India's non-bank payment aggregators process billions of transactions per year. They stand between merchants and payment networks — onboarding merchants, monitoring transactions, detecting fraud, reporting suspicious activity to FIU-IND under PMLA, and contributing data to RBI's centralized fraud intelligence platform. Most of this work is done by AI models.
The governance framework for those AI models has a gap that no one has mapped. RBI's PA Directions (September 2025) say only that PAs must put in place "adequate Information and Data Security infrastructure and systems for detection and prevention of frauds." MRMF 2026 — the most comprehensive model risk governance framework India has issued — does not explicitly cover non-bank PAs. The result: PA fraud detection AI, merchant risk scoring AI, and AML AI operate under a governance standard defined by a single broad sentence in the PA Directions.
What the regulations say vs. what AI governance requires
What PA Directions September 2025 say about AI: "PA shall put in place adequate Information and Data Security infrastructure and systems for detection and prevention of frauds." (Section 16). That is the entirety of AI-specific guidance for non-bank PAs in the Master Direction. Zero model inventory requirements, zero validation mandates, zero explainability standards, zero bias testing, zero drift monitoring, zero vendor AI governance, zero kill switch provisions.
What AI governance best practice requires for the same fraud detection AI: Model inventory with business purpose documentation, pre-deployment validation, statistical performance testing, bias/fairness testing (does the model disproportionately flag transactions by certain merchant categories, geographies, or customer demographics?), ongoing drift monitoring (fraud patterns evolve faster than most other BFSI AI use cases), adversarial testing (fraud actors specifically attempt to evade detection), explainability for disputed transaction decisions, kill switch for models producing unexpected outputs, vendor contract provisions for third-party model accountability.
The gap between these two is not theoretical. When a PA's fraud detection AI incorrectly blocks a legitimate payment, the merchant suffers revenue loss, the customer experiences transaction failure, and the PA is exposed to consumer complaint liability — all traceable to an AI model operating without documented governance standards.
Three PA Categories Under September 2025 Directions
PA-Online (PA-O)
Facilitates digital payments for online merchants. This is the classic payment gateway model: Razorpay, PayU, CCAvenue, Cashfree, Easebuzz for e-commerce and D2C transactions. Fraud detection AI primarily addresses card-not-present fraud, account takeover, and payment velocity manipulation. Highest AI deployment sophistication in the PA segment.
PA-Physical (PA-P)
Facilitates card-present and proximity payments at physical merchant locations. POS-based transactions, QR code payments at retail. Fraud detection AI addresses card skimming, terminal tampering, merchant category misuse. DPIP integration for real-time fraud scoring at physical terminals is a key AI governance consideration.
PA-Cross Border (PA-CB)
Facilitates cross-border online payments. FEMA compliance layer adds to AML AI complexity. Correspondent banking AI risk scoring, beneficiary screening AI (OFAC/UN sanctions lists), and FX fraud detection AI. Highest regulatory complexity given multi-jurisdictional AML obligations alongside PMLA/FIU-IND requirements.
Five AI Use Cases PAs Deploy — Without Explicit Governance Framework
Transaction Fraud Detection
Velocity-based, behavioral scoring, device fingerprinting, network graph AI. The core AI use case for every PA. PA Directions mandate "adequate systems for detection and prevention of frauds" — this is the AI they mandate without specifying. Governance gap: no validation standard, no false positive rate monitoring requirement, no bias testing for discriminatory false positive rates across merchant geographies or transaction types.
Merchant Risk Scoring and Onboarding
AI-driven due diligence for merchant applications: business legitimacy scoring, category risk assessment, velocity limit assignment. PA Directions require Merchant Due Diligence including transaction monitoring against declared business profiles. AI used here affects which merchants can access digital payments. Governance gap: discriminatory merchant onboarding AI (disproportionately rejecting merchants from specific geographies or business categories) has no explicit fairness testing requirement under PA Directions.
AML Transaction Monitoring (FIU-IND PMLA)
Automated Suspicious Transaction Report (STR) and Cash Transaction Report (CTR) generation for FIU-IND under PMLA obligations. All non-bank PAs must register with FIU-IND. AI models that generate STRs have significant customer impact: false positive STRs can trigger account investigation and transaction blocking disproportionately affecting certain customer segments. Governance gap: no model validation standard exists for PA AML AI under either the PA Directions or FIU-IND's reporting guidelines.
