RBI Ref: CO.DPSS.POLC.No.S-633/02-14-008/2025-26

RBI Payment Aggregators Health Check

Assess compliance with RBI's Master Direction covering PA-O, PA-P and PA-CB operations, escrow discipline and merchant governance.

FrameworkISO 27001:2022 RBI PA (S-633)RBI IT Governance RBI IT Outsourcing

Why it matters

Licence eligibility, avoiding supervisory escrow freezes and protecting consumer funds.

What you learn

Escrow compliance posture, merchant onboarding gaps and audit preparedness.

Effort

~8 minutes · 12 questions · no documents required

Important notice & scope disclaimer

Directional dipstick only

These Self-Assessment Questionnaires are a high-level dipstick check to establish your current state. They are not a replacement for a formal audit, CERT-In system audit or comprehensive gap assessment.

Operational health questionnaire

Pick the option that best reflects day-to-day reality, not policy on paper.

1Governance, Net-Worth & Scope

Does the entity maintain the required audited net-worth (₹15 Cr at application / ₹25 Cr ongoing) with statutory auditor certificates?

Section 4 · Net-Worth

Are Board-approved policies in place ensuring directors meet 'fit and proper' criteria, with conflicts of interest managed?

Corporate Governance

Is the PA operating strictly as a payment intermediary without co-mingling marketplace funds or unauthorised pooling?

Business Scope Discipline

2Merchant Due Diligence & Onboarding

Is Customer Due Diligence performed on all onboarded merchants via CKYCR / official documents, including Contact Point Verification?

Section 7 · Merchant KYC

Do merchant agreements mandate PCI-DSS / data-security standards, and are merchant sites monitored for prohibited goods?

Merchant Security & Monitoring

Are automated validations (e.g. penny-drop) used to ensure payouts route only to the merchant's verified bank account?

Account Validation

3Escrow Operations & Settlement

Are escrow account flows strictly limited to permitted credits and debits, with no cash handling or impermissible pooling?

Section 8 · Escrow Operations

Are merchant payouts and customer refunds settled within contract terms and RBI-mandated turnaround times?

Settlement & TAT

Are refunds credited back to the original payment instrument unless explicitly requested under verified rules?

Source Refund Mandate

4Cyber Security & Resilience

Are card credentials protected — no card-on-file storage on merchant / PA servers unless tokenised?

Section 10 · CoF Tokenisation

Is an annual system and cyber security audit conducted by a CERT-In empanelled auditor, with remediation tracked?

System Audit

Are payment systems backed by tested failover plans and a defined workflow to report incidents / frauds within mandated timelines?

BCP/DR & Incident Reporting

Bridging the gap to full assurance

From self-assessment to audit-ready compliance

The SAQ shows where you stand directionally. Formal regulatory comfort or certification needs hands-on gap closure, evidence and independent assurance — that is where Open Security Alliance steps in.

01 / Diagnostic

Full Regulatory & ISO Gap Assessment

Evidence-backed evaluation across every clause and control, with a Statement of Applicability and remediation roadmap.

02 / Audit Defense

Pre-Audit Readiness & CERT-In Audits

Mock inspections, VAPT, configuration reviews and annual cyber security audits for licensed entities.

03 / Governance

Board Advisory, CISO Reporting & Policies

Board-approved IT & cyber policies, ITSC agendas, CISO dashboards and escrow operating SOPs.

04 / Contracts

Vendor Contract Remediation

Clause-by-clause MSA review to add right-to-audit, sub-contracting and data-localisation safeguards.

Confidential discovery session

Unsure how regulators will read your gaps?

Book a 30-minute session with a principal consultant to review your SAQ results under a mutual NDA.