Unified Startup Enablement & Growth Platform

RBI Compliance — Payments, Data Localisation & Fintech Regulations

The Reserve Bank of India (RBI) is the most active regulator in India's startup ecosystem, with mandatory frameworks covering payment aggregators (PA), payment gateways (PG), card tokenisation (CoFT), prepaid instruments (PPI), and data localisation for all payment data. Any startup processing, facilitating, or storing payment transactions in India must comply.

Corpfy maps your payment flows, implements data-localisation architecture on AWS ap-south-1 / GCP asia-south1, manages PA/PG licence applications, and ensures your card tokenisation, DPSC reporting, and audit readiness meet RBI circular standards.

Key circulars: PA/PG Guidelines 2020, Storage of Payment System Data 2018, Card Tokenisation 2021, Prepaid Payment Instruments (PPI) Master Directions
Data localisation: All payment system data must be stored exclusively in India (AWS ap-south-1 / GCP asia-south1)
Card-on-file tokenisation: Raw PANs may not be stored; CoFT mandatory since October 2022
Penalty exposure: ₹10,000/day + licence revocation for PA/PG non-compliance

Who Needs RBI Compliance

Entity Coverage Matrix

RBI compliance is not optional for any startup that touches payment data of Indian customers

Entity Type	Primary Obligation	Licence Required	Data Localisation
Payment Aggregator (PA)	PA Guidelines March 2020; Net worth ₹15–25 Cr; SAR/TAR audit	Yes — RBI PA Licence	Mandatory — India-only storage
Payment Gateway (PG)	PG Guidelines 2020; technology-service provider to PA	Via PA entity	Mandatory
Prepaid Payment Instrument (PPI)	PPI Master Directions; KYC, limits, cross-border rules	Yes — PPI Licence	Mandatory
E-commerce / marketplace	CoFT for stored cards; tokenisation mandate Oct 2022	No own licence — use RBI-authorised PA	Via PA
Fintech SaaS (lending, BNPL)	Digital Lending Guidelines 2022; FLDG caps; LSP obligations	Via NBFC / bank partner	All loan data in India
Crypto exchanges (VASP)	FEMA reporting; FIU-IND registration; PMLA compliance	FIU-IND registration	Mandatory

Five RBI Compliance Pillars Corpfy Implements

PA/PG Licence Journey

Corpfy manages the full 6-stage RBI PA licence application: net-worth certificate, SoA, SAR audit, security framework, DPSC reporting, and in-principle to final approval.

Data Localisation Architecture

All payment system data — transaction data, card data, KYC — must reside exclusively in India. Corpfy provisions GCP asia-south1 or AWS ap-south-1 and validates zero-cross-border leaks.

Card-on-File Tokenisation (CoFT)

Raw PANs cannot be stored after October 2022. Corpfy integrates your stack with a network token requestor (Visa, MC, RuPay) and migrates existing card-on-file data to tokens.

DPSC & Regulatory Reporting

Data Processing and Security Committee (DPSC) reports, quarterly returns, SAR/TAR audits. Corpfy automates data collection and prepares RBI-compliant report formats.

Security & Audit Framework

PCI DSS alignment, vulnerability management, incident reporting to RBI within 2–6 hours, and annual VAPT by RBI-empanelled agency.

PA Licence Journey — 6 Stages

S1: Eligibility

Net worth, promoter fit, business plan

S2: Application

COMS portal submission + SoA

S3: In-Principle

RBI review; letter valid 180 days

S4: SAR Audit

Security Audit Report by RBI-empanelled auditor

S5: Compliance

Data localisation, CoFT, DPSC, escrow

S6: Final Licence

Authorisation letter + DPSC reporting begins

Key RBI Circulars & Corpfy Coverage

Circular-by-Circular Implementation

Corpfy directly maps deliverables to each applicable RBI circular

Circular / Direction	Key Requirement	Corpfy Deliverable	Status
PA/PG Guidelines, Mar 2020	Authorisation, net-worth, escrow, merchant onboarding	Licence application end-to-end management	Full Coverage
Storage of Payment System Data, Apr 2018	All payment data in India only; no foreign mirror	GCP/AWS India region architecture + zero-leak validation	Full Coverage
Card Tokenisation, Sep 2021 (effective Oct 2022)	No raw PAN storage; CoFT via network token requestor	Token integration (Visa/MC/RuPay) + PAN migration	Full Coverage
Digital Lending Guidelines, Sep 2022	LSP disclosure, disbursement to borrower account, FLDG caps	Digital lending policy doc + tech stack compliance review	Fintech Specific
PPI Master Directions, Aug 2021	KYC, ₹10K/₹2L wallet limits, cross-border rules	KYC flow, limit enforcement, reporting setup	PPI Specific
Cyber Security Framework, Jun 2016	SOC, incident reporting ≤2–6 hrs, VAPT, DR drill	Security controls, IR plan, empanelled VAPT coordination	Full Coverage
DPSC Reporting	Data Protection and Security Committee quarterly reports to RBI	Report automation + RBI format templates	Full Coverage

