loading and usage limits should always be aligned with the latest RBI directions and PPI category.

Non-bank PPI issuers are required to maintain customer funds in accordance with RBI's fund protection and escrow / settlement framework. The objective is to ensure that customer balances are safeguarded and used only for permitted purposes. Designated Account / Escrow: Customer funds should be maintained in permitted account structure Permitted Credits: PPI sale, reload amounts, refunds and permitted settlement inflows Permitted Debits: Merchant settlement, permitted transfers, taxes, refunds and related permitted payments No Interest to PPI Holder: PPI balances should not earn interest for holders Reconciliation: Daily monitoring and reconciliation required Customer Fund Safety: Funds should not be misused for business expenses

RBI has progressively enabled interoperability for certain PPI structures. Full-KYC PPIs may be allowed to participate in interoperable payment systems subject to applicable conditions. RBI has also enabled UPI access for full-KYC PPIs through third-party UPI applications, subject to applicable framework and operational arrangements.

• 'Full-KYC PPI interoperability', 'UPI access for eligible PPIs', 'NPCI operational requirements', 'Customer consent and security', 'Transaction monitoring', 'Technical integration readiness'
• Interoperability must be implemented only in accordance with RBI and NPCI requirements.

- 'Transparent terms and conditions', 'Clear charges and fees disclosure', 'Customer complaint mechanism', 'Refund and failed transaction process', 'Transaction alerts', 'Customer liability framework', 'Fraud reporting mechanism', 'Ombudsman / escalation support where applicable' Customer protection is central to the PPI framework. Weak grievance handling can attract regulatory concern.

PPI issuers operate payment systems and are expected to maintain robust cyber resilience, payment security controls and data protection systems. IT Governance

• 'Board-approved IT and information security policy', 'IT steering committee or technology risk oversight', 'Cyber risk assessment', 'Security incident response plan', 'Periodic audit and review'
• Data Security
• 'Encryption of sensitive data', 'Secure authentication', 'Access control', 'Secure application development', 'Log monitoring and forensic readiness'
• Payment Security
• 'Fraud monitoring', 'Transaction anomaly detection', 'Device and account risk controls', 'Secure APIs', 'Vulnerability assessment and penetration testing'
• Data Localisation and Audit
• 'Payment system data storage in India as applicable', 'Vendor and cloud architecture review', 'Contractual controls over data access', 'System audit', 'Cyber security audit', 'VAPT', 'Incident reporting', 'Board reporting'

Board-approved IT Policy: Required Information Security Policy: Required Data Localisation Review: Required KYC Integration: Required Transaction Monitoring: Required Fraud Detection System: Required Customer Grievance System: Required Wallet Ledger System: Required Daily Reconciliation: Required Escrow / Settlement Reconciliation: Required Audit Trail: Required VAPT: Recommended / required as applicable Cyber Incident Reporting: Required as applicable BCP-DR Framework: Required Vendor Risk Controls: Required

Company Documents: Certificate of Incorporation, MOA, AOA, PAN, registered office proof and board resolution Capital Documents: Net worth certificate, audited financial statements, bank statements, capital infusion documents Promoter and Director Documents: KYC, PAN, DIN, address proof, professional profile, fit and proper declarations Business Documents: PPI business model, target customer segment, merchant network strategy, revenue model, 3-year financial projections Policy Documents: KYC/AML policy, information security policy, customer grievance policy, risk management policy, refund policy Technology Documents: Wallet architecture, transaction flow, cyber security framework, data localisation architecture, audit readiness documents Escrow / Settlement Documents: Customer fund protection structure, bank account framework, reconciliation process Compliance Documents: Regulatory declarations, board approvals, application forms and other RBI-prescribed documents

[ ['Business Model Assessment', 'Evaluate whether the proposed model is closed system, semi-closed system, open system, wallet, card, gift instrument or another PPI structure.'], ['Entity and Object Clause Review', 'Ensure the company structure and MOA object clause support PPI issuance and payment system activity.'], ['Capital and Net Worth Readiness', 'Review net worth, capital source, auditor certification and financial strength.'], ['Policy and Technology Preparation', 'Prepare KYC/AML policy, IT policy, customer protection framework, wallet architecture, reconciliation controls and cyber security documentation.'], ['Application Preparation', 'Compile RBI application, business plan, financial documents, promoter details, technology details and regulatory declarations.'], ['Submission to RBI', 'File application in the prescribed manner with supporting documents.'], ['RBI Review and Clarifications', 'RBI may review business model, financial strength, governance, technology readiness, KYC framework and customer protection systems.'], ['Grant of Authorisation', 'Upon regulatory satisfaction, RBI may grant authorisation for permitted PPI activity.'], ['Post-Authorisation Setup', 'Implement operational controls, customer onboarding, escrow / settlement reconciliation, reporting, audit and compliance calendar.'] ].map(([title, body], index) => ( Step index + 1 title body ))

