RBI to disallow Entities other than Credit and Debit Card issuers and Networks from Storing Transaction Data from August 2025

RBI issues directive for Credit and Debit cardholders
RBI - Reserve Bank of India - Credit and Debit Card Issuers - Credit and Debit Card Issuers and Networks - TAXSCAN

On Tuesday, the Reserve Bank of India issued a directive instructing all payment aggregators to conduct thorough due diligence of merchants according to RBI’s standards, aiming to regulate the payment ecosystem. The RBI stated that Know Your Customer ( KYC ) and due diligence requirements would be enforced three months from the circular’s issuance date, with payment aggregators required to complete due diligence on all merchants by September 30, 2025. Additionally, the central bank mandated aggregators to continually monitor merchant transaction activities.

The RBI’s notification outlined that merchants would be shifted to a higher Customer Due Diligence ( CDD ) category based on their transaction patterns. Upon migration, payment aggregators must promptly conduct additional due diligence on the merchant as outlined in the guidelines.

Moreover, the RBI’s directive extends to cardholders, specifying that only card issuers and card networks can retain transaction data from August 2025 onwards. Non-bank payment aggregators have been instructed to register with the Financial Intelligence Unit-India ( FIU-IND ) and furnish the required information as requested by the unit.

Regarding Payment Aggregators – physical Point of Sale ( PA-P ), the RBI stipulated that non-bank entities providing these services must possess a minimum net worth of Rs 15 crore upon authorization. By March 31, 2028, a minimum net worth of Rs 25 crore is mandatory, to be maintained thereafter.

For existing non-bank PA-P entities failing to meet the aforementioned requirements or failing to apply for authorization within the designated period, the RBI has directed them to cease PA-P activities by July 31, 2025. Furthermore, banks have been instructed to close accounts associated with non-bank PA-P activities by October 31, 2025, unless such entities provide evidence of having applied for authorization from the RBI.

Support our journalism by subscribing to Taxscan premium. Follow us on Telegram for quick updates

taxscan-loader