Why is merchant acquiring bank AI governance different from payment aggregator AI governance in India?

Merchant acquiring banks — scheduled commercial banks (SBI, HDFC Bank, ICICI Bank, Axis Bank) that hold NPCI acquiring licenses and process card payments on behalf of merchants — are entirely different entities from payment aggregators (Razorpay, PayU, CC Avenue) that are non-bank entities licensed under RBI's PA Directions. The regulatory difference creates distinct AI governance obligations: (1) MRMF applicability: acquiring banks are scheduled commercial banks and are explicitly covered under RBI MRMF 2026. Non-bank payment aggregators are not regulated under MRMF — they have separate PA Direction obligations that do not include MRMF-equivalent model validation requirements. The acquiring bank's merchant onboarding AI, chargeback prediction AI, and fraud detection models are subject to MRMF model inventory, independent validation, and board reporting requirements that non-bank PA entities do not face; (2) Regulatory stack: acquiring banks operate under RBI Master Direction on Credit Cards (2022 update), NPCI acquiring operating procedures, PMLA, and RBI MRMF — a four-framework stack. Non-bank PAs operate under RBI PA Directions 2025 and DPDP Act — a two-framework stack; (3) NPCI dispute framework: acquiring banks are direct NPCI members and are bound by NPCI's acquiring dispute procedures (chargebacks, representments). Non-bank PAs route through their sponsor bank — the acquiring bank — and are one step removed from direct NPCI compliance obligations. These structural differences make acquiring bank AI governance a distinct domain that the existing PA governance content does not address.

What MRMF obligations apply to merchant onboarding fraud AI in acquiring banks?

Merchant onboarding fraud AI — models that score merchant applications for risk of fraudulent merchant creation (synthetic merchants, money laundering shell merchants, prohibited category merchants) — is used in a material financial decision: approving or rejecting a merchant's acquiring relationship. Under MRMF 2026 Clause 4.2, this is a material decision model requiring pre-deployment validation documentation, model card, and ongoing PSI monitoring. Three India-specific governance complications arise: (1) MRMF + PMLA intersection: merchant due diligence under the Card Master Direction 2022 is partly equivalent to KYC for PMLA purposes — high-risk merchants may require Enhanced Due Diligence. AI models that automate merchant risk categorisation are simultaneously making an MRMF-governed decision (model risk) and a PMLA-governed decision (customer risk categorisation for AML purposes). The two frameworks have different validation and documentation requirements, and neither references the other; (2) False negative consequences: a merchant onboarding AI that fails to flag a fraudulent merchant (false negative) exposes the acquiring bank to liability for the merchant's fraudulent transactions and potential PMLA non-compliance for onboarding a money laundering operation. The false negative is not only a model performance metric — it is a regulatory event; (3) Merchant categorisation bias: merchant onboarding AI trained on historical fraud data may systematically associate certain merchant categories, geographic areas, or merchant business sizes with higher fraud risk — creating adverse selection against legitimate small merchants in those segments. MRMF bias documentation and fairness testing requirements apply.

What was the AI model governance implication of the RBI CoFT tokenisation mandate in 2022?

RBI's Card-on-File Tokenisation mandate (effective October 1, 2022, RBI/2021-22/117) required all card-on-file data stored by merchants and payment processors to be replaced with tokens issued by authorized Token Service Providers. After the mandate took effect, acquiring banks' fraud detection AI models faced a fundamental data structure change: the 16-digit PAN (Primary Account Number) that fraud models had used as a key identifier was replaced by a token that is merchant-specific and may not persist across merchant relationships or card renewals. The model governance implication: acquiring banks' fraud detection AI models trained on PAN-based transaction histories became partially unusable for tokenised transaction data. Historical fraud patterns linked to specific PANs could not be directly applied to tokenised transactions. Three governance questions that no RBI circular addressed: (1) Transition validation obligation: were acquiring banks required to validate that their fraud models performed adequately on tokenised data before the October 2022 deadline? No RBI circular specified this obligation; (2) Performance degradation monitoring: if fraud detection accuracy declined during the tokenisation transition period (because models had not yet been retrained on tokenised data), was this a model risk event requiring board reporting under MRMF? MRMF was not yet in effect in 2022, but the question of model performance across a major data structure transition remains relevant under the current MRMF framework; (3) Ongoing tokenisation AI governance: as the tokenised transaction history grows, acquiring banks' fraud AI models must be periodically retrained on tokenised data. Model change management under MRMF Clause 6 applies to each such retrain — requiring documentation that the retrained model performs at least as well as the prior version across all relevant merchant categories and fraud types.

