RBI's Payment Aggregator License Crackdown: Why Gateways Stopped Onboarding

If you have tried to start an online business in India over the past few years, you likely encountered a frustrating roadblock: attempting to sign up for a major payment gateway, only to be met with a message saying, “We are currently pausing new merchant onboarding.”

This wasn’t a glitch. It was the direct result of the Reserve Bank of India (RBI) executing a massive regulatory cleanup of the digital payments ecosystem through its Payment Aggregator (PA) Guidelines.

Understanding why this happened is critical for founders choosing their payment stack in 2026.

The Shift in Fintech Regulation

Before the RBI intervention, the payment gateway industry operated in a relatively gray regulatory area. Many tech startups acted as intermediaries, collecting thousands of crores in public funds, holding them in internal accounts, and paying them out to merchants days later — with minimal oversight.

The RBI recognized that these companies were essentially performing core banking functions without the strict scrutiny required of actual banks. Concerns over money laundering, fraudulent merchants, and the systemic risk of an aggregator going bankrupt led to the creation of the PA framework under the RBI’s Guidelines on Regulation of Payment Aggregators and Payment Gateways, first issued in March 2020 and significantly tightened in 2023.

What the PA Regulations Actually Require

Obtaining and maintaining a PA license is not trivial. The RBI has set out stringent requirements that existing and new payment aggregators must meet:

Net Worth Requirements: Existing PAs were required to have a minimum net worth of ₹15 crore by March 2021, rising to ₹25 crore by March 2023. New applicants must demonstrate a net worth of ₹25 crore at the time of application. This requirement alone disqualified hundreds of smaller fintech startups from operating in the space.

Escrow Account Obligations: PAs must maintain a dedicated escrow account with a scheduled commercial bank. All customer funds collected must be routed through this account. The escrow structure protects merchants and consumers if the PA faces insolvency, but it also means the PA is subject to detailed RBI-directed audit trails on every rupee flowing through the account.

KYC and AML Norms: PAs are required to perform full Know Your Customer (KYC) verification on every merchant they onboard, in line with the Prevention of Money Laundering Act (PMLA). This includes verifying business registration, beneficial ownership, GST status, and website content. Any lapse in KYC can result in the PA’s authorization being suspended.

Audit and Reporting Requirements: Licensed PAs must undergo annual system audits by RBI-empaneled auditors, submit quarterly compliance reports, and maintain transaction logs for a minimum period as prescribed. They are also subject to cybersecurity framework requirements issued by the RBI.

Governance Standards: PAs must have a board-approved policy for merchant onboarding, grievance redressal, and risk management. Foreign-owned PAs face additional scrutiny under FDI policy.

Which Companies Hold a PA License?

As of 2024–2025, the RBI has granted in-principle or final PA authorization to a limited set of companies. Major licensed PAs include Razorpay, Cashfree Payments, PayU, Juspay, CCAvenue (Infibeam Avenues), BillDesk, Paytm Payment Gateway, and a handful of others. The full authorised list is published on the RBI website at rbi.org.in and is updated periodically.

Many smaller operators who applied did not receive authorization or were asked to wind down their PA operations. This consolidation is deliberate — the RBI wants fewer, well-capitalized, and well-audited intermediaries handling public funds.

How the 2023 Tightening Changed the Game

The 2023 amendments to the PA guidelines introduced several important changes that triggered the wave of onboarding pauses merchants experienced:

• Stricter merchant KYC timelines: PAs were given deadlines to re-KYC their existing merchant base. Those who could not complete re-KYC in time had merchant accounts suspended.
• Online and offline PA distinction: The 2023 guidelines extended PA regulations to cover “Payment Aggregators — Physical Point of Sale (PA-P)” separately from online PAs, bringing QR-code and POS-based aggregators under the same framework.
• Enhanced due diligence for high-risk merchants: Categories such as crypto, fantasy gaming, and e-commerce in certain goods were flagged for enhanced due diligence, causing many PAs to simply stop onboarding merchants in those categories entirely.
• Nodal account settlement windows tightened: The permissible window for funds to sit in a nodal account before settlement to merchants was reduced, forcing PAs to overhaul their settlement infrastructure.

What Happens to Unlicensed Aggregators?

Operating as a payment aggregator without RBI authorization is a serious violation. The RBI can direct banks to stop providing payment services to unauthorized entities, effectively cutting off their ability to settle funds. In practice, this means:

• Banks refuse to maintain escrow or nodal accounts for unauthorized aggregators.
• The unauthorized aggregator cannot legally pool and hold customer funds.
• Merchants using an unauthorized aggregator face the risk of funds being frozen or settlement being halted without notice.
• Directors and key managerial persons of the unauthorized entity can face regulatory action.