Stage 1: Business model and eligibility review - 2 to 3 weeks Stage 2: Entity, capital and MOA readiness - 2 to 4 weeks Stage 3: Policy, business plan and technology documentation - 3 to 6 weeks Stage 4: Application submission - Case-specific Stage 5: RBI scrutiny and clarifications - 3 to 6 months or more Stage 6: Authorisation and operational readiness - Subject to RBI satisfaction The timeline is indicative and depends on application quality, regulatory scrutiny, business model clarity, technology readiness and query cycles.

Confusing closed system and semi-closed PPI: Wrong regulatory assessment MOA not covering PPI activity: Regulatory query or restructuring requirement Weak net worth documentation: Application delay Unclear fund flow: RBI may seek detailed clarification Weak KYC/AML framework: Compliance concern No customer grievance framework: Customer protection concern Poor wallet ledger architecture: Operational risk No daily reconciliation process: Settlement risk Weak cyber security documentation: Technology compliance query Improper merchant network explanation: Business model concern No realistic business plan: Sustainability concern

KYC / AML Compliance: Customer onboarding, due diligence, monitoring and reporting Customer Fund Protection: Proper account structure, reconciliation and permitted usage Transaction Monitoring: Fraud detection and suspicious activity monitoring Customer Grievance Redressal: Complaint handling, refund process and escalation Technology Audit: System audit, cyber security review and VAPT where applicable Data Security: Secure storage, access controls and data localisation Reporting to RBI: Periodic and event-based reporting as prescribed Board Oversight: Policy review, risk review and compliance monitoring Interoperability Compliance: RBI / NPCI requirements where applicable Agent / Vendor Oversight: Due diligence and contractual controls

Unauthorised PPI issuance: Regulatory action under PSS Act Failure to maintain net worth: Supervisory concern Misuse of customer funds: Severe regulatory action KYC / AML breach: FIU / RBI concern Cyber security breach: Supervisory action False disclosures: Authorisation cancellation risk Non-compliance with RBI directions: Penalty or restriction Weak customer grievance handling: Regulatory scrutiny Failure to submit reports: Supervisory action

PPI Registration in India requires clarity on instrument type, customer fund flow, KYC framework, wallet architecture, settlement process, merchant acceptance network and cyber security. Early structuring helps identify whether the model requires RBI authorisation and whether the applicant is operationally ready before filing. "In payment businesses, trust is not built only through technology; it is built through disciplined handling of customer funds, transparent governance and regulatory readiness." CS Devyani Khambhati - Compliance Expert

faqs.map((faq) => ( faq.q faq.a ))

CS Devyani Khambhati Designation: Compliance Expert | Estabizz Fintech Private Limited Expertise: RBI, SEBI, IRDAI, IFSCA, fintech regulatory compliance, payment system authorisation, PPI registration, KYC/AML, cyber compliance and post-authorisation regulatory support. This content has been prepared from a regulatory advisory perspective to help fintech founders, wallet businesses, prepaid card issuers, payment companies and compliance teams understand the broad RBI framework for Prepaid Payment Instrument authorisation in India. This content is for general informational purposes only and should not be treated as legal, regulatory, financial or investment advice. RBI requirements, application formats, net worth thresholds, KYC requirements, interoperability rules, escrow obligations, cyber security expectations, reporting obligations and approval processes may change from time to time. Applicants should verify the latest regulatory position and obtain professional advice before filing any application with RBI.

Build your PPI application with structured RBI regulatory support, business model assessment, net worth readiness review, KYC/AML framework, wallet technology documentation, customer fund protection structure, policy drafting and post-authorisation compliance assistance. Speak to RBI Compliance Expert Apply for PPI Registration WhatsApp Estabizz Team