By : Manisha Kumari Bharti
Introduction
India’s digital payments ecosystem has expanded rapidly with the growth of the Unified Payments Interface (UPI), prepaid payment instruments (PPIs), online commerce and card-based transactions. Payment aggregators (PAs) and PPI issuers play a significant role in this ecosystem, operating within a framework where fund management, customer protection, cybersecurity and regulatory compliance are closely interconnected.
Payment failures, delayed settlements, fraudulent transactions, data breaches and operational disruptions can affect customers, merchants, sponsor banks and other payment participants. Consequently, liability can no longer be examined solely through the lens of contractual breach or direct causation. It must be assessed across three dimensions: regulatory responsibility, contractual allocation of risk and customer-facing liability.
This article examines the evolving liability framework applicable to PAs and PPI issuers in India, with particular emphasis on regulatory obligations, settlement failures, fraud, data protection, indemnities and limitations of liability.
- Understanding Payment Aggregators and PPI Issuers
- Payment aggregators
A PA facilitates the acceptance of payments from customers on behalf of merchants and enables the subsequent settlement of collected funds. The RBI’s Master Direction on Regulation of Payment Aggregators dated 15 September 2025 (the Reserve Bank of India (Regulation of Payment Aggregators) Directions, 2025) governs the applicable framework, including authorisation, merchant due diligence, escrow arrangements and settlement obligations. A non-bank PA requires RBI authorisation, whereas a bank does not require separate authorisation to undertake PA business.
Unlike a payment gateway, which primarily provides payment-processing technology without handling funds, a PA undertakes fund collection and settlement functions. Accordingly, its liability extends to compliance with applicable requirements concerning fund safeguarding, reconciliation and timely settlement.
- Prepaid payment instrument issuers
PPI issuers facilitate transactions against stored value through instruments such as prepaid cards and wallets. Their responsibilities include compliance with applicable RBI directions on issuance and operation of PPIs, KYC, customer fund safeguarding, transaction processing and grievance redressal.
Unlike PAs, which primarily facilitate payment collection and settlement, PPI issuers are responsible for the prepaid instruments they issue. Where a PPI arrangement involves a sponsor bank or payment network, liability must be assessed based on each participant’s regulatory obligations, contractual responsibilities and role in the transaction.
- The Regulatory Foundation of Liability
The Payment and Settlement Systems Act, 2007 (PSS Act), provides the statutory foundation for the regulation of payment systems in India. Sections 4 and 7 address the requirement for RBI authorisation to operate a payment system and the grant of such authorisation.
The RBI’s Master Direction on Regulation of Payment Aggregators, 2025 and the Master Directions on Prepaid Payment Instruments, 2021, as amended, establish the respective regulatory requirements applicable to PAs and PPI issuers. The RBI released a draft Master Direction on Prepaid Payment Instruments in April 2026 which, once finalised, is proposed to replace the 2021 directions; until then, the 2021 directions, as amended, continue to apply.
These frameworks address authorisation, governance, fund safeguarding, settlement, merchant due diligence, operational security and customer protection. The Master Direction on Regulation of Payment Aggregators, 2025 also consolidates the regulatory framework applicable to different categories of payment aggregators, namely online (PA-O), physical (PA-P) and cross-border (PA-CB) payment aggregators. It also repeals the earlier 2020 guidelines on PAs and payment gateways and the 2023 directions on cross-border payment aggregation.
Importantly, contractual arrangements cannot eliminate obligations imposed by applicable law. A regulated entity may allocate financial responsibility to another party through an indemnity, but it may remain accountable to the regulator for its own non-compliance.
Liability may also arise from a failure to maintain prescribed controls, even where the entity did not directly cause the underlying fraudulent transaction or financial loss.
- Fund Safeguarding, Escrow and Settlement Liability
Fund safeguarding is a critical area of exposure for PAs and PPI issuers. Applicable RBI directions prescribe arrangements for protecting funds and meeting outstanding obligations, including escrow requirements for relevant non-bank PAs and fund-safeguarding requirements applicable to PPI issuers.
However, the existence of an escrow account does not eliminate risks arising from unauthorised debits, reconciliation errors, delayed settlements or shortfalls. Agreements must clearly define account-operation rights, permitted debits, reconciliation procedures, reporting obligations and responsibility for outstanding amounts.
Settlement liability becomes more complex when transactions involve multiple participants. For instance, in a prepaid card transaction, the customer’s balance may be debited while the corresponding settlement amount fails to reach the intended beneficiary. The cause may lie with the issuer’s technology platform, the sponsor bank, an incorrect instruction or a payment-network failure.
A broad indemnity requiring the PPI issuer to cover all losses arising from the programme may unfairly allocate risk where the failure results from the sponsor bank’s own conduct. Conversely, the bank should not automatically bear losses caused by incorrect