Data Localisation — What Exactly Must Stay in India

Payment System Data Localisation Scope

RBI's 2018 circular requires ALL components of the payment message/transaction to reside only in India

Data Category	Examples	Allowed Region	Corpfy Solution
End-to-end transaction data	Amount, merchant ID, timestamp, payment mode	India only	GCP asia-south1 / AWS ap-south-1 primary + replica
Payment account data	Masked PAN (token), bank account number, IFSC	India only	Encrypted at rest; Indian KMS key
Customer authentication data	OTP, 2FA logs, device fingerprint	India only	Firebase Auth routed via India region endpoint
KYC documents	Aadhaar number (masked), PAN, photo ID	India only	Firebase Storage bucket: asia-south1
Settlement data	Merchant settlement amounts, UTR, batch IDs	India only	Firestore database: asia-south1 region
Logs of payment events	Success/failure events, retry attempts, webhook logs	India only	GCP Cloud Logging sink restricted to asia-south1

⚠️ What Happens Without RBI Compliance

PA operations without licence: illegal aggregation of funds — criminal liability under PSS Act 2007
Data stored abroad: RBI can direct payment networks to block processing through your entity
Raw PAN storage after Oct 2022: PCI DSS breach + RBI enforcement action + card network fines
Missing DPSC reports: ₹10,000/day penalty per missed reporting period
Series A blockers: fintech investors run RBI compliance due diligence before term sheets

What Corpfy Delivers

Deliverables & Artefacts

A complete RBI compliance package for payment-processing startups

Deliverable	Description	Format
PA Licence Application Package	COMS submission, net-worth certificate, SoA, business plan	Docs + Portal
Data Localisation Architecture	GCP/AWS India-region Terraform + validation scripts proving zero foreign data flow	IaC + Report
Card Tokenisation Integration	CoFT API integration with Visa/MC/RuPay token requestor; PAN migration guide	Code + Docs
SAR Audit Coordination	Scope document, empanelled-agency engagement, gap remediation tracker	Project + Report
DPSC Report Templates	Quarterly Data Protection & Security Committee report in RBI-required format	Excel + PDF
Incident Response Plan (RBI)	RBI-specific IRP with ≤2-hour critical incident reporting and CISO escalation chain	PDF Playbook
Merchant Onboarding Policy	PA merchant due diligence, prohibited-category list, KYC checklist	PDF Policy
Escrow Account Setup Guide	Nodal/escrow account structure per PA Guidelines for merchant settlement	PDF
RBI Compliance Certificate	Corpfy-signed attestation of circular-compliance status for investor due diligence	PDF

Frequently Asked Questions

Does my startup need an RBI PA licence to accept payments?+

Not necessarily — it depends on how you handle the money.

Using a licensed PA (Razorpay, PayU, Cashfree): you are a merchant on their platform and do not need your own PA licence.
Holding merchant funds before settlement: you are acting as a Payment Aggregator and must be RBI-licensed. This includes marketplaces that pool seller payments and BNPL platforms.
Only redirecting customers to a payment page: you are a Payment Gateway and operate under your PA partner's licence.

Operating as an unlicensed PA is a criminal offence under the Payment and Settlement Systems Act, 2007.

What is data localisation and which payment data must stay in India?+

RBI's 2018 circular requires that the entire payment transaction data must be stored only in India — no foreign copy, no mirroring, no backup abroad.

This covers: transaction amount and timestamp, tokenised card data, bank account number and IFSC, customer authentication data, KYC documents, settlement data, and event logs. For GCP startups this means restricting all payment-related resources to asia-south1 (Mumbai). On AWS, ap-south-1 is required. Corpfy delivers Terraform configuration and post-deployment validation scripts proving zero payment data flows outside India.

What is card tokenisation (CoFT) and are we required to implement it?+

Card-on-File Tokenisation (CoFT) is RBI's mandate (effective October 1, 2022) that no entity may store raw card data (PAN, expiry, CVV) after a transaction. The raw PAN must be replaced with a network token issued by Visa, Mastercard, or RuPay through an RBI-approved Token Service Provider.

If your platform offered "saved cards" before October 2022, those raw PANs must have been deleted or tokenised. Non-compliance is a PCI DSS violation AND an RBI enforcement action — card networks can fine acquiring banks who process non-compliant merchants, and banks will terminate your merchant account.

