What AI governance obligations do the RBI Payment Aggregators Directions 2025 create for non-bank PAs?

RBI Payment Aggregators Directions 2025 (RBI/DPSS/2025-26/141, issued September 15, 2025) are the first comprehensive, consolidated regulatory framework for India's payment aggregator sector — superseding the March 2020 PA Framework, the March 2021 supplementary guidelines, and the October 2023 Cross-Border PA Directions. The Directions apply to approximately 400+ non-bank payment aggregators that had applied for RBI authorization by December 31, 2025, plus bank payment aggregators operating within the framework. Merchants, FinTechs, and e-commerce entities routing payments through authorized PAs are indirectly subject. Five explicit AI governance obligations: (1) Board-approved Information Security Policy covering AI fraud scoring: every PA must have a board-approved IS Policy that explicitly addresses AI/ML fraud detection systems. This is not the board approving a general security policy with AI mentioned — it is a governance obligation requiring the board to understand and approve the AI fraud scoring framework embedded in the IS Policy; (2) Continuous ML-based transaction monitoring: the Directions mandate continuous monitoring of merchant transactions against business profiles — not merely one-time KYC or onboarding verification. This creates an operational obligation for algorithmic/ML-based ongoing transaction risk assessment as a regulatory requirement. A PA that relies on periodic batch review rather than real-time continuous AI monitoring is non-compliant; (3) FIU-IND registration and PMLA reporting: all non-bank PAs must register with the Financial Intelligence Unit — India (FIU-IND) under the Prevention of Money Laundering Act and file Suspicious Transaction Reports. This creates AI/AML governance obligations for algorithmic AML monitoring systems — non-bank PAs that were previously outside the PMLA framework must now operate PMLA-compliant AML AI; (4) Annual CERT-In audit covering AI infrastructure: annual audits by CERT-In empanelled auditors must cover the full information security infrastructure including AI fraud detection systems. PAs relying on external AI fraud scoring APIs must secure vendor audit rights; (5) Board-level risk management framework for algorithmic risk: PAs must implement a comprehensive risk management framework covering fraud prevention algorithms, suspicious activity monitoring AI, and customer data security controls, with direct board accountability.

How do the RBI Payment Aggregators Directions 2025 AI obligations differ from the existing NPCI UPI circular AI governance?

The NPCI UPI Circular 2024 (already covered in Zytra's India BFSI AI governance corpus) and the RBI Payment Aggregators Directions 2025 cover two distinct regulated populations with different AI governance obligations: (1) NPCI UPI Circular 2024 scope: governs AI fraud scoring on the UPI payment rails — NPCI as the infrastructure operator establishes AI fraud scoring norms for all UPI participants (banks, Payment Service Providers). The banks and PSPs on UPI rails are NPCI's regulated entities in this context; (2) RBI Payment Aggregators Directions 2025 scope: governs payment aggregators as independently regulated entities — FinTechs and non-bank entities that aggregate payments between merchants and payment networks (including but not limited to UPI). PAs sit between merchants and the payment rails; NPCI's UPI framework covers what happens on the rails. The ~400 non-bank PAs are not banks and were not covered under any previously covered Zytra document; (3) Different AI obligations: the NPCI UPI AI obligation focuses on fraud scoring accuracy on the UPI payment rail. The RBI PA Directions AI obligation focuses on board-level fraud AI governance, continuous merchant monitoring, PMLA-compliant AML AI, and CERT-In audit coverage — obligations that apply to the PA as a regulated entity, not to the payment rails; (4) Complementary compliance: a FinTech that operates as both a PA and a UPI app PSP faces obligations from both documents. Its UPI fraud scoring AI must comply with NPCI's norms; its merchant transaction monitoring AI and board-level fraud governance must comply with the PA Directions. The compliance stacks are complementary, not redundant.

What is the FIU-IND PMLA registration obligation for non-bank PAs and how does it govern AML AI systems?

The RBI PA Directions 2025 require all non-bank payment aggregators to register with the Financial Intelligence Unit — India (FIU-IND) as reporting entities under the Prevention of Money Laundering Act, 2002 (PMLA). This is a structural governance change for the PA sector — most non-bank PAs operated outside the PMLA framework because they were not previously classified as reporting entities. The PMLA registration creates four AI governance implications: (1) AML programme obligation: registered PMLA entities must maintain a documented AML/CFT programme covering suspicious transaction detection, monitoring of politically exposed persons, and threshold-based cash transaction reporting. For PAs whose primary AML mechanism is AI-based transaction monitoring, this programme must specify the AI model's parameters, thresholds, and governance procedures; (2) Suspicious Transaction Report generation: PAs must file Suspicious Transaction Reports with FIU-IND for transactions meeting STR criteria. Where AI algorithms identify and generate STR triggers, the PA must document how the AI model's output is reviewed, approved, and translated into an STR filing — a human-in-the-loop requirement for AI-triggered regulatory reports; (3) PMLA-compliant AI training data: PMLA AML models must be trained on data that supports genuine risk-based AML screening — a PA that deploys AI AML monitoring trained on non-representative data or with systematic evasion gaps faces regulatory exposure under both PMLA and the PA Directions; (4) FIU-IND examination: FIU-IND conducts examinations of PMLA reporting entities. A PA with AI-based AML monitoring will face FIU-IND scrutiny of its AI model's accuracy, its STR generation process, and its human oversight of AI AML outputs. AML AI governance is now a regulatory audit category for PAs, not just an internal risk management tool.

What AI governance gaps exist between the RBI PA Directions 2025 and actual practice among India's payment aggregators?