Who is the MRMF model owner when a large acquiring bank processes transactions for smaller banks under a white-label arrangement?

Several large Indian acquiring banks (notably SBI Card, HDFC Bank) process card transactions for smaller banks through white-label acquiring arrangements — the smaller bank offers its own branded card acquiring service, but the transaction processing, fraud detection, and chargeback management are handled by the larger bank's acquiring infrastructure, including its AI models. Under RBI MRMF 2026, the model owner is the regulated entity that uses the model in its business — the entity that bears the regulatory and financial consequences of model decisions. In a white-label arrangement, both banks bear consequences: the processing bank operates the AI, the branded bank faces the regulatory accountability for the acquiring service offered under its brand. MRMF does not explicitly address white-label arrangements — but the analogy to MRMF Section 7 (third-party model risk) provides a framework: the branded bank should treat the processing bank's acquiring AI as a third-party model under MRMF, requiring: (a) contractual documentation access — the branded bank must have the right to receive model cards and validation reports for the processing bank's acquiring AI models; (b) periodic independent validation — the branded bank should commission or review validation of the AI models covering its white-label acquiring portfolio; (c) change notification — the processing bank must notify the branded bank before material model changes that could affect the branded bank's regulatory position; (d) incident reporting — AI-related fraud failures in the white-label acquiring portfolio must be reported to the branded bank with sufficient model-level information for regulatory escalation.

AI Governance · RBI · Merchant Acquiring · MRMF · Card Payments · India BFSI

RBI Merchant Acquiring Bank AI Governance: MRMF Obligations for Merchant Onboarding AI, Chargeback Prediction, CoFT Tokenisation Transition and White-Label Acquiring Arrangements India 2026

Scheduled commercial banks operating as NPCI acquiring members (SBI Card, HDFC Bank, ICICI Bank) are explicitly MRMF-covered — their merchant onboarding fraud AI, chargeback prediction AI, and tokenised transaction fraud models face model inventory, validation, and board reporting obligations under RBI MRMF 2026. The CoFT tokenisation mandate created a data structure change that acquiring AI models have not been required to document. Chargeback prediction AI operates in NPCI's quasi-adjudicative dispute framework. White-label acquiring creates MRMF model ownership ambiguity. Entirely distinct from non-bank PA governance. Zero global competitor coverage.

Zytra Research Team · October 2026 · 12 min read

📖 Part of the India BFSI AI Governance Complete Guide 2026 — RBI, SEBI, IRDAI, NPCI & DPDP in one place.

India's card acquiring infrastructure — the bank-side of the payment card ecosystem that enables merchants to accept credit and debit card payments — is operated by scheduled commercial banks holding NPCI acquiring licenses. These are different entities from payment aggregators (non-bank PA Direction licensees like Razorpay or PayU). Acquiring banks have a four-framework regulatory stack: RBI Master Direction on Credit Cards (DBOD.FSD.BC.49/24.01.009/2015-16, updated April 2022), NPCI acquiring operating procedures, PMLA/FIU-IND AML obligations, and RBI MRMF 2026.

AI governs three critical functions in the acquiring bank: merchant onboarding risk scoring (deciding which merchants to onboard and at what risk tier), transaction-level fraud detection (real-time scoring of each card-present and card-not-present transaction), and chargeback management (predicting which chargebacks to contest, automating representment evidence assembly). Each function has MRMF obligations that the acquiring bank's Card division may not have connected to its primary regulatory instrument — the Card Master Direction — which contains zero AI governance provisions.

Merchant Onboarding AI: Three-Framework Compliance Intersection

Merchant onboarding AI operates at the intersection of RBI MRMF (model risk governance), Card Master Direction (merchant due diligence obligation), and PMLA (AML customer risk categorization). No single framework addresses this intersection, creating compliance siloing where the Card team manages the due diligence obligation, the Risk team manages MRMF, and the Compliance team manages PMLA — without a shared governance framework for the AI that serves all three.

The model: merchant applications are scored on risk dimensions — business legitimacy indicators, industry category risk (certain merchant categories have higher fraud and money laundering rates), transaction pattern plausibility (does the expected transaction volume match the business size?), geographic risk, and beneficial ownership screening against PEP/sanctions lists. High scores trigger Enhanced Due Diligence; very high scores result in rejection.

