What AI governance obligations arise from the RBI Payment Aggregator Master Direction 2025?

RBI's Master Direction on Regulation of Payment Aggregators (Reference RBI/DPSS/2025-26/141, Circular No. CO.DPSS.POLC.No.S-633/02-14-008/2025-26, dated September 15, 2025) consolidated all prior Payment Aggregator (PA) regulations and governs all RBI-authorised PAs — PhonePe, Razorpay, PayU, CCAvenue, Cashfree, Paytm Payments, BillDesk, and 40+ others. The direction explicitly mandates: 'adequate information and data security infrastructure and systems for detection and prevention of frauds' and 'constant monitoring of transactions carried out by merchants to identify suspicious activity or fraud.' In 2026, both mandates are operationalised entirely through AI/ML: real-time transaction risk scoring, merchant onboarding due diligence automation, pre-authorization fraud filters, and suspicious pattern detection. The direction mandates the outcome but prescribes no AI governance for the systems that achieve it. Five specific governance voids: (1) no model explainability requirement for AI-driven transaction blocking or merchant suspension decisions; (2) no model validation or testing standard before AI fraud systems go live; (3) no bias testing obligation for AI merchant risk scoring; (4) no killswitch or incident reporting requirement for AI system failure; (5) no audit trail requirement for AI-automated fraud decisions. The direction mandates annual CERT-In cybersecurity audits — but explicitly excludes AI model governance from audit scope.

What AI explainability is required when a Payment Aggregator's fraud AI blocks a merchant or transaction?

When a PA's AI fraud model flags a merchant for suspension or blocks a transaction, the adversely-actioned merchant or payer has due process rights under Indian law and NPCI dispute mechanisms. The PA Master Direction 2025 requires PAs to establish merchant onboarding agreements that specify dispute resolution procedures. AI-driven adverse actions against merchants create an explainability problem that the direction does not resolve: an AI fraud score that results in merchant account suspension must, at some point, be communicated to the merchant as a reason for action. If the AI produces only a score (above a threshold) without producing a human-readable rationale, the PA cannot satisfy any merchant dispute or RBI inspection inquiry about the basis for the adverse action. Three specific explainability requirements that PA fraud AI should satisfy even without explicit direction mandate: (1) Action-specific rationale: when an AI model flags a specific transaction for blocking or a merchant for suspension, the AI should produce a rationale log citing the specific indicators (unusual transaction velocity, merchant category mismatch, previous chargeback pattern, geographic anomaly) that drove the decision — not only a risk score; (2) Merchant notification: when a merchant's account is suspended or limited based on AI fraud scoring, the notification to the merchant must include an actionable reason, not 'flagged for suspicious activity'; the reason must be sufficient for the merchant to identify and address the cause; (3) RBI inspection trail: RBI's on-site and off-site monitoring of PAs may include review of fraud detection decisions; PAs must be able to demonstrate to RBI inspectors that AI fraud decisions were made on specific, articulable grounds, not arbitrary algorithmic outputs.

How does merchant onboarding AI at Payment Aggregators intersect with PMLA KYC obligations?

PA Master Direction 2025 requires PAs to conduct merchant onboarding due diligence, verify merchant identity, and comply with PMLA (Prevention of Money Laundering Act) obligations applicable to payment system operators. PAs using AI for merchant onboarding — automated document verification, business legitimacy scoring, beneficial ownership AI analysis, sanctions screening automation — create a specific AI-PMLA governance intersection: (1) AI beneficial ownership analysis: PAs must verify the ultimate beneficial owner (UBO) of merchant entities. AI tools that scan corporate registry data and infer UBO chains face a governance question — what is the AI's false negative rate on undisclosed UBOs? An AI that misses a sanctioned UBO because the corporate structure was obfuscated creates both a PMLA violation and a PA governance failure; (2) Adverse media AI: many PAs use AI to screen merchant applicants against adverse media and sanctions databases. AI adverse media models that produce false positives — flagging legitimate merchants due to name homonymy with sanctioned entities — and false negatives — missing relevant adverse media in vernacular Indian-language sources — both create compliance risk; (3) Periodic re-screening AI: PMLA requires ongoing monitoring of customers, not only at onboarding. PA merchant portfolios grow to tens of thousands; only AI makes periodic re-screening feasible. The AI re-screening model's recall rate on merchant risk changes over time creates an ongoing compliance exposure that periodic KYC audits cannot fully test; (4) RBI FREE-AI recommendations: RBI's August 2025 Report on Fintech Related Emerging and Evolving AI (FREE-AI) specifically recommends human oversight and killswitch capabilities for payment sector AI — a recommendation that, while not yet mandatory, signals RBI's direction for PA AI governance.

