Who this applies to
RBI's guidelines on the regulation of Payment Aggregators and Payment Gateways (PAPG) bring entities that collect and settle funds for merchants under direct regulation. Alongside capital and governance requirements, the guidelines include baseline technology recommendations that applicants and authorised entities must implement.
The security themes
Governance
- A board-approved information security policy
- Clear ownership of security and fraud risk
- Periodic review of controls and incidents by senior management
Data protection
- Card data must not be stored by merchants or aggregators beyond what is permitted; tokenisation is the expected approach
- Payment system data must be stored in India in line with RBI's data storage directions
- Strong encryption for data in transit and at rest
Application and infrastructure security
- Secure software development and code review
- Regular vulnerability assessment and penetration testing of internet-facing systems
- Hardened configurations and patch management
Monitoring and response
- Security event monitoring and fraud monitoring
- An incident response process that also meets CERT-In reporting timelines
Audits and evidence
Expect to demonstrate compliance through independent security audits, typically by auditors empanelled with CERT-In, along with evidence such as:
- Policy documents and board approvals
- VAPT reports with remediation closure
- Data flow diagrams showing where payment data is stored and processed
- PCI DSS attestation where card data is in scope
Common gaps we see
- Data flows that send payment data to offshore analytics or support tools
- Merchants onboarded without security due diligence
- VAPT performed once, with findings left open until the next audit
Making it sustainable
Treat PAPG compliance as an operating rhythm: quarterly control testing, a living data-flow map and a remediation tracker reviewed by management.
Key takeaways
- PAPG guidelines include baseline technology recommendations alongside governance and capital rules.
- Expect requirements around card data, data storage in India and independent security audits.
- Make compliance continuous with quarterly control testing and a living data-flow map.
Frequently asked questions
Can a payment aggregator store card numbers?
Card data storage is tightly restricted. Tokenisation is the expected approach, and only the card networks and issuers may store full card data except where specifically permitted.
Who can perform the security audit?
Audits are typically performed by independent auditors empanelled with CERT-In, as required by the applicable RBI guidance.
Do merchants onboarded by the aggregator need checks too?
Yes. Merchant due diligence, including security and fraud risk checks, is part of the aggregator's responsibility.
The audit is a snapshot. The regulator expects the controls every day.
Our team has delivered PAPG readiness and audit support for authorised entities — see our regulatory compliance services.
