Payments Regulations

1. PAYMENT SYSTEMS IN INDIA
 SPECIFIC INSTRUMENTS
 PAYMENT GATEWAYS AND AGGREGATORS
 LOCALISATION OF PAYMENT DATA
 LOOKING AHEAD

2. INTRODUCTION
• Primary legislation – Payment and Settlement Systems Act, 2007
• Definition of a ‘Payment System’:
• a system that enables payment to be effected between a
payer and a beneficiary
• involves clearing, payment or settlement service or all of
them
• includes systems enabling credit card operations, debit card
operations, smart card operations, money transfer
operations
• excludes a stock exchange
J. Sagar Associates - Privileged & Confidential
2

3. INTRODUCTION
• Meaning of ‘Clearing’
• Meaning of ‘Settlement’
• Prior authorization from RBI required for commencement /
operation of a Payment System
• Exceptions:
• any person acting as the duly appointed agent
• company accepting payments either from its holding
company or any of its subsidiaries
• any person who has received a specific exemption from
RBI
J. Sagar Associates - Privileged & Confidential
3

4. PRE-PAID PAYMENT
INSTRUMENTS
• What is a PPI?
• It is a payment instrument
• It facilitates purchase of goods and services, including
financial services, remittance facilities
• Linked to value stored on such instruments
• Types of PPI
• Closed System PPIs
• Semi-closed System PPIs
• Open System PPIs.
J. Sagar Associates - Privileged & Confidential
4

5. CLOSED SYSTEM PPI
• Issued by an entity for facilitating the purchase of goods and
services from that entity alone
• Not a payment system – Does not require RBI authorization
• Does not permit cash withdrawal
• May be issued by any entity
J. Sagar Associates - Privileged & Confidential
5

6. SEMI-CLOSED SYSTEM
PPI
• Issued by an entity for purchase of goods and services from a group
of clearly identified merchants
• Merchants must have a specific contract with the issuer (or contract
through a payment aggregator / payment gateway) to accept the
PPIs as payment instruments
• May be issued by any entity (Bank, NBFC or other Indian company)
• Requires RBI authorization
• Does not permit cash withdrawal, irrespective of whether they are
issued by banks or non-banks
• Examples: Mobikwik, Freecharge, Citrus Pay
J. Sagar Associates - Privileged & Confidential
6

7. CATEGORIES OF SEMI-
CLOSED SYSTEM PPI
• Semi-Closed PPIs up to INR 10,000:
• These can be issued with “minimum details” of the customer, including
the mobile number verified with One Time Pin (OTP) and a self-
declaration with the name and unique identification number of any
officially valid document (OVD)
• No fund transfers to other PPIs / bank accounts permitted
• Semi-Closed PPIs up to INR 1,00,000:
• Full KYC to be undertaken i.e., the same level of KYC as required for
opening a bank account
• Transfer to pre-registered beneficiaries, may not exceed INR 1,00,000
per month per beneficiary
• Monthly funds transfer limit of INR 10,000, in all other cases
J. Sagar Associates - Privileged & Confidential
7

8. OPEN SYSTEM PPI
• These PPIs may be used at any merchant for purchase of goods and
services, including financial services, remittance facilities, etc.
• Allows cash withdrawal at ATMs / Point of Sale (PoS) / Business
Correspondents (BCs)
• Can be issued only any banks. Requires RBI authorization
• Transfer to pre-registered beneficiaries, capped at INR 1,00,000 per
month per beneficiary
• Monthly funds transfer limit of INR 10,000, in all other cases
• Funds transfer permitted to other open system PPIs, debit cards and
credit cards
• Example: SBI Gift Card
J. Sagar Associates - Privileged & Confidential
8

9. SPECIFIC CATEGORIES
• Gift Instruments
• May be issued by banks and non-banks
• Maximum value – INR 10,000
• Non reloadable; No cash outs, funds transfers permitted
• T&C to be clearly communicated by SMS / e-mail / post or
any other means at the time of issuance of the PPI / before
the first loading of funds
• PPIs for Mass Transit Systems (PPI-MTS)
• Issuer may determine the customer details required to be
obtained for issuance of such PPIs
• Reloadable; maximum value outstanding cannot exceed the
limit of INR 3,000
• No cash outs, funds transfers permitted
J. Sagar Associates - Privileged & Confidential
9

10. TYPES OF CARDS
• Debit Cards, Credit Cards, Prepaid Cards
• Debit cards – issued by banks and linked to a bank account.
• Credit cards – generally issued by banks and non-banks, but
can also be issued by other approved entities
• Prepaid cards – may be issued by banks/non-banks
• Usage of cards:
• For purchase of goods and services at POS terminals /
e-commerce (online purchase)
• Debit / credit / open system prepaid cards can be used
to withdraw cash from an ATM
J. Sagar Associates - Privileged & Confidential
10

11. AUTHENTICATION
• Card Present / CP transaction: carried out through physical
presence of card at the point of transaction (eg: ATM
transactions or purchase at POS terminal)
• Card Not Present / CNP transaction: does not require the
card to be physically presented at the point of transaction. (eg:
online transactions or a mobile banking transactions using the
card)
• Authentication: All CP and CNP transactions on cards issued
in India to be authenticated using ‘Additional Factor of
Authentication’ (AFA)
• Commonly used AFA - PIN, dynamic OTP, static code
J. Sagar Associates - Privileged & Confidential
11

