RBI Digital Banking and Payment System Guidelines

The RBI regulates India’s digital payment and digital banking ecosystem through the Payment and Settlement Systems Act, 2007 and the Banking Regulation Act, 1949. These rules govern payment systems, prepaid instruments, payment aggregators, digital lending apps and digital banking units, with a focus on security, settlement safety and consumer protection.

Regulatory framework

The Payment and Settlement Systems Act, 2007 (PSSA) gives the Reserve Bank of India the legal authority to regulate, supervise and authorize payment and settlement systems in India. No payment system can be started or operated without prior written authorization from the RBI under Section 4.

The Board for Regulation and Supervision of Payment and Settlement Systems (BPSS), a committee of the RBI’s Central Board, oversees policy matters relating to payment systems. Section 18 of the PSSA empowers the RBI to issue binding directions, policy circulars and technical guidelines to authorized operators.

• PSSA came into effect: 12 August 2008.
• BPSS: Constituted in 2005 under the RBI Act.
• RBI role: Apex regulator for payment and settlement systems in India.
• Key focus areas: Authorization, supervision, cybersecurity, settlement safety and consumer protection.

Licensing and net worth norms

• Payment Aggregators (PAs): Require RBI authorization and must have a minimum net worth of ₹15 crore at application.
• Payment Aggregators: Net worth must rise to ₹25 crore within three years.
• Prepaid Payment Instrument (PPI) issuers: Must maintain a minimum positive net worth of ₹15 crore.
• Non-bank TReDS operators: Require a minimum net worth of ₹25 crore.
• BBPOUs: Must maintain a minimum net worth of ₹25 crore to process interoperable bill collections.
• Banking/settlement entry: These thresholds are used by RBI to assess operational soundness and customer protection.

Prepaid instruments and payment intermediaries

Prepaid Payment Instruments (PPIs) allow purchase of goods and services against stored value. They are issued in different categories depending on customer verification and usage limits.

• Small PPIs: Up to ₹10,000 without full customer verification.
• Small PPIs: Permitted only for merchant transactions; cash withdrawal is not allowed.
• Full-KYC PPIs: Can store up to ₹2 lakh.
• Full-KYC PPIs: Allow interoperability through UPI rails.
• Cash withdrawal limit: Up to ₹2,000 per transaction.
• Escrow protection: PPI issuers must keep 100% of outstanding balances in an escrow account with a scheduled commercial bank.

Payment Aggregators collect customer funds, pool them and transfer them to merchants after settlement. Payment Gateways only provide the technical infrastructure for routing payment data and do not handle customer funds directly.

• Payment Aggregators: Handle merchant settlements through monitored escrow accounts.
• Payment Gateways: Provide software connectivity and transaction routing.
• Non-bank PAs: Must route merchant payouts only through escrow arrangements.
• Regulatory distinction: Fund handling attracts stricter RBI supervision than pure technology services.

Core digital payment systems

• RTGS: Used for high-value transfers in real time.
• NEFT: Works on deferred net settlement and is available 24x7x365.
• IMPS: Enables instant retail fund transfer at any time.
• UPI: Uses virtual aliases and real-time interoperability.
• NACH: Designed for recurring bulk payments and collections.

Exam fact: NEFT became operational 24x7x365 in December 2019, while RTGS shifted to 24x7x365 in December 2020.

Digital banking units and lending rules

Digital Banking Units (DBUs) are fixed-point business units set up by scheduled commercial banks to offer digital banking products and services. Each DBU has a self-service zone for digital transactions and an assisted zone for support and onboarding.

• DBUs: Can be opened in Tier-1 to Tier-6 centres.
• RBI permission: Prior RBI approval is not required, subject to regulatory capital conditions.
• Purpose: To expand low-cost, technology-led banking access.

RBI’s digital lending directives are intended to protect borrowers from opaque practices.

• Loan disbursal: Funds cannot be disbursed directly into third-party accounts.
• Flow of funds: Should move directly between the borrower and the regulated entity’s bank account.
• Key Fact Statement (KFS): Must be given before loan execution.
• All-in Annual Percentage Rate (APR): Must be disclosed in the KFS.
• App permissions: Lending apps cannot access file storage, contact directories or call logs.
• Allowed access: One-time camera and microphone access may be used for KYC verification.
• Cooling-off period: Borrowers must get a look-up period to exit the loan without penalty.

Data localization and grievance redressal

RBI requires payment data to be stored in systems located entirely within India. This includes transaction details, customer identifiers, payment credentials and system logs.

• Domestic storage: Complete payment data must remain in India.
• Cross-border processing: Temporary processing abroad is permitted for foreign leg transactions.
• Data finalization: Final transaction data must be deleted abroad and stored in India within 24 hours.
• Compliance aim: Better oversight, security and auditability.

The Reserve Bank-Integrated Ombudsman Scheme (RB-IOS) combines three ombudsman systems into a single-window grievance mechanism.

• Model: “One Nation One Ombudsman”.
• Centre: Centralised Receipt and Processing Centre (CRPC), Chandigarh.
• Platform duty: Digital platforms must appoint an internal grievance redressal officer.
• Disclosure: Nodal contact points should be displayed prominently on interfaces.

Key Prelims Takeaways

• RBI authority: Under the PSSA, RBI is the apex regulator for payment systems.
• Authorization rule: No payment system can operate in India without prior RBI permission.
• PPIs: Small PPIs are capped at ₹10,000; Full-KYC PPIs can hold up to ₹2 lakh.
• Escrow protection: PPI issuers must keep 100% outstanding balance in escrow with a scheduled commercial bank.
• RTGS and NEFT: RTGS has a minimum transfer of ₹2 lakh; NEFT has no minimum limit.
• Digital lending safeguards: KFS, APR disclosure, fund-flow restrictions and cooling-off period are mandatory.
• Data storage: Payment data must be stored within India, with foreign processing subject to deletion and domestic storage timelines.

Exam fact: Minimum transfer amount through RTGS is ₹2 lakh.

Exam fact: Full-KYC PPIs can hold a maximum balance of ₹2 lakh.