RBI Guidelines and Regulations on Digital Banking and Payment Systems

The Reserve Bank of India regulates digital payment systems and digital banking entities under the Payment and Settlement Systems Act, 2007, and the Banking Regulation Act, 1949. These frameworks govern payment system operators, non-bank prepaid payment instrument issuers, digital lending platforms, and digital banking units. They set statutory standards for cybersecurity, transaction processing, settlement safety, and financial consumer protection across India.

Regulatory Architecture and Primary Legislation

Statutory Powers of RBI

• The Payment and Settlement Systems Act, 2007 (PSSA) designates the RBI as the apex authority to regulate, supervise, and authorize all payment and settlement systems.
• Section 4 of the PSSA mandates prior written authorization from the RBI to commence or operate any payment system in India.
• The Board for Regulation and Supervision of Payment and Settlement Systems (BPSS), a committee of the Central Board of the RBI, oversees payment system policies.
• Section 18 of the PSSA empowers the RBI to issue binding directions, policy circulars, and technical guidelines to authorized payment system operators.

Licensing and Net Worth Norms

• Payment Aggregators (PAs) require RBI authorization and must maintain a minimum net worth of 15 crore rupees at application, scaling to 25 crore rupees within three years.
• Prepaid Payment Instrument (PPI) issuers must achieve and maintain a minimum positive net worth of 15 crore rupees.
• Non-bank entities operating Trade Receivables Discounting Systems (TReDS) require a minimum net worth of 25 crore rupees.
• Bharat Bill Payment Operating Units (BBPOUs) must maintain a minimum net worth of 25 crore rupees to process interoperable bill collections.

Classification of Digital Payment Instruments and Entities

Prepaid Payment Instruments (PPIs)

• PPIs are payment instruments that facilitate the purchase of goods and services against stored value.
• Small PPIs hold up to 10,000 rupees without full customer verification, permitted exclusively for merchant transactions without cash withdrawal.
• Full-KYC PPIs allow funds storage up to 2 lakh rupees, complete interoperability via UPI rails, and cash withdrawal limits up to 2,000 rupees per transaction.
• PPI issuers must maintain 100 percent of outstanding balances in an escrow account with a scheduled commercial bank.

Payment Aggregators and Payment Gateways

• Payment Aggregators directly handle customer funds, pool them, and transfer them to merchants after standard settlement periods.
• Payment Gateways purely provide technical infrastructure and software communication routing without handling client funds directly.
• Non-bank Payment Aggregators must settle merchant payouts exclusively through monitored escrow accounts.

Digital Banking Units (DBUs)

• DBUs are specialized, fixed-point business units set up by scheduled commercial banks to provide digital banking products and services.
• Each DBU operates with a self-service zone for digital checkouts and an assisted zone for human-supported onboarding.
• Banks can open DBUs in Tier-1 to Tier-6 centers without prior RBI permission, subject to minimum regulatory capital conditions.

Framework for Core Digital Payment Systems

Digital Lending and Consumer Protection Regulations

Digital Lending Directives

• Digital lending apps and platforms cannot disburse loans directly into third-party accounts; funds must flow directly between the borrower and the regulated entity bank account.
• Regulated entities must present a standardized Key Fact Statement (KFS) to the borrower before loan execution, stating the All-in Annual Percentage Rate (APR).
• Digital lending apps cannot access smartphone features such as file storage, contact directories, or call logs, except for single-time camera and microphone access during KYC verification.
• Borrowers receive a mandatory cooling-off or look-up period to exit digital loans without paying penalty charges.

Data Localization and Storage Directives

• All payment system operators must store complete payment data in systems located entirely within India.
• Data includes end-to-end transaction details, customer identifiers, payment credentials, and system logs.
• For cross-border transactions, payment processing outside India is permitted, but the final transaction data must be wiped abroad and stored exclusively in India within 24 hours.

Redressal Mechanisms

• The Reserve Bank – Integrated Ombudsman Scheme (RB-IOS) integrates three separate ombudsman systems into a single window for customer dispute resolution.
• The framework follows the “One Nation One Ombudsman” model with a Centralised Receipt and Processing Centre (CRPC) set up in Chandigarh.
• Digital platforms must appoint an internal grievance redressal officer and display nodal contact points prominently on their interfaces.

Facts

• The Payment and Settlement Systems Act came into effect on August 12, 2008.
• The Board for Regulation and Supervision of Payment and Settlement Systems was constituted in 2005 under the RBI Act.
• The Reserve Bank of India made NEFT operational 24 hours a day, 7 days a week, 365 days a year in December 2019.
• RTGS was transitioned to a 24x7x365 operational system in December 2020.
• Minimum transfer amount permitted through the RTGS network is 2 lakh rupees.
• Full-KYC Prepaid Payment Instruments can hold a maximum balance of 2 lakh rupees.
• Payment Aggregators must maintain a minimum net worth of 25 crore rupees on an ongoing basis.
• Under RBI data localization rules, international payment data processed overseas must be permanently stored only in India within 24 hours.
• Digital lending guidelines bar digital apps from accessing mobile phone media, device contacts, and location data continuously.
• The Centralised Receipt and Processing Centre for the RBI Integrated Ombudsman Scheme is located at the RBI Chandigarh office.
• Scheduled commercial banks with digital banking experience can set up Digital Banking Units in Tier-1 to Tier-6 centers without prior approval.
• The Reserve Bank of India launched the Digital Payments Index (RBI-DPI) in January 2021 with March 2018 as the base period at 100.