How the Payment Aggregator (PA) License Framework Affects Direct-to-Bank UPI Solutions

The Reserve Bank of India’s (RBI) regulatory overhaul of digital payment intermediaries has dramatically altered how businesses accept payments online. Between capital adequacy norms, stringent merchant onboarding KYC, and the creation of Payment Aggregator (PA) and Payment Aggregator - Cross Border (PA-CB) categories, the industry has divided into two distinct technical paradigms: Pooled Escrow Aggregation versus Direct-to-Bank Orchestration.

Here is an architectural and regulatory comparison of how these frameworks operate and what they mean for merchant cash flow.

---

The RBI Payment Aggregator License Explained

Direct Answer: An RBI Payment Aggregator (PA) is a regulated entity authorized to facilitate e-commerce and merchant payments by collecting funds from consumers and holding them in a nodal escrow account before disbursing them to the merchant. Because aggregators act as custodians of public money, the RBI subjects them to strict net-worth mandates (minimum ₹25 Crore) and continuous surveillance.

When you use an aggregator like Razorpay, Cashfree, or PayU:

1. The customer pays.
2. The money leaves the customer’s bank and enters the Aggregator’s Escrow Account.
3. The aggregator verifies the transaction, deducts a 2% fee, holds the balance for 24 to 72 hours (T+1 or T+2 settlement), and transfers the remainder to your business account.

---

Escrow Model vs Direct-to-Bank Architecture

The difference between custodial aggregation and direct-to-bank software lies in the custody of funds:

Dimension	Centralized Payment Aggregator (PA)	Direct-to-Bank UPI Software (e.g. VyaparGateway)
Custody of Funds	Yes: Funds held in intermediary escrow	Zero: Funds transfer directly to merchant’s bank
Settlement Velocity	T+1 to T+3 working days (subject to weekend delays)	Instant to T+0 (governed by your bank/provider)
Reserve Withholding	Can withhold 5% to 20% in rolling risk reserves	Impossible: Software cannot hold or freeze merchant cash
Account Freeze Risk	High: Aggregator compliance freezes can block entire balances	Low: Isolated to your primary banking partner
Fee Structure	Percentage-based (typically 2.0% + GST)	Flat SaaS subscription with 0% platform transaction fees
Regulatory Role	Regulated Escrow Payment Intermediary	Non-custodial Technical Software Application

---

The PA-CB Framework for Cross-Border Transactions

In late 2023 and 2024, the RBI extended the aggregator regime to international payments under the PA-CB (Payment Aggregator - Cross Border) regulations:

• Entities handling import payments (Indian shoppers buying from overseas websites) must register under PA-CB (Import).
• Entities facilitating export collections (Indian SaaS and freelancers collecting global payments) must register under PA-CB (Export).
• Strict per-transaction value ceilings (₹25 Lakhs per unit) and Mandatory Import/Export Data Processing and Monitoring System (IDPMS/EDPMS) reporting apply.

For domestic Indian transactions, however, direct UPI infrastructure provides a far simpler, cost-effective domestic rail.

---

Why Merchants Are Choosing Non-Custodial UPI Solutions

The primary motivation driving thousands of Indian merchants toward direct-to-bank models is margin protection and liquidity:

1. Immediate Working Capital: Retailers, restaurants, and wholesalers operating on tight margins cannot wait 48 hours for weekend aggregator settlements. With direct UPI connections (such as BharatPe, Paytm Business, or HDFC SmartHub), transactions credit directly into the merchant’s designated current account.
2. Elimination of Arbitrary Account Freezes: Because a software platform never holds your money in a custodial wallet, it cannot unilaterally lock your operating capital.
3. Transparent Operational Economics: Businesses pay for software infrastructure as an operating expense rather than paying a compounding toll on every rupee earned.

---

Compliance and Security Standards for Software Integrations

Even though direct-to-bank software does not hold funds, robust data security remains mandatory:

• HMAC-SHA256 Webhook Signatures: Ensures every payment status callback received by your website is cryptographically verified against replay attacks.
• TLS 1.3 Encryption: All merchant API keys and transaction tokens are protected in transit and at rest with AES-256.
• Zero Cardholder Data Storage: UPI transactions bypass card data security (PCI-DSS) burdens because no debit or credit card PANs are ever processed or stored on your servers.

Learn how to integrate our non-custodial API in our Developer Documentation.