Decoding of Payment Aggregator and Gateway Guidelines of Reserve Bank of India

“Digitalization of payment realisation process is undoubtedly a welcome step in the finance sector as the process has drastically reduced the effort and time to process payments at a click.”

Statutory Deadline: Unlike earlier, the issued guidelines mandate existing market players on this activity to obtain the Certificate of Authorization by 30th September, 2021 from the Department of Payment and Settlement, unit of Reserve Bank of India (RBI).

• Corporate Incorporation: Applicant must be company incorporated under Companies Act, 2013 with an object of doing proposed activity of operating as PAs/PGs business.
• Regulatory No Objection Certificate: Applicant being company if regulated by any of the financial sector regulators shall apply with a ‘No Objection Certificate’ from their respective regulator, within 45 days of obtaining such clearance.
• Capital Adequacy & Net-Worth Trajectory: Minimum capital requirement of applicant before application to RBI shall be at least INR 15 Cr as per its latest audited financial statement subject to made this net-worth INR 25 Cr by the end of third financial year of grant of authorization.
• Data Security Standard Compliance: Applicant shall maintain Payment Card Industry – Data Security Standard (PCI-DSS) and Payment Application – Data Security Standard (PA-DSS) compliance of the Infrastructure.
• Designated Escrow Account Maintenance: Applicant needs to maintain escrow account with any scheduled commercial bank (maximum two accounts allowed with two different scheduled commercial banks), known as Designated Payment Systems under section 23A of the Payment and Settlement System Act, 2007 (as amended in 2015).

Key Governance Tenets & Mandates

• Professional Board & Fit & Proper Criteria: Starting with the Board of Directors (BOD) of entity, it needs to be professionally managed. Promoters of the entity should satisfy the fit and proper criteria prescribed by RBI. Criteria states that such person should have a record of fairness and integrity, including but not limited to financial integrity, good reputation and character and honesty.
• Website Disclosures & Board Policies: Applicant shall disclose comprehensive information regarding merchant policies, customer grievances, privacy policy and other terms and conditions on the website and/or their mobile applications. Board shall have approved policy for disposal of complaints/dispute resolution mechanism/time-lines for processing refund, turn-around time for resolution of failed transaction as per RBI direction.
• Multi-Party Commercial Agreements: Agreement between PAs, merchants, acquiring banks, and all other stake holders shall clearly delineate the roles and responsibilities of the involved parties in sorting/handling complaints, refund/failed transaction, return policy, customer grievance redressal (including turnaround time for resolving queries), dispute resolution mechanism, reconciliation, etc.
• Appointment of Nodal Officer: Applicant shall appoint Nodal Officer responsible for regulatory and customer grievance handling functions. And the details of such Nodal officer shall be disclosed on their website. It is part of governance initiatives as an outcome of Customer Grievance Redressal and Dispute Management Framework in PAs business.
• Prior Intimation of Management Changes: Besides all these, any takeover or acquisition of control or change in management of entity shall be communicated by way of letter to the CGM, Department of Payment and Settlement Systems, RBI within 15 days with complete details. It is important to note that no threshold limit is prescribed by RBI.
• Mandatory AML/CFT KYC Norms: The Know Your Customer (KYC) is a crucial aspect of governance for any entity. Hence the RBI has issued direction and guidelines for the adoption of KYC norms and requirements which is applicable to PA/PG to formulate in the course of action as a counter-move to combat with money-laundering, financing of terrorism and so on.

CERT-In Empanelled Audit Mandate

Importance of implementation and regular monitoring of security, emphasizes the requirement of Information System Audit Report including cyber security audit conducted by CERT-In empanelled auditors within two months of the close of their financial year to the respective Regional Office of Department of Payment and Settlement System, RBI.

• Comprehensive Security Risk Assessment: Applicant at a minimum shall carry out comprehensive security risk assessment of its people, IT, business process environment, etc. to identify risk exposure with remedial measures and residual risks.
• Data Security & Encryption Standards: Data security standards and best practices like PCI-DSS, PA-DSS, latest encryption standards, transport channel security etc. shall be implemented.
• Mandatory Data Breach Reporting: Any data breach event in terms of card holder or anything else are serious matter and its threat on security, must be reported to RBI within stipulated timeframe.
• Merchant Onboarding Security Checks: Applicant shall undertake comprehensive security assessment while onboarding the merchant to ensure these minimal baseline security controls.
• Internal & External Technical Audits: Company shall carry out and submit to the IT Committee quarterly internal and annual external audit reports; bi-annual vulnerability assessment/penetration test reports, PCI-DSS including attestation of compliance and report of compliance.
• Board-Approved Information Security Policy: Board approved information security policy in alignment with business objectives, scope, ownership and responsibility for the policy, information security organizational structure, maintenance of asset inventory and registers, data classification, authorization, expectations, knowledge and skill sets required, compliance review etc. shall be incorporated and must be reviewed at least annually.
• Structured IT Governance Framework: An IT Policy shall be framed for regular management of IT functions and ensure that detailed documentation in terms of procedure and guidelines exist and are implemented. It shall have involvement of Board, IT Steering Committee, Enterprise Information Model, Cyber Crisis Management Plan as Governance Framework for IT Policy.
• Enterprise Data Dictionary: Applicant shall maintain an ‘enterprise data dictionary’ incorporating the organization’s data syntax rules in order to enable sharing of data across the application and systems.
• Granular Asset Risk Evaluation: Risk assessment shall, for each asset within its scope, identify the threat/vulnerability combinations and likelihood of impact on confidentiality, availability or integrity of that asset – from a business, compliance and/or contractual perspective.
• Least Privilege & Need-to-Know Access: Access to application has thumb rule across the Industry, to be facilitated on the principle of least privilege and ‘need to know’ commensurate with the job responsibilities, is requirement of applicant to adopt and implement in its platform.
• Human Resource IT Skills & Training: Resources are trained with requisite skills set for IT function and periodically assessed for the training requirements for human resources.
• Vendor Risk Management & BCP-DR: Vendor risk management is required for technology support, including Business Continuity Planning – Disaster Recovery (BCP-DR) and data management.
• IT Maturity Level Benchmarking: Entities shall consider assessing its IT maturity level, based on well known international standards, design an action plan and implement the plan to reach the target maturity level.
• Robust Encryption Protocols: Applicant shall adopt and implement strong encryption algorithms.
• Centralized Security Event Logging & SIEM Analysis: Security events from the entities infrastructure including but not limited to application, servers, middleware, endpoint, network, authentication events, database, web services, cryptographic events and log files shall be collected, investigated and analysed on regular intervals, then either enhanced or made proactive for identification of security alerts.
• Data Localization & Sovereign Jurisdiction: Entities shall take preventive measure to ensure storing data in infrastructure that do not belong to external jurisdiction.
• Prohibition on Storing Card Credentials: Customer card credentials shall not be stored within database or the server accessed by merchant.
• Card-Not-Present Authentication Standards: Option for ATM PIN as factor of authentication for card not present transactions shall not be given.
• Source-Mode Refund Routing: Refunds in case of failed transition or denied etc. shall be made to source mode of payment unless otherwise agreed by the user to credit amount in any other alternate mode.

“Gateway performs as communication channel whereas aggregator pool’s the fund from users and as per agreed terms and condition with merchant transfer, the eligible amount to their respective account.”

Application for registration needs to be placed to RBI at the earliest to carry on the ongoing business of existing market player else they need to stop the business activities. However, if the existing player has applied for authorization with the Department of Payment and Settlement System as per requirements, then the entity can pursue the ongoing business till the final decision from RBI is not communicated to the applicant entity.