What AI governance applies to PA-Cross Border entities and international payment AI under the 2025 direction?

The PA Master Direction 2025 covers both domestic PAs and PA-Cross Border (PA-CB) entities that facilitate cross-border payment transactions. PA-CB entities — which process cross-border e-commerce payments, international remittances, and inbound/outbound business payments — use AI in additional dimensions beyond domestic PA fraud detection: (1) Cross-border fraud pattern AI: cross-border transactions have distinct fraud signatures (currency mismatch exploitation, multi-jurisdiction card testing, synthetic international merchant fronts) that require AI models trained on cross-border transaction data, not domestic fraud data. A PA-CB operating with a domestic fraud AI model applied to cross-border transactions has a training distribution gap that may result in systematically higher false positive rates for legitimate cross-border transactions; (2) Foreign exchange compliance AI: PA-CBs process foreign exchange transactions subject to FEMA (Foreign Exchange Management Act). AI-automated FEMA compliance screening — detecting purpose-of-remittance misclassification, AD bank reporting obligation triggers, and LRS limit monitoring — creates a governance requirement that domestic-PA AI governance frameworks do not address; (3) DPDP cross-border data flow: PA-CB entities transmit payment data across borders. The DPDP Act 2023's restrictions on cross-border personal data transfer apply to payment data about Indian individuals processed by PA-CB entities in foreign jurisdictions. AI fraud models running on cross-border payment data in foreign infrastructure may violate DPDP cross-border transfer restrictions applicable to significant data fiduciaries.

AI Governance · RBI · Payment Aggregator · Fraud Detection AI · India BFSI

RBI Payment Aggregator Master Direction 2025 AI Governance: Fraud Detection AI Explainability for Merchant Adverse Action, Transaction Monitoring Audit Trail, Merchant Onboarding AI PMLA and Killswitch Void India

RBI's consolidated Payment Aggregator Master Direction (RBI/DPSS/2025-26/141, September 15, 2025) mandates fraud detection and constant transaction monitoring for all 50+ RBI-authorised PAs — PhonePe, Razorpay, PayU, CCAvenue, Cashfree, and others. Both mandates are operationalised entirely through AI/ML. The direction mandates the outcome but creates zero AI governance: no explainability for merchant adverse actions, no model validation standard, no bias testing for merchant risk scoring, no killswitch, no AI audit trail. RBI's own FREE-AI report (August 2025) signals this gap will close. Zero global competitor coverage.

Zytra Research Team · September 2025 · 12 min read

📖 Part of the India BFSI AI Governance Complete Guide 2026 — RBI, SEBI, IRDAI, NPCI & DPDP in one place.

India's Payment Aggregator ecosystem — PhonePe, Razorpay, PayU, CCAvenue, Cashfree, Paytm Payments, BillDesk, and 40+ RBI-authorised entities — processes hundreds of millions of transactions daily for merchants ranging from micro-enterprises on Instagram to enterprise e-commerce platforms. The PA Master Direction 2025 (RBI/DPSS/2025-26/141, September 15, 2025) consolidated all prior PA regulations into a single instrument, adding PA-Cross Border coverage and strengthening fraud detection obligations.

