Digital Payments & UPI Integration for Foreign Companies: RBI Licensing Guide

India's Digital Payments Ecosystem: Scale That Foreign Companies Cannot Ignore

Any entity facilitating payments between customers and merchants in India -- including a foreign company without an Indian entity -- must obtain a Payment Aggregator licence from the RBI under the consolidated Master Direction the RBI published on September 15, 2025, which created three licence categories: PA-Online, PA-Physical, and PA-Cross Border. Applicants need a minimum net worth of INR 15 crore (~USD 1.8 million) at application, rising to INR 25 crore (~USD 3 million) by the end of the third financial year from grant of authorisation.

India's Unified Payments Interface (UPI) is the world's largest real-time payment system by transaction volume. In 2025, UPI processed 228.3 billion transactions worth INR 299.7 lakh crore — a 32.5% increase in volume over 2024's 172.2 billion. December 2025 alone saw 21.63 billion transactions, an average of nearly 700 million per day, and NPCI has set a target of 1 billion daily transactions. For foreign companies entering India — whether through a wholly-owned subsidiary, branch office, or as a cross-border merchant — integrating with India's digital payment infrastructure is operationally essential.

RBI Regulatory Framework: The September 2025 Master Directions

On September 15, 2025, the RBI published a consolidated Master Direction that unified all payment aggregator regulations into a single framework. This replaced the earlier patchwork of circulars and created three distinct PA categories:

PA-Online (PA-O)

For entities that aggregate payments through online channels — websites, mobile apps, and digital platforms. This is the most relevant category for foreign companies operating e-commerce, SaaS, or digital service businesses in India.

PA-Physical (PA-P)

For entities facilitating in-person payments through POS terminals, QR codes, and other physical acceptance infrastructure. Relevant for foreign companies with brick-and-mortar retail presence.

PA-Cross Border (PA-CB)

For entities facilitating cross-border payment flows — enabling Indian consumers to pay overseas merchants, or enabling overseas consumers to pay Indian merchants. This category is most directly relevant for foreign companies without an Indian entity seeking to accept payments from Indian customers.

Payment Aggregator Licence Requirements

Any entity facilitating payments between customers and merchants in India must obtain authorisation from the RBI. The requirements vary by category but share common foundational elements.

Capital and Net Worth Requirements

Entity Structure Requirements

The applicant must be a company incorporated in India under the Companies Act, 2013. Foreign companies cannot directly apply for a PA licence — they must establish an Indian subsidiary. This means a foreign fintech seeking to operate as a payment aggregator in India must first incorporate an entity (typically a private limited company), bring in the required FDI under the automatic route (100% FDI is permitted in payment aggregation under the automatic route), and then apply for RBI authorisation.

Governance and Compliance Requirements

• Data security: PCI-DSS certification, current payment-application security standards, latest encryption standards, and transport channel security are mandatory
• KYC framework: Full KYC for merchants onboarded, in compliance with RBI's Master Direction on KYC
• Escrow accounts: All merchant settlement funds must be maintained in escrow accounts with Scheduled Commercial Banks
• Grievance redressal: A dedicated customer grievance mechanism with defined escalation and resolution timelines
• Anti-money laundering: Registration with Financial Intelligence Unit-India (FIU-IND) and compliance with Prevention of Money Laundering Act (PMLA) requirements
• Board composition: At least one director with experience in payments, banking, or financial services

Application Timeline and Process

1. Preparation: Incorporate Indian entity, build net worth, implement compliance infrastructure (3-6 months)
2. Application submission: Apply through the RBI's designated portal with comprehensive documentation
3. In-principle approval: RBI reviews the application and grants in-principle authorisation (3-6 months)
4. System audit: Complete a mandatory IT systems audit by a CERT-In empanelled auditor
5. Final authorisation: RBI grants final authorisation after satisfactory system audit (3-6 months after in-principle approval)

The total timeline from application to final authorisation is typically 6-12 months, assuming the entity has already met all prerequisite conditions.

UPI Integration Options for Foreign Companies

Foreign companies have several pathways to accept UPI payments, depending on their business model and India presence.

Option 1: Through a Licensed Payment Aggregator (Fastest)

The simplest approach is to partner with an existing RBI-licensed payment aggregator such as Razorpay, PayU, Cashfree, or CCAvenue. The foreign company (operating through its Indian subsidiary) onboards as a merchant with the PA, which handles UPI integration, settlement, and compliance. This approach requires no separate RBI licence and can be operational within 2-4 weeks.

Option 2: Becoming a Third-Party Application Provider (TPAP)

Under NPCI's UPI framework, a company can become a TPAP — developing its own UPI-enabled application while connecting through a Payment Service Provider (PSP) bank. The UPI ecosystem operates on a four-pillar model:

• NPCI: The operator and standard-setter for UPI
• PSP Bank: The bank that provides UPI infrastructure access to the TPAP
• TPAP: The application provider (e.g., Google Pay, PhonePe) that builds the customer-facing interface
• Remitter/Beneficiary Bank: The banks that hold the actual customer and merchant accounts

Becoming a TPAP requires a sponsoring PSP bank relationship and NPCI approval. This is a more involved process suited for companies whose core business involves payment facilitation.

Option 3: Cross-Border UPI Acceptance (No Indian Entity Required)

For foreign merchants selling to Indian consumers without an Indian entity, cross-border UPI acceptance is possible through NPCI International Payments Limited (NIPL) partnerships. PPRO signed a definitive agreement with NIPL in April 2023, enabling international PSPs and global merchant acquirers to accept UPI payments from Indian consumers without requiring a legal entity in India, settlement to an Indian bank, or invoice uploads. This removes the need for establishing formal business presence in India for pure cross-border commerce.

Cross-Border Payment Aggregator (PA-CB) Licence

For companies that want to facilitate — not just accept — cross-border payments involving India, the PA-CB licence is the relevant authorisation.

Scope and Market Status

As of early 2026, the RBI had fully authorised 19 entities to hold PA-CB licences, following a wave of approvals in late 2025. Notable foreign-linked approvals include Payoneer India (in-principle approval, January 2026) and Unlimit (final authorisation for cross-border transactions, December 2025).

PA-CB Specific Requirements

• Separate escrow accounts: An Inward Collection Account (InCA) for receipts from overseas customers and an Outward Collection Account (OCA) for payments to overseas merchants
• Purpose code reporting: All cross-border transactions must carry appropriate RBI purpose codes under FEMA regulations
• Transaction limits: Adherence to RBI-prescribed per-transaction and annual limits for various categories of cross-border payments
• FIU-IND registration: Mandatory registration with the Financial Intelligence Unit for AML/CFT reporting

Authentication and Security Requirements

The RBI has implemented increasingly stringent authentication requirements that foreign companies must factor into their payment integration:

Two-Factor Authentication (2FA) Mandate

Effective April 1, 2026, every domestic digital payment transaction — including UPI, card payments, wallet transactions, and recurring mandates — must include two distinct factors of authentication. For cross-border card-not-present transactions, additional validation must be implemented by October 1, 2026.

Implications for Foreign Companies

This means that any payment flow designed for the Indian market must incorporate 2FA. Simple card-on-file tokenisation or single-click payment flows that may work in other markets will not be compliant in India. Foreign companies must work with their payment aggregators to ensure that checkout flows meet the 2FA requirement without creating excessive friction.

UPI for Foreign Visitors and NRI Customers

NPCI's UPI One World prepaid wallet — first rolled out in 2023 and extended to all inbound international travellers in July 2024, with a further expansion for delegates at the India AI Impact Summit in February 2026 — enables foreign visitors to make UPI payments in India without an Indian bank account. This prepaid wallet-based service allows foreign nationals to load INR into a UPI-linked wallet using their international debit/credit cards.

For businesses targeting foreign visitors — hotels, tourism, retail, events — UPI One World integration provides a way to accept digital payments from international customers who may not carry Indian rupee cash.

For NRIs with Indian bank accounts (either NRE or NRO accounts), UPI is already fully available. NRI customers can link their Indian accounts to UPI apps and transact seamlessly.

UPI Global Expansion: Countries and Linkages

As of early 2026, UPI payments are accepted for cross-border merchant payments in seven countries: Bhutan, Mauritius, Nepal, Singapore, Sri Lanka, France, and UAE. Additional linkages are in progress:

For foreign companies with operations across multiple Asian markets, UPI's expanding international acceptance creates opportunities for unified payment infrastructure. The BIS Project Nexus initiative, which will interlink domestic fast payment systems across member countries, could make UPI the backbone of a pan-Asian real-time payment network.

Merchant Discount Rate (MDR) and Payment Economics

Understanding the economics of digital payments in India is critical for foreign companies building their India P&L. The MDR structure differs significantly from Western markets:

UPI MDR Structure

The zero-MDR policy on UPI makes it the most cost-effective payment method for merchants in India — a stark contrast to card networks where MDR typically runs between 1% and 3%. This economics drives UPI's dominance in merchant payments and means foreign companies should prioritise UPI integration over card acceptance for domestic transactions.

Card Payment MDR

For debit cards, the RBI caps MDR at 0.4% for small merchants (turnover up to INR 20 lakh) and 0.9% for other merchants. Credit card MDR is not regulated and typically runs between 1% and 3%, with international card transactions attracting higher MDR plus a forex markup. The interchange fee structure follows the RBI's guidelines, with periodic revisions.

Digital Wallet and Prepaid Instrument Payments

Companies like Paytm, PhonePe, and Amazon Pay also operate prepaid payment instruments (PPIs) governed by RBI's PPI Master Direction. Foreign companies integrating payments should ensure their payment aggregator supports all major digital payment methods — UPI, cards, net banking, and wallets — to maximise checkout conversion.

Data Localisation and Storage Requirements

The RBI has mandated strict data localisation requirements that directly affect foreign companies processing payments in India:

RBI Data Localisation Circular (April 2018)

All payment system operators must store the complete end-to-end payment data exclusively in India. This includes transaction data, customer data, payment credentials, and associated metadata. Per the RBI's June 2019 FAQ, payment data may be processed abroad, but it must then be deleted from overseas systems and stored only in India within one business day — no copy may be retained on foreign infrastructure (other than the foreign leg of a cross-border transaction).

Implications for Foreign Companies

• Infrastructure setup: Companies operating their own payment infrastructure must use India-based data centres (AWS Mumbai, Azure India, GCP Mumbai)
• Vendor compliance: Ensure that your payment aggregator complies with data localisation — all major Indian PAs are compliant
• Cross-border carve-out: For cross-border transactions, the foreign leg of the transaction can be processed overseas, but the Indian leg must be stored in India
• Penalties: Non-compliance can result in RBI directing banks to stop processing transactions for the non-compliant entity

GST and Tax Implications of Digital Payment Integration

Foreign companies accepting digital payments in India must consider the tax implications:

GST on Payment Aggregator Services

Payment aggregator fees are subject to GST at 18%. For foreign companies using Indian PAs, this is typically built into the merchant discount rate (MDR). UPI transactions for person-to-merchant (P2M) payments currently carry zero MDR for transactions up to INR 2,000, with the government subsidising the interchange through NPCI.

Withholding Tax on Cross-Border Payments

When Indian customers pay a foreign merchant through cross-border payment channels, withholding tax obligations under section 393(2) of the Income-tax Act, 2025 (Table, Sl. No. 17; section 195 of the Income-tax Act, 1961) may apply depending on the nature of the payment. Payments for digital services may have attracted equalisation levy (2% on e-commerce supply of goods and services) before the levy's abolition effective 1 August 2024; it no longer applies. Foreign companies should evaluate whether their India-sourced digital revenue creates a permanent establishment risk under applicable DTAA provisions.

Recurring Payments and Subscription Billing

Foreign SaaS companies, subscription services, and membership platforms operating in India need to comply with RBI's e-mandate framework for recurring payments:

RBI E-Mandate Framework

Recurring payments through cards, UPI, and net banking require explicit customer mandates. Under the current framework:

• Registration: The first transaction requires full 2FA authentication with explicit customer consent for recurring charges
• Notification: Customers must be notified at least 24 hours before each recurring debit, with the option to cancel
• Amount limits: Automatic recurring debits are permitted up to INR 15,000 per transaction without additional authentication. Amounts above INR 15,000 require fresh 2FA for each transaction
• UPI AutoPay: UPI supports mandate-based recurring payments through UPI AutoPay — without additional authentication up to INR 15,000 per transaction generally, and up to INR 1 lakh for specified categories such as mutual fund subscriptions, insurance premiums and credit card repayments

Implications for Foreign SaaS Companies

International SaaS platforms charging Indian customers in INR must ensure their billing systems comply with the e-mandate framework. This typically requires working with an Indian payment aggregator that handles mandate registration, pre-debit notifications, and fallback authentication for above-threshold amounts. Non-compliance results in payment failures, not penalties — the payment simply will not process.

Step-by-Step Integration Guide for Foreign Companies

For Companies With an Indian Entity

1. Select a payment aggregator: Choose an RBI-licensed PA (Razorpay, PayU, Cashfree, etc.) that supports UPI, cards, and net banking
2. Complete merchant KYC: Submit company incorporation documents, GST registration, PAN, bank account details, and director KYC
3. Integrate payment SDK/API: Implement the PA's SDK or API into your website/app — most PAs provide sandbox environments for testing
4. Configure settlement: Set up settlement to your Indian entity's bank account — typical settlement cycles are T+1 or T+2
5. Go live: Complete PA's review of live integration and commence accepting payments

For Cross-Border Merchants Without an Indian Entity

1. Partner with a PA-CB licensed entity: Engage a cross-border payment aggregator (Payoneer, Unlimit, PayPal, or similar) with RBI PA-CB authorisation
2. Provide documentation: Submit business registration from home country, website details, product/service description, and expected transaction volumes
3. Configure cross-border settlement: Set up settlement in your home currency — the PA-CB handles INR collection and forex conversion
4. Ensure compliance: Implement 2FA for card transactions, display pricing in INR where required, and comply with India's consumer protection regulations for cross-border e-commerce

For comprehensive assistance with establishing a payment-ready entity in India, our foreign subsidiary registration service handles incorporation, FEMA compliance, and bank account setup. For understanding entity structure options, see our comparison of branch office vs subsidiary structures.

Key Takeaways

• UPI processed 228 billion transactions in 2025, making it the world's largest real-time payment system — foreign companies operating in India must integrate digital payments
• RBI's September 2025 Master Directions consolidated PA regulations into three categories: PA-Online, PA-Physical, and PA-Cross Border, each requiring minimum INR 15 crore net worth at application
• Foreign companies need an Indian entity to obtain a PA licence, but can accept UPI payments immediately by partnering with an existing licensed PA as a merchant
• Cross-border merchants can accept UPI without an Indian entity through NIPL partnerships and PA-CB licensed aggregators
• Two-factor authentication becomes mandatory for all domestic digital payments from April 1, 2026, requiring payment flow redesign for compliance