MRMF validation requirements for this AI:

Model card: architecture, training data, feature set (including which merchant data points and external data sources are used), validation methodology, performance metrics
False negative analysis: false negative rate by merchant category and geography — the regulatory consequence of a false negative (onboarding a fraudulent or money-laundering merchant) is a regulatory event, not only a performance metric
Bias testing: systematic rejection patterns by merchant geography, business size, or owner demographic — adverse selection against legitimate small merchants is both a fairness and an RBI financial inclusion concern
PMLA alignment: merchant risk categories produced by AI must align with PMLA's risk categorization requirements — the AI's output is an input to the Compliance team's AML risk decisions and must be PMLA-audit-ready

CoFT Tokenisation: The Undocumented AI Retraining Event

RBI's CoFT mandate eliminated card-on-file PAN storage and replaced it with merchant-specific tokens. Acquiring banks' transaction fraud models — trained on years of PAN-keyed transaction history — faced a fundamental input structure change. The behavioral signatures that models had learned (this PAN's transaction velocity, geographic patterns, spending category distribution) no longer persisted in the same form across the tokenised environment.

MRMF Clause 6 (model change management) classifies a material change in model inputs or operating environment as a model event requiring documentation and potentially revalidation. The CoFT mandate was a forced, regulatory-imposed material change to the input environment of every acquiring bank's fraud detection AI.

Banks that retrained their fraud models on tokenised data should have MRMF change management documentation for that retrain — recording the retrain decision, the validation results on tokenised transaction data versus the pre-tokenisation baseline, and the board-level model risk assessment of the transition period (when the model was operating on partially tokenised data before retraining completed). Banks that did not fully document this transition have a gap in their MRMF change management record for their most systemically important AI models.

Chargeback Prediction AI: NPCI Dispute Framework + MRMF

NPCI's acquiring dispute framework defines time limits, evidence requirements, and liability rules for chargebacks. Acquiring banks use AI to predict chargeback outcomes — models that assess whether a specific chargeback is likely to succeed in representment (based on the merchant's transaction evidence, the card network's chargeback reason code, and historical representment outcomes for similar disputes). These models make financial decisions: whether to accept the chargeback (and credit the issuing bank) or contest it (spending representment effort on expected recoveries).

MRMF applies to this AI as a material financial decision model. Additional governance consideration: chargeback representment AI generates evidence packages submitted to NPCI's dispute process. If the AI systematically selects weaker evidence or systematically over-contests chargebacks (generating disputes the bank ultimately loses, creating merchant frustration and NPCI dispute cost), both performance and conduct issues arise that MRMF bias documentation should capture.

White-Label Acquiring: MRMF Model Ownership

Large acquiring banks process transactions for smaller banks' branded card acquiring services. The processing bank's AI models — fraud detection, merchant scoring, chargeback management — govern the smaller bank's acquiring portfolio. MRMF Section 7 (third-party model risk) provides the governance framework for the branded bank: treat the processing bank's acquiring AI as third-party models, requiring contractual documentation access, periodic independent validation review, change notification, and incident reporting.

This is the acquiring equivalent of the co-lending AI governance model ownership problem — the regulatory accountability sits with the branded bank, the model sits with the processing bank, and neither the Card Master Direction nor MRMF explicitly addresses white-label acquiring AI governance. Acquiring banks in white-label arrangements on either side of the relationship should document their MRMF obligations and establish contractual provisions accordingly.

Merchant Acquiring AI Governance Checklist

☐ Merchant onboarding AI: MRMF model card; PMLA risk categorization alignment documented; false negative rate analysis by merchant category; geographic and demographic bias testing
☐ Transaction fraud AI: MRMF model inventory; independent validation; PSI monitoring; tokenised transaction data validation completed and documented
☐ CoFT transition documentation: MRMF change management record for fraud model retrain post-tokenisation; performance comparison pre/post tokenisation in validation report
☐ Chargeback prediction AI: MRMF model card; representment outcome tracking; bias analysis for systematic over/under-contesting by merchant category
☐ NPCI dispute evidentiary compliance: AI-generated representment evidence packages reviewed for accuracy before submission; audit trail for AI-selected evidence
☐ White-label acquiring: contractual documentation access for processing bank AI models; periodic independent review of AI governance covering branded acquiring portfolio; change notification provision
☐ MRMF-Card MD integration: acquiring bank Card division governance framework updated to reference MRMF obligations for AI models — closing compliance silo between Card MD and MRMF
☐ RBI examination readiness: merchant onboarding AI MRMF documentation, fraud AI validation reports, tokenisation transition change log — packaged for Card/Payment System examination