How RBI Regulates Payment Apps in India
The Reserve Bank of India (RBI) regulates payment apps in India through laws, guidelines and security requirements. Applications such as Google Pay, PhonePe, Paytm and BHIM operate within a regulated payment system. The RBI supervises digital payments under the Payment and Settlement Systems Act, 2007, while the National Payments Corporation of India (NPCI) manages UPI operations. These regulations protect customers, prevent fraud and ensure safe transactions.
How Does RBI Regulate Payment Apps in India?
The RBI regulates payment apps in India by supervising payment systems, authorising payment service providers and prescribing security and consumer protection requirements.
Add LawBhoomi as your preferred source on Google.
However, not every payment application requires direct authorisation from the RBI. The regulatory requirements depend on the services provided by the application.
For example, a UPI application may operate through a partner bank, whereas a non-bank payment aggregator collecting payments for merchants generally requires RBI authorisation.
The RBI regulates these activities through several measures:
- Authorisation of Payment Systems: The RBI authorises entities operating payment systems and ensures that they satisfy the applicable regulatory requirements. Unauthorised operation of a payment system may attract action under the law.
- Transaction Security: The RBI prescribes security requirements to protect digital transactions from hacking, unauthorised access and financial fraud. Regulated entities must implement appropriate controls.
- Consumer Protection: The RBI establishes rules relating to failed transactions, refunds, compensation and grievance redressal. These measures protect customers when payment services do not function properly.
- Regulatory Supervision: The RBI monitors regulated payment service providers and can issue directions, impose restrictions or take other action when applicable requirements are violated.
These measures help maintain trust in India’s digital payment system.
Explore LawBhoomi's free law library for students and lawyers.
Which Law Regulates Payment Apps in India?
The primary legislation governing payment systems in India is the Payment and Settlement Systems Act, 2007.
The Act gives the RBI legal authority to regulate and supervise payment systems operating in India.
Important Provisions of the Payment and Settlement Systems Act, 2007
Section 4 – Authorisation of Payment Systems
Section 4 generally prohibits any person, other than the RBI, from commencing or operating a payment system without obtaining RBI authorisation, subject to the exceptions provided under the Act.
Section 5 – Application for Authorisation
Section 5 deals with applications seeking permission to operate a payment system. Entities must follow the prescribed procedure and satisfy the applicable regulatory conditions.
Section 10 – Power to Determine Standards
Section 10 empowers the RBI to prescribe standards for payment systems. These may relate to operational arrangements, security and other matters necessary for the functioning of payment systems.
Section 18 – Power to Give Directions
Section 18 authorises the RBI to issue directions to system providers and participants when necessary for regulating payment systems or protecting public interest.
Together, these provisions establish the legal foundation for digital payment regulation in India.
Does RBI Directly Regulate Google Pay, PhonePe and Other UPI Apps?
The RBI regulates the payment infrastructure through which UPI applications operate, but the regulatory relationship differs from that of banks and authorised payment system operators.
Find the latest legal internship opportunities, updated daily.
Google Pay, PhonePe and similar applications generally function as Third-Party Application Providers (TPAPs) within the UPI ecosystem.
These applications work with Payment Service Provider (PSP) banks and must follow applicable NPCI requirements.
What Is the Role of NPCI?
The National Payments Corporation of India operates the Unified Payments Interface (UPI).
NPCI manages the UPI network, establishes operational rules and coordinates participating banks and application providers.
The responsibilities are divided as follows:
- RBI: Regulates and supervises payment systems under applicable laws and directions.
- NPCI: Operates UPI infrastructure and establishes operational requirements for participating entities.
- PSP Banks: Provide banking infrastructure and support UPI services offered through participating applications.
- UPI Apps: Provide interfaces through which customers initiate and manage eligible UPI transactions.
Therefore, RBI and NPCI perform different but connected functions in regulating UPI payments.
What Are RBI Rules for Payment Aggregators?
Payment aggregators help merchants accept payments from customers through different payment methods.
For example, when you purchase a product online and pay through a payment processing service, a payment aggregator may facilitate the collection and settlement of the payment.
On 15 September 2025, the RBI issued the Reserve Bank of India (Regulation of Payment Aggregators) Directions, 2025.
Explore practical law courses to build career-ready legal skills.
These Directions govern different categories of payment aggregators.
Types of Payment Aggregators
- Online Payment Aggregators (PA-O) facilitate payments for online transactions where the customer and merchant are not physically present at the same location.
- Physical Payment Aggregators (PA-P) facilitate face-to-face payments, such as transactions at shops and other physical business locations.
- Cross-Border Payment Aggregators (PA-CB) facilitate specified payment transactions involving merchants and customers across national borders.
- The Directions prescribe requirements concerning authorisation, financial eligibility, merchant verification, escrow accounts and security arrangements.
- Non-bank payment aggregators generally require RBI authorisation, while banks undertaking payment aggregation business do not require separate authorisation under these Directions.
