Accepting payments in India. 6 chapters and a final quiz.

Chapter 1. Choosing who collects for you: PG, PA, or PSP bank.

The first decision is the only one you cannot cheaply reverse: who touches the money before you do. In India, the collection chain runs merchant → payment aggregator (PA) or acquiring bank → PSP bank → NPCI → payer's bank. No merchant, Indian or foreign, connects to NPCI directly. Access to the rail is reserved for banks. So you choose an intermediary, and that choice commits your cash flow, your license, and your ability to operate.

Gateway or aggregator: the question to ask at the first meeting

The Reserve Bank of India (Regulation of Payment Aggregators) Directions, 2025, published on September 15, 2025, completely overhauled the aggregator regime and split the business into three separate authorizations. PA-O covers online aggregation and PA-P covers in-person aggregation, which brings in-store acquiring by non-banks into scope. PA-CB covers cross-border payment aggregation, under a framework dating from an RBI circular of October 31, 2023. A provider can hold one without the others. “We're RBI licensed” is not an acceptable answer.

• Net worth: ₹15 crore when the application is filed, rising to ₹25 crore by the end of the third financial year after authorization (RBI, Regulation of Payment Aggregators Directions, 2025).
• Legal form: a non-bank aggregator must be a company incorporated in India under the Companies Act, 2013. There is no PA license for a foreign entity, and that is the pivot point of any market entry strategy.
• Ring-fencing: merchant funds pass through an *escrow account with a Scheduled Commercial Bank*** in India, kept separate from the aggregator's own funds.
• Settlement to the merchant: the 2025 Directions require T+1 settlement. Write that benchmark into the contract and check it against actual statements.
• Cross-border: the PA-CB regime caps a single transaction at ₹25 lakh (RBI circular of October 31, 2023) and requires dedicated collection accounts, separate from the domestic escrow.
• Transition deadline: applications had to be filed by December 31, 2025, and aggregators without one had to stop operating by February 28, 2026 (RBI, 2025 Directions). A provider that missed that window is no longer operating legally.

Chapter 2. UPI in production: intent, collect, VPA, and QR.

“Integrating UPI” means you have picked a mode. There are two, and they differ in user experience, success rate, and fraud profile. In intent mode, the merchant pushes: it builds a upi://pay link that the phone opens, prefilled, in the customer's UPI app. The customer just enters their UPI PIN. In collect mode, the merchant pulls: it sends a payment request to the payer's ID. The payer gets a notification and has to find it, open it, and approve it before it expires. Intent removes two steps and the dependency on a notification, which makes it the default mode for any serious merchant integration.

upi://pay
  ?pa=marchand@banque      # payee address: the payee's VPA (required)
  &pn=Nom%20Du%20Marchand  # payee name: shown in the payer's app
  &mc=5814                 # merchant category code, assigned by the acquirer
  &tr=CMD-2026-000178      # transaction reference: YOUR order ID
  &tn=Commande%20178       # transaction note, visible to the customer
  &am=1499.00              # amount, in rupees, two decimal places
  &cu=INR                  # currency: INR only

Parameter source: NPCI, UPI Linking Specification.

GOLDEN RULE OF RECONCILIATION
  tr  = your reference: you choose it, and it comes back in the callback
  txn = the UPI ID, generated by the rail: you only learn it afterward
  NEVER reconcile on amount + timestamp: on a rail that
  handles 23.66 billion transactions a month, collisions are certain.

A VPA is not an IBAN

• A VPA (Virtual Payment Address), in the form name@bank, is an alias, not an account. It can be revoked or moved from one bank to another, and one customer can hold several. Never use it as the primary key in your customer database.
• Validate a VPA before you use it: the address validation call returns the holder's name as their bank has it on file. Show that name to the customer and have them confirm it. It is your best protection against a typo, which cannot be undone on an instant rail.
• VPAs are case-insensitive for resolution, but your storage has to normalize them: Ravi@okhdfcbank and ravi@okhdfcbank point to the same account and must map to a single record.
• A newly created UPI ID, or a newly linked account, is capped at ₹5,000 for the first 24 hours. A new customer whose first order exceeds that amount will fail, and your integration is not to blame.
• Limits are category-specific, not universal: ₹1 lakh a day for P2P, and up to ₹5 lakh per transaction and ₹10 lakh per 24 hours for certain verified merchant categories since September 15, 2025 (NPCI circular of August 28, 2025). Your MCC sets your limit, so get it confirmed in the contract, not in production.