India's payment aggregator sector includes large established PAs (Razorpay, PayU, CCAvenue/Infibeam, Cashfree, Paytm Payment Gateway, Pine Labs) alongside hundreds of smaller niche PAs serving specific merchant categories. The AI governance gap across the sector is concentrated in four areas: (1) Board AI fraud policy gap: the board-approved IS Policy requirement with explicit AI fraud scoring coverage is new. Most PA boards approved generic security policies without AI-specific provisions. The PA Directions require boards to understand and approve the AI fraud scoring framework embedded in the IS Policy — a governance obligation that requires AI fluency at the board level that most PA boards have not yet developed; (2) Continuous monitoring vs batch: many smaller PAs rely on periodic (hourly or daily) batch analysis of merchant transaction patterns rather than real-time continuous ML monitoring. The Directions' continuous monitoring mandate requires a shift to real-time AI monitoring infrastructure — a capital investment for smaller PAs; (3) PMLA AI readiness: the FIU-IND registration and PMLA obligations are new for non-bank PAs. Most non-bank PAs do not have PMLA-compliant AML AI programmes because they were not previously required to. Building a PMLA-compliant AML AI programme — including model documentation, STR generation workflow, and human oversight — is a significant new AI governance investment; (4) CERT-In audit scope: most PA annual security audits focus on application security, network security, and data protection — not specifically on AI fraud scoring systems. Extending CERT-In audit scope to AI infrastructure requires engaging auditors with AI competency, which is not universally available in the CERT-In empanelled auditor ecosystem.

AI Governance · RBI · Payment Aggregators · Fraud AI · ML Monitoring · PMLA · India BFSI

RBI Payment Aggregators Directions 2025 AI Governance: Board-Approved AI Fraud Policy, Mandatory Continuous ML Transaction Monitoring, FIU-IND PMLA Registration and CERT-In AI Audit for 400+ Non-Bank PAs India

RBI Payment Aggregators Directions 2025 (RBI/DPSS/2025-26/141, September 15, 2025) — first comprehensive consolidated PA regulatory framework — create explicit AI governance obligations for India's ~400+ non-bank payment aggregators. Board must formally approve Information Security Policy with AI/ML fraud detection explicitly covered. Mandatory continuous ML-based merchant transaction monitoring (shift from periodic batch to real-time AI surveillance). Non-bank PAs must register with FIU-IND under PMLA, creating AML AI governance obligations for a previously unregulated population. Annual CERT-In audit must cover AI fraud infrastructure. Entirely distinct from NPCI UPI Circular 2024 — covers PAs as independently regulated entities, not as UPI rail participants. Zero global competitor coverage.

Zytra Research Team · September 2025 · 11 min read

📖 Part of the India BFSI AI Governance Complete Guide 2026 — RBI, SEBI, IRDAI, NPCI & DPDP in one place.

India's payment aggregator sector processes hundreds of millions of transactions daily — every Razorpay merchant checkout, every CCAvenue payment page, every Cashfree API call. AI runs the fraud layer: every transaction is scored against a merchant risk profile, behavioural baseline, and network pattern in real time. Until September 2025, that AI operated in a regulatory gap — non-bank PAs were not explicitly subject to PMLA, not required to have board-approved AI fraud frameworks, and not within CERT-In audit scope for their AI infrastructure.

The PA Directions 2025 close that gap. For the first time, the ~400 non-bank PAs have an explicit AI governance obligation at the board level, a regulatory mandate for continuous ML monitoring, and a new status as PMLA reporting entities requiring AML AI programmes. This is the first India BFSI circular to reach the FinTech PA sector with AI governance obligations that are on par with those applied to banks.

The PMLA Gap for Non-Bank PAs

Non-bank PAs process merchant payment flows that include high-value merchants, cross-border transactions, and sectors with elevated money laundering exposure (crypto-adjacent services, high-ticket e-commerce, online gaming). Until the 2025 Directions, most non-bank PAs operated without PMLA reporting entity status — relying on the banking partners in the payment chain to carry the PMLA obligation. The direct PMLA registration obligation means PAs can no longer rely on banks upstream to absorb the AML compliance burden. Every PA must now maintain its own PMLA-compliant AML AI programme and file STRs directly with FIU-IND.

RBI Payment Aggregators Directions 2025 AI Compliance Checklist

☐ Board-approved IS Policy with AI coverage: board-approved IS Policy explicitly addresses AI/ML fraud detection systems; board understands and approved AI fraud scoring framework; review cadence defined
☐ Continuous ML monitoring: real-time continuous merchant transaction monitoring operational; not periodic batch; ML model continuously assesses merchant transactions against business profiles
☐ FIU-IND PMLA registration: non-bank PA registered with FIU-IND as PMLA reporting entity; AML programme documented; STR generation workflow for AI-triggered alerts defined; human oversight of AI AML outputs in place
☐ PMLA AI programme: AML AI model documented (parameters, thresholds, governance); training data representativeness assessed; model accuracy tested; STR filing process for AI-generated triggers defined
☐ CERT-In AI audit: annual CERT-In audit scope includes AI fraud detection systems; auditor with AI competency engaged; vendor audit rights secured for external AI fraud scoring APIs
☐ Board risk management framework: risk management framework covers fraud prevention algorithms, suspicious activity monitoring AI, customer data security AI controls; board accountability defined
☐ NPCI UPI intersection: where PA also operates as UPI PSP, NPCI UPI AI fraud scoring obligations mapped alongside PA Directions obligations; no gaps at intersection
☐ RBI examination readiness: IS Policy AI section, FIU registration, PMLA programme documentation, CERT-In audit evidence, continuous monitoring records — packaged for RBI PA examination