The direction's fraud mandate is operationally explicit: "adequate information and data security infrastructure and systems for detection and prevention of frauds" and "constant monitoring of transactions carried out by merchants." In 2026, no PA satisfies these mandates without AI. Real-time transaction risk scoring, automated merchant onboarding due diligence, pre-authorization filters, and suspicious pattern detection are all AI-dependent. The direction created the obligation; it left the AI governance entirely undefined.

The Explainability Problem at Scale

India's PA ecosystem processes transaction volumes that make human review impossible without AI pre-filtering. A PA processing 50 million daily transactions with a 0.1% AI flagging rate generates 50,000 flagged transactions per day. The AI's decisions — block this transaction, suspend this merchant, escalate this pattern — cascade into real economic consequences for Indian merchants and consumers. When an AI model incorrectly flags a legitimate transaction, the merchant loses the sale and potentially the customer relationship. When an AI model incorrectly suspends a merchant account, the merchant may lose days of revenue and face working capital stress.

The PA Master Direction does not resolve what happens when a merchant disputes an AI-driven suspension. The merchant agreement specifies dispute resolution, but if the AI cannot produce a rationale for its decision, the PA has no articulable basis for the adverse action — creating legal exposure in Grievance Redressal proceedings and potential RBI inspection findings.

Micro-Merchant AI Bias: The Financial Inclusion Dimension

India's PA ecosystem is one of the world's largest enablers of financial inclusion for micro-merchants: small traders, artisans, gig workers, and home-based businesses who previously could not accept digital payments now onboard onto PhonePe, Razorpay, or Cashfree in minutes. AI merchant risk scoring models trained predominantly on urban, higher-volume merchant data may exhibit demographic or geographic bias against micro-merchants — assigning higher risk scores to low-volume merchants in Tier-3 cities not because of fraud indicators, but because the training data associates low-volume and geographic location with risk. The PA direction creates no obligation to test for this bias — yet systematically elevated rejection or restriction rates for micro-merchants would undermine RBI's financial inclusion mandate at the PA level.

RBI FREE-AI August 2025: The Signal

RBI's Report on Fintech Related Emerging and Evolving AI (FREE-AI), published August 2025, specifically recommends human oversight mechanisms and killswitch capabilities for payment sector AI. While FREE-AI is a recommendation document not yet converted to binding direction, it establishes RBI's stated policy direction for PA AI governance. PAs that build killswitch capability, human oversight protocols, and AI audit trails before FREE-AI recommendations become binding will face no compliance disruption when the final rule arrives.

Payment Aggregator AI Governance Checklist

☐ Fraud AI explainability: action-specific rationale log for every merchant suspension and transaction block; rationale cites specific observable indicators (not only risk score); merchant notification includes actionable reason; RBI inspection audit trail
☐ Model validation: fraud detection AI validated before production deployment; false positive rate (legitimate transaction block rate) and false negative rate (fraud miss rate) documented; geographic and merchant-category segment performance tracked
☐ Merchant risk AI bias testing: merchant risk scoring model tested for demographic/geographic bias; micro-merchant approval rates compared to equivalent-risk larger merchants; correction protocol for identified bias
☐ Merchant onboarding AI: AI beneficial ownership analysis false negative rate documented; adverse media AI coverage of vernacular Indian-language sources verified; periodic re-screening AI recall rate monitored; PMLA audit trail per merchant
☐ Killswitch and incident reporting: killswitch capability for fraud AI (defined criteria for human takeover of fraud decision pipeline); incident reporting protocol for AI system failure (both over-blocking and under-detection events); RBI FREE-AI alignment documented
☐ PA-CB AI governance: cross-border fraud AI validated on cross-border transaction data; FEMA compliance AI coverage documented; DPDP cross-border data flow assessment for AI fraud models running in foreign infrastructure
☐ CERT-In audit scope extension: annual CERT-In cybersecurity audit scope assessed for AI model governance inclusion; gap identified; AI model governance audit track established separate from cybersecurity audit