Chapter 3. Zero MDR: building a cost model when there is no fee.

A head of payments who arrives in India with a spreadsheet of ad valorem fees should close it. Since January 1, 2020, under Section 269SU of the Income-tax Act 1961, the merchant fee has been zero by law on RuPay debit cards and BHIM-UPI. This is not a low market rate open to renegotiation: the law bans charging at all. In a market where UPI carries 85.5% of volume, your marginal cost of acceptance on most transactions is zero. So is your provider's revenue.

Where fees remain, and where they are gone

Cout_acceptation = Sum over each instrument i of:
                     Volume_i x Ticket_moyen_i x Taux_i  +  Frais_fixes_i

Known, enforceable rates (sources in the table above):
  UPI account to account ............. 0.00%    (Income-tax Act, s.269SU)
  RuPay debit card ................... 0.00%    (Income-tax Act, s.269SU)
  UPI merchant > ₹2,000 .............. 0.40%    (NPCI, from 2026-10-15)
  PPI wallet on UPI, > ₹2,000 ........ 1.10%    (NPCI, since 2023-04-01)
  PPI wallet on UPI, <= ₹2,000 ....... 0.00%    (NPCI, since 2023-04-01)
  Visa / Mastercard cards ............ r_negocie  <-- TO BE OBTAINED, unregulated
  RuPay credit card on UPI ........... NPCI schedule, above ₹2,000

WORKING ASSUMPTION (replace with your actual mix, measured over 90 days):
  anchor: UPI = 85.5% of national VOLUME, 9.5% of VALUE
          (RBI, Payment Systems Report 2026)
  => in India, volume is free and the value is elsewhere.
     A revenue model based on a percentage of the amount collected
     has almost nothing to apply to. This is not a negotiation
     problem. It is a model problem.

WHAT TO MEASURE INSTEAD:
  cost per successful transaction = (fixed fees + subscriptions) / # successful tx
  cost of a failure               = retry + support + lost order
  cost of the payout              = payout fees + days of cash tied up (T+1)

One contractual risk needs handling now. The zero MDR is a policy choice, not a law of nature. Since 2025, the Payments Council of India has been lobbying to restore a 0.3% fee on UPI for large merchants only, with a turnover threshold of ₹40 lakh under discussion. In March and April 2026, Parliament's Standing Committee on Finance recommended reinstating an MDR for large merchants. No decision has been made so far. Treat this as a contract risk. Negotiate now the clause that will apply if an MDR comes back (cap, notice period, right to terminate), rather than discovering it in a one-sided amendment.

Chapter 4. Cards: RuPay, network choice, and mandatory tokenization.

Cards have not disappeared in India, but the market has split in two. Debit is collapsing because UPI does what debit cards did, for free and better. Volume fell from 408 crore to 133 crore transactions between 2021 and 2025, an average decline of 24.4% a year (RBI, Payment Systems Report 2026). Credit, meanwhile, grew 27% a year over the same period. The operational takeaway is clear. In India, the card is a credit instrument. Designing an acceptance flow around debit means optimizing a channel that is dying out.

What India's card regime won't let you do

Two habits imported from mature card markets fall flat in India. The first is least-cost routing. Since the RBI circular on network choice took effect on September 6, 2024, issuers can no longer sign exclusivity deals with a network. They must let customers choose their network at issuance and at renewal. The customer picks one network, not two applications on the same card, so there is no dynamic routing at the point of sale for acquirers to exploit. The second is the global card vault, which is illegal, and which the rest of this chapter covers.

The market's real differentiator lies elsewhere: RuPay Credit Card on UPI. A RuPay credit card is linked to a UPI ID and pays by scanning a merchant QR code, with the UPI PIN as authentication. You therefore accept credit on a QR code, with no terminal, along with the fee that comes with it above ₹2,000. The scope is limited. Cash withdrawals at merchants, P2P, and card-to-card payments are excluded, and standard UPI limits apply. There is no Visa or Mastercard equivalent on this rail. If your average ticket justifies credit, this card is the only way in through QR.