DPIP Integration and DoT FRI
Digital Payments Intelligence Platform (DPIP): RBI-centralized AI fraud risk scoring platform. PAs contribute transaction data (data quality obligation) and consume fraud scores (AI output governance obligation). DoT's Financial Risk Indicator (FRI): mobile number risk classification that PAs can query for customer fraud risk in real-time. Governance gap: how PA automated decisions based on DPIP/FRI scores should be governed — including discrimination testing for disproportionate transaction blocking based on DPIP-scored customer segments — has no specific framework.
Customer Service and Dispute AI
Chatbots for merchant and cardholder queries, AI-assisted dispute resolution (chargeback handling, transaction dispute investigation). DPDP Act 2023 consent and non-discrimination requirements apply to customer data processing in these AI systems. India language fairness (INDIC-BIAS findings) applies to customer service AI serving Indian consumers across 22 languages — PA customer service AI serving merchants and customers in regional languages must not provide degraded service quality to non-English users.
MRMF Applicability Question: The Eleven Covered Entities and the PA Gap
RBI Draft Guidance on Model Risk Management (June 24, 2026) explicitly covers eleven entity categories: commercial banks (scheduled and non-scheduled), cooperative banks, small finance banks, payment banks, NBFCs (all categories), Asset Reconstruction Companies, Credit Information Companies, and all-India financial institutions. Non-bank PAs are not listed.
The regulatory ambiguity is structural: non-bank PAs are licensed by RBI under the PSS Act and supervised by RBI's Department of Payment and Settlement Systems. They are RBI-regulated entities by definition. But MRMF uses a specific entity-category list rather than a catch-all formulation. Until RBI either explicitly extends MRMF to PAs or issues PA-specific model governance guidelines, the applicability question remains open.
| Governance Requirement | PA Directions Sept 2025 | MRMF June 2026 | PA Exposure |
|---|---|---|---|
| Fraud system obligation | Yes — "adequate systems" | Implicit (model validation) | Broad, unspecified standard |
| Model inventory requirement | No | Yes (for listed entities) | No binding requirement for PAs |
| Pre-deployment validation | No | Yes (for listed entities) | No binding requirement for PAs |
| Bias/fairness testing | No | Yes (for listed entities) | DPDP Act applies; no AI-specific test requirement |
| Third-party AI accountability | PCI-DSS for merchant infra | Yes (for listed entities) | Partial — cybersecurity standard only |
| DPIP data quality governance | Data integrity obligation | Not addressed | No specific standard |
| AML model governance (FIU-IND) | PMLA compliance required | Not PA-specific | FIU-IND guidelines set STR/CTR; no model governance |
| Kill switch for fraud AI | No | Yes (for listed entities) | No binding requirement for PAs |
| Explainability for disputed decisions | No | Yes (for listed entities) | DPDP Act implies but no AI-specific standard |
| Annual cybersecurity audit | Yes — CERT-In audit | N/A | Binding — CERT-In audit scope for AI systems |
MRMF-Equivalent AI Governance for Payment Aggregators: The Prudential Case
Whether or not RBI formally extends MRMF to PAs, the prudential case for building MRMF-equivalent AI governance is strong. Four reasons:
- PA Directions' "adequate systems" standard is outcome-based. If a PA's fraud detection AI produces a pattern of incorrect customer decisions and RBI investigates, the determination of whether the system was "adequate" will be made with the benefit of hindsight against industry best practice. A PA with documented model validation, ongoing monitoring, and bias testing will be in a materially better position than one with none of this documentation — regardless of whether MRMF formally applied.
- MRMF extension to PAs is more likely than not. The June 2026 MRMF draft covered eleven entity categories. The comment period closed July 24, 2026. Final MRMF guidelines will likely be issued Q4 2026 or Q1 2027. Industry feedback on the draft included arguments that payment system operators should be covered given the AI they deploy. PAs that have built MRMF-equivalent programs when the extension comes will require adaptation, not a compliance build from scratch.
- CERT-In annual audit scope includes AI systems. PA Directions require annual CERT-In audits. CERT-In Blueprint (May 2026) includes AI-specific requirements (AIBOM, adversarial testing, AI system documentation). A CERT-In audit of a PA's systems will cover the PA's AI models — and CERT-In's Blueprint-aligned requirements create de facto AI governance obligations through the audit channel even without a specific PA AI governance circular.
- DPIP data quality liability is binding now. PAs contributing to DPIP bear data quality responsibility. Low-quality or biased training data contributed by a PA degrades DPIP's models across the ecosystem. This is an operational liability that exists under current law, independent of MRMF or PA Directions specifics. DPIP data governance documentation — what data PAs contribute, data quality monitoring, anomaly detection for contributed data — is a governance program PAs should build now.