12. OTHER
CONSIDERATIONS
• Payments for domestic CNP transactions
• CNP transactions for purchase of goods and services
using cards issued by banks in India
• Must be acquired by a bank in India
• Must be settled only in Indian currency
J. Sagar Associates - Privileged & Confidential
12

13. EXEMPTION FROM 2FA
• No AFA required for transactions upto INR 2,000 for online
CNP transactions
• Limit imposed per transaction, across all merchant
categories
• Only authorized card networks may provide such solutions
• Customers to continue to have the option to complete
transaction using 2FA
• AFA is not mandatory for transactions where outflow of
foreign exchange is contemplated
J. Sagar Associates - Privileged & Confidential
13

14. TOKENIZATION
• Tokenization and de-tokenization shall be performed only by the
authorized card network
• Actual card data, token and other relevant details shall be
stored in a secure mode
• Token requestors shall not store PAN or any other card detail.
• Registration of card on token requestor’s app - only with explicit
customer consent through AFA
• Customers may choose use cases (contactless, QR code
based, in-app payments), transaction and daily limits
J. Sagar Associates - Privileged & Confidential
14

15. TOKENIZATION
• Token requestor (third party app) must be certified for
• token requestor’s systems, including hardware
deployed for this purpose
• security of token requestor’s application
• features for ensuring authorized access to token
requestor’s app on the identified device
• other functions performed by the token requestor,
including customer on-boarding, token provisioning
and storage, data storage and transaction processing
J. Sagar Associates - Privileged & Confidential
15

16. RECURRING PAYMENTS
• Guidelines on processing e-mandate on cards for recurring
transactions issued by RBI on August 21, 2019
• Cardholders to undertake a one-time registration process
• First transaction to be undertaken with AFA validation
• E-mandate may be given for either a pre-specified fixed value of
recurring transaction or for a variable value of the recurring
transaction
• Overall cap fixed by the RBI – INR 2,000 per transaction
• Pre-transaction notification to be sent to the cardholder, at least
24 hours prior to the actual charge / debit to the card
• Choice to opt-out at any time, to be given to the cardholder
J. Sagar Associates - Privileged & Confidential
16

17. INTERMEDIARY GUIDELINES
• Intermediary – an entity that collects monies from customers
for payment to merchants using any electronic/online
payment mode, for goods and services availed by them and
subsequently facilitates the transfer of these monies to the
merchants in final settlement of the obligations of the paying
customers.
• Intermediaries to open a nodal account with an AD bank, for
receipt and disbursement of funds to merchants
• Entities facilitating delivery vs. payment transactions are not
considered as intermediaries
J. Sagar Associates - Privileged & Confidential
17

18. PAYMENT AGGREGATORS
AND GATEWAYS
• RBI issued guidelines on March 17, 2020
• Payment Gateways: technology infrastructure providers; not
involved in fund flows
• Payment Aggregators: allow merchants to accept various
forms of payments; involved in fund flows
• Mandatory authorization and compliances for PAs; Only
recommendations for PGs
• Regulations cover:
• Minimum capital requirements
• Governance requirements
J. Sagar Associates - Privileged & Confidential
18

19. PAYMENT AGGREGATORS
AND GATEWAYS
• KYC/AML compliances
• Merchant onboarding requirements
• Settlement timelines and escrow account requirements
• Security, fraud and risk mitigation methodologies
J. Sagar Associates - Privileged & Confidential
19

20. RBI LOCALIZATION
DIRECTIVE
• RBI Directive issued in April, 2018
• FAQS issued in June, 2019
• Addressed to authorized payment systems & licensed banks
• Objective - better monitoring & unfettered supervisory access
to data of:
• Payment system providers
• Service providers
• Intermediaries
• Third party vendors
• Other entities in payment ecosystem
J. Sagar Associates - Privileged & Confidential
20

21. RBI LOCALIZATION
DIRECTIVE
• Applicability:
• Payment system providers
• Banks
• Transactions through service providers, intermediaries,
payment gateways, third party vendors & other entities
• Scope:
• Entire data relating to payment system
• Full end-to-end transaction details
• Information collected, carried, processed in payment
message/instruction
• Customer data - name, mobile number
• Payment sensitive data - customer and beneficiary account
details
• Payment credentials - OTP, PIN, passwords
• Transaction data - transaction reference, timestamp, amount
J. Sagar Associates - Privileged & Confidential
21

22. RBI LOCALIZATION
DIRECTIVE
• Processing of transactions
• No bar on offshore processing
• Data must be deleted abroad and brought to India within
24 hours
• Settlement or chargeback processing permitted offshore
• Storage only in India
• Foreign leg of transaction partially exempt
• Deadline for compliance – October 15, 2018
• Enforcement – System Audit Report (SAR) by empaneled
auditor
J. Sagar Associates - Privileged & Confidential
22

23. THANK YOU
J. Sagar Associates - Privileged & Confidential
23
Probir@jsalaw.com
Yajas.setlur@jsalaw.com