Tokenization: you no longer store anything

• Since October 1, 2022, merchants and their aggregators may no longer store the card number, CVV, or expiration date. Only the issuer and the network hold that data; you work with a token.
• Creating a token requires the cardholder's explicit consent, validated by an additional factor of authentication with the issuer (AFA). You cannot quietly tokenize an existing card base: every customer has to make a new authenticated payment.
• Guest checkout allows time-limited retention: up to T+4, or the settlement date if that comes first. That is not storage. It is a temporary reprieve.
• Since December 2023, the RBI has allowed tokenization at the issuer level (CoFT through card issuing banks): cardholders can create tokens in their bank's interface for the merchants they choose. You inherit tokens you never requested, and your back office must be able to accept them.
• What this means for migrations: an Indian token is specific to the merchant-network-issuer combination. Switching providers without a portability clause forces you to re-authenticate your entire customer base. Negotiate portability in the contract when you sign up, never when you leave.

Chapter 5. Subscriptions: e-NACH, UPI AutoPay, and the 2026 e-mandate framework.

Two rails carry recurring direct debits in India, and you choose based on ticket size, not technical preference. NACH, run by NPCI, is the bulk clearing rail. Its paperless version, e-NACH, registers a mandate online through Aadhaar (India's national digital ID), net banking, or a debit card. UPI AutoPay is a mandate linked to the payer's UPI ID and executed by the switch. The first collects loan installments, insurance premiums, and systematic investment plans. The second collects consumer subscriptions.

The seven rules of the Digital Payments – E-mandate Framework, 2026

• The first transaction on a mandate always requires strong authentication. No exceptions, whatever the rail.
• After that, strong authentication is not required up to ₹15,000 per transaction. Above that amount, it becomes mandatory again at the time of debit, so the customer must be present.
• The threshold rises to ₹1 lakh for three categories only: insurance premiums, mutual fund subscriptions, and credit card bill payments.
• Mandatory pre-debit notification at least 24 hours before each debit, stating the payee’s name, the amount, the date and time of the debit, the mandate reference, and the purpose.
• The right to decline individual transactions, and mandate revocation validated with AFA.
• No charges to the customer for using the e-mandate service, and a post-debit notification listing the ways to file a complaint.
• A dispute and complaint handling process must be set up by the collecting entity. You cannot delegate it to your aggregator.

Chapter 6. Data, disputes, and go-live: what will get you rejected.

Indian projects rarely fail on technology. They fail on three compliance points that no outsourcing contract can fix. The first question is where the payment data is stored. The second is who answers the customer when a debit goes through and the goods never arrive. The third is how quickly the money comes back. This chapter is the review to pass before you open up traffic.

When the customer disputes: what you don't have

• UPI has no chargebacks in the card sense. A UPI payment is an account-to-account transfer: once executed, there is no chargeback right comparable to a card network's. Don't build your commercial policy on the opposite assumption, in either direction.
• UPI disputes are decided by the system, not by you. Since February 15, 2025, the payee's bank automatically accepts or rejects a dispute based on the TCC or RET codes generated, starting in the next settlement cycle. Your job is to get proof of fulfillment to your aggregator, fast.
• The customer has an enforceable refund deadline. The RBI circular of September 20, 2019 harmonizes turnaround times for failed transactions and requires ₹100 per day of delay to be paid to the customer. A slow refund is not just an unhappy customer: it is a cost.
• The last resort is the ombudsman. The Reserve Bank – Integrated Ombudsman Scheme is the final step. Your written replies to customers are evidence in the case file, so write them accordingly.
• Your complaints process is your responsibility. The 2026 e-mandate framework explicitly requires the collecting entity to have one. It is not a service your aggregator provides.

• Check the exact category of the provider's authorization (PA-O, PA-P, PA-CB), its date, and the entity that holds it, then compare it with the list the RBI publishes.
• Check the real location of the servers that process and store payment data.
• Check the provider's PSP bank redundancy: a single bank is a continuity risk, not a simplification.
• Check T+1 settlement against real statements, not the sales brochure.
• Check the authentication flow: two factors, one of them dynamic, and a dynamic factor other than SMS OTP.
• Check that the 24-hour pre-debit notification is actually implemented on your chosen mandate rail, with a right to decline.
• Check card token portability and mandate export, as an entry clause, never an exit clause.