How long does the PA licence process take?+

The PA licence typically takes 12–24 months from application to final authorisation across 6 stages: Eligibility → COMS Application → In-Principle Approval → SAR Audit → Compliance Verification → Final Authorisation.

There is no expedited pathway. Startups that begin only when an enterprise customer or investor demands a PA licence find themselves unable to close deals for 18+ months. The right time to start is when you first determine your business model requires fund aggregation — typically at founding.

What is DPSC and what do we report to RBI?+

DPSC (Data Protection and Security Committee) is a governance body RBI requires all licensed PAs to constitute, including senior management (CEO, CTO, CISO). It must meet quarterly and submit reports to RBI covering: cybersecurity incidents, VAPT findings, infrastructure changes, data localisation status, and merchant onboarding risk summary.

Corpfy automates the data collection for each section and produces the report in RBI's expected format, ready for DPSC sign-off and submission.

What are the penalties for RBI non-compliance?+

RBI's enforcement powers under the Payment and Settlement Systems Act, 2007 are significant:

Operating without a PA licence: criminal prosecution, fines, ISP-directed platform blocking
Data localisation violations: ₹10,000 per day + potential licence suspension
Missing DPSC quarterly reports: ₹10,000 per day per missed submission
CoFT non-compliance: PCI DSS fines from card networks + RBI enforcement
Licence revocation: RBI can revoke the PA licence for repeated violations — existential for a payment business

Key Takeaways — RBI Compliance for Indian Fintech Startups

The PA vs PG distinction determines whether you need a licence:

If your platform at any point holds merchant funds before settling them — even briefly, even in an escrow — you are a Payment Aggregator and require an RBI PA licence. Most marketplaces, BNPL platforms, and escrow-based services fall on the PA side of this line without realising it. Operating as an unlicensed PA is a criminal offence under PSS Act 2007.

All payment system data must reside exclusively in India — no exceptions:

RBI's data localisation circular covers the complete payment message — not just the card number, but transaction logs, authentication events, settlement records, KYC documents, and event logs. Default multi-region replication that cloud providers enable by default will violate this requirement. Corpfy's Terraform configuration enforces regional restriction and includes post-deployment validation to prove zero foreign data flows.

Raw PANs may not be stored anywhere in your stack after October 2022:

CoFT is not optional. Every entity in the payment chain is prohibited from storing raw card numbers, expiry dates, or CVVs after October 1, 2022. If your database, logs, or analytics pipeline captures a full 16-digit card number, you are in violation of both RBI directions and PCI DSS. Remediation requires identifying all raw PAN storage, deleting existing records, and integrating with a Token Service Provider.

The PA licence takes 12–24 months — start before you need it:

There is no expedited PA licence pathway. Startups that begin only when an enterprise customer or investor demands a licence find themselves unable to close deals for 18+ months. The right time to start is when you first determine your business model requires fund aggregation — typically at founding, not at Series A.

RBI, CERT-In, and DPDPA obligations overlap for fintech — implement with a unified IRP:

A payment data breach triggers RBI's 2–6 hour reporting SLA, CERT-In's 6-hour reporting SLA, and DPDPA's breach notification obligation simultaneously. Implementing a single unified incident response plan satisfying all three regulators is both more efficient and more defensible to each regulator than three separate IRPs.

Inside Corpfy RBI Audit

Corpfy's RBI Audit dashboard tracks compliance across PA Licensing, Data Localisation, Card Tokenisation (CoFT), DPSC Reporting, and KYC/AML — with applicability flags for your entity type (Payment Aggregator, Payment Gateway, NBFC, Bank). Every circular maps to a concrete compliance task.

Capability	What it does	Output
Circular Compliance Register	20 key RBI circulars mapped to compliance tasks, filterable by entity type	Audit-ready circular compliance log
Data Localisation Validator	Tracks payment data storage in India-only regions (GCP asia-south1 / AWS ap-south-1)	Data localisation compliance certificate for RBI inspection
CoFT Implementation Tracker	Tracks raw PAN purge status and Token Service Provider integration progress	CoFT compliance evidence — PAN deletion log + token integration proof
DPSC Report Builder	Assembles quarterly DPSC report sections in RBI-expected format	Quarterly DPSC submission-ready report
PA Licence Stage Tracker	Tracks all 6 stages of PA licence process with document checklist per stage	Licence application progress evidence for internal governance

Third-party tool integrations: Corpfy integrates with Indian payment gateways — Razorpay, Cashfree, PayU, and Paytm — for automated transaction data localisation validation and CoFT compliance reporting. For international payment flows, Stripe and Adyen integrations are also supported.