How Does RBI Regulate Digital Wallets?
Digital wallets fall within the RBI’s regulatory framework for Prepaid Payment Instruments (PPIs), where applicable.
A prepaid payment instrument allows transactions using value stored in an instrument or account.
For example, a customer may add money to an eligible digital wallet and subsequently use that balance for permitted transactions.
The RBI’s Master Directions on Prepaid Payment Instruments regulate matters such as:
- Issuance and Authorisation: Banks and eligible non-bank entities must comply with applicable requirements for issuing regulated prepaid payment instruments.
- Customer Verification: Wallet issuers must follow the relevant Know Your Customer (KYC) requirements depending on the type of instrument.
- Transaction Limits: Different categories of prepaid payment instruments are subject to prescribed loading, balance and usage conditions.
- Security and Customer Protection: Issuers must maintain appropriate security controls and provide grievance redressal arrangements.
Not every digital wallet operates under identical rules. The obligations depend on the type of wallet and the services it provides.
What Security Rules Must Payment Apps Follow?
The RBI has prescribed security requirements to reduce the risks associated with digital financial transactions.
On 30 July 2024, the RBI issued the Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators.
These Directions apply to authorised non-bank payment system operators, with phased implementation according to their size.
Cyber Security Requirements
Regulated operators must implement appropriate measures relating to:
- Protection of Customer Information: Payment system operators must maintain controls to protect sensitive information against unauthorised access, misuse and security breaches.
- Fraud Detection and Monitoring: Security systems must be capable of identifying suspicious activities and managing risks associated with payment transactions.
- Application Security: Operators must follow appropriate security practices when developing, testing and maintaining payment applications and related infrastructure.
- Incident Response: Payment system operators must establish procedures for responding to cyber security incidents and restoring affected services.
These requirements help reduce operational risks and improve the reliability of digital payments.
What Happens When a UPI Transaction Fails?
The RBI has prescribed specific timelines for resolving failed transactions through authorised payment systems.
Under its framework dated 20 September 2019, customers may be entitled to compensation when qualifying failed transactions are not reversed within the prescribed period.
RBI Rules for Failed UPI Transactions
| Failed Transaction | Maximum Reversal Timeline | Compensation for Delay |
| Money debited but beneficiary not credited | T+1 day | ₹100 per day beyond T+1 |
| Money debited but merchant does not receive transaction confirmation | T+5 days | ₹100 per day beyond T+5 |
Here, T means the transaction date.
For example, if a qualifying UPI fund transfer fails and the money is not reversed within T+1 day, the applicable compensation is ₹100 per day for the delay beyond that deadline.
The compensation must be provided automatically under the RBI framework.
However, these rules concern specified failed transactions and do not automatically apply to every payment dispute, mistaken transfer or authorised transaction involving fraud.
How Can Customers Complain Against Payment Apps?
Customers facing problems with digital payments can use the complaint mechanisms provided by the application, bank or relevant regulated entity.
For example, where money is deducted but the transaction fails, the customer can first raise a complaint through the payment application’s support system or the concerned bank.
Filing a Complaint with the RBI Ombudsman
The Reserve Bank – Integrated Ombudsman Scheme, 2026, effective from 1 July 2026, provides a cost-free grievance redressal mechanism for complaints involving covered RBI-regulated entities.
A complaint can generally be escalated when the regulated entity does not respond within 30 days or the longer period prescribed under applicable RBI, NPCI or card-network rules, or when the response is unsatisfactory.
Under the 2026 Scheme, an eligible complaint must ordinarily be filed within 90 days of the expiry of the applicable response period or the last communication from the regulated entity, whichever is later.
Complaints can be submitted through the RBI Complaint Management System.
The Ombudsman mechanism applies only where the concerned entity and complaint fall within the Scheme.
Can RBI Ban or Restrict a Payment App?
The RBI can take regulatory action against payment system operators and other regulated entities for violating applicable laws or directions.
Depending on the violation and relevant statutory powers, action may include operational restrictions, monetary penalties or measures affecting authorisation.
However, the RBI’s powers must be considered in relation to the legal status of the entity concerned. A bank, payment aggregator and third-party UPI application provider may have different regulatory obligations.
A payment application experiencing technical problems does not automatically mean that it has violated RBI regulations.
Conclusion
The RBI regulates payment apps in India through the Payment and Settlement Systems Act, 2007, regulatory directions, cyber security standards and consumer protection mechanisms.
While the RBI supervises the overall payment system, NPCI manages the UPI network and its operational requirements. Banks, payment aggregators and application providers have different compliance responsibilities.
These regulations help protect customer funds, improve transaction security and provide mechanisms for resolving payment disputes. As digital payments continue to expand, RBI regulation remains important for maintaining a secure and reliable payment ecosystem.
Join LawBhoomi’s 100K+ Community