For merchants, the lesson is clear: always verify that your payment service provider holds valid RBI authorization before onboarding, especially if they are collecting and holding your customer’s funds on your behalf.

The Impact on Small Businesses and Startups

The result of the PA license crackdown was damaging for small startups, freelancers, and independent creators who needed a fast and simple way to accept online payments.

Because licensed PAs are now acutely aware that a single fraudulent merchant could trigger an RBI audit or jeopardize their authorization, their merchant KYC processes have become extremely rigorous. If your business model is slightly unconventional — a creator selling digital courses, a bootstrapped SaaS, a small export business — or if you don’t have a fully established private limited company with a comprehensive website and GST registration, your application is likely to be rejected or delayed for weeks.

Many legitimate businesses were left stranded, unable to collect online payments because they didn’t fit neatly into the aggregator’s updated risk profiles.

How Merchants Should Verify Their Payment Partner’s License Status

Before onboarding with any payment service provider that will handle your customer’s funds, follow these steps:

1. Check the RBI’s authorized PA list at rbi.org.in. The RBI publishes and updates the list of entities authorized to operate as Payment Aggregators.
2. Ask for the authorization letter or in-principle approval reference number from your provider. A legitimate licensed PA will readily provide this.
3. Confirm the escrow bank arrangement — a licensed PA will be able to name the scheduled commercial bank where their escrow account is maintained.
4. Review the merchant agreement carefully — it should explicitly state how and when funds are settled, and reference their RBI authorization.

Disclaimer: Always verify your payment service provider’s RBI authorization status at rbi.org.in before onboarding.

Understanding VyaparGateway’s Role — A Merchant UPI Tool, Not a PA

It is important to be transparent about where VyaparGateway fits in this regulatory landscape: VyaparGateway is not a Payment Aggregator and does not hold a PA license. VyaparGateway does not collect, pool, hold, or transfer customer funds on behalf of merchants.

VyaparGateway is a merchant UPI tool — a software layer that helps merchants directly accept UPI payments into their own bank-approved merchant UPI IDs (such as accounts registered with PhonePe Business, Google Pay for Business, Paytm for Business, or a bank’s own merchant UPI service).

Here is what this means in practice:

• You own the UPI ID: The merchant registers and holds their own UPI VPA with their bank or a UPI-enabled app. VyaparGateway does not own or operate this UPI ID on the merchant’s behalf.
• Money flows directly to you: When a customer pays, the funds transfer from the customer’s bank directly to the merchant’s bank account linked to their UPI ID. VyaparGateway is never in the payment flow — it does not touch, hold, or pool any funds at any stage.
• No nodal account, no escrow: Because VyaparGateway does not intermediate the fund flow, there is no nodal account and no escrow account involved in a VyaparGateway-powered transaction.
• What VyaparGateway provides: The platform provides the technical infrastructure — APIs, dynamic QR code generation, payment status webhooks, and a merchant dashboard — that makes it easy for businesses to integrate UPI collection into their websites, apps, or physical setups. Think of it as plumbing software, not a bank vault.

This distinction matters enormously in the context of PA regulations. The PA framework applies to entities that intermediate the fund flow — collecting from customers and paying out to merchants. VyaparGateway does neither. Merchants using VyaparGateway are responsible for ensuring their own UPI merchant account is properly registered and KYC-compliant with their bank or UPI app provider, which is a straightforward process handled directly between the merchant and the bank.

The Direct-to-Bank Compliance Alternative

The PA regulations apply to companies that pool and handle funds. If a software provider never touches the money, they do not require a PA license.

This regulatory nuance has led to the rise of Direct-to-Bank UPI Infrastructure as a practical and compliant alternative for merchants who cannot get through the PA onboarding gauntlet.

With a direct-to-bank UPI setup using a tool like VyaparGateway:

• You Provide the KYC: You connect your existing, bank-approved merchant UPI ID. Since your bank has already performed KYC on you during account registration, you don’t have to go through a redundant, weeks-long PA approval process.
• No Nodal Accounts: When a customer pays, the money flows directly from their bank to your bank. No intermediary holds the funds even for a second.
• Immunity from PA Pauses: Because this model bypasses the nodal account pooling system entirely, merchants are not affected by sudden onboarding freezes or risk-holds triggered by a PA’s regulatory situation.
• Lower Cost: Without the PA’s fee for intermediation, merchants often pay less per transaction.

By aligning your payment stack with direct-to-bank UPI architecture, you not only reduce costs but also ensure your business remains agile and insulated from the regulatory shocks that periodically freeze traditional payment gateway operations.

The key takeaway for any Indian merchant in 2026 is this: understand who is holding your money and whether they are authorized to do so. If your payment partner is a licensed PA, verify that authorization. If your payment partner is a merchant UPI tool that never touches funds, understand that distinction too. Informed choices about your payment infrastructure protect your business and your customers.