RBI Payment Aggregators & Gateway Audit

Overview

The Reserve Bank of India has circulated new guidelines on 17th March 2020 related to the Regulation of Payment Aggregators and Payment Gateways. These guidelines mandate the Payment Aggregators and Payment Gateways to get authorization from RBI, by obtaining the settlement of payment to the merchant at fixed transaction time. The guidelines are the detailed technical and operational for Payment Aggregators and Payment Gateways that includes merchant onboarding, customer data access, audit obligations, and data sovereignty. Through these guidelines, RBI decided to regulate the activities of payment aggregators and assist them by providing baseline technology related to payment gateways.

What is RBI Payment Aggregators & Payment Gateway Audit?

In March 2020, all the existing non-banks Payment Aggregators are required to take the authorization from RBI before 30th June 2021. From now, the Payment Aggregators and Payment Gateways will be regulated by RBI to ensure the safety of all the online transactions.

The Key aspects that RBI is going to include in their guidelines are described below.

Non-Banks Payment Aggregators will have the minimum net worth of Rs 15 Crore which also varies up to INR 25 crore by the end of the financial year.
The Payment Aggregators required baseline technology, which includes the implementation of Data Security standards, Cybersecurity audits, incident reporting, and framing IT policies.
Payment Aggregators have clear policies while on-boarding the merchant, privacy policy, Customer Grievances, etc. and followed the provisions set by Prevention of Money Laundering ACT 2002.
E-commerce organization with a Payment Aggregators business, need to take the authorized license and have to segregate Payment Aggregators into the separate entity.
A non-bank Payment Aggregators have to be a complete company incorporated under the Act of the organization with the PA activity forming a party.
In case of any takeover or acquisition of control or any change in upper management of non-bank Payment, Aggregators have to communicate with the Chief General Manager of RBI within 15 days of the change.
The RBI also gives the format of authorization which includes net-worth certificate director's undertaking, auditor certificate while maintaining the balance on an escrow account, and a format for storing the data of transaction handled by Payment Aggregators every month.

What We Deliver ?

It’s an important practice that gives organizations visibility into real-world threats to your security. As part of a routine security check, penetration tests allow you to find the gaps in your security before a hacker does by exploiting vulnerabilities and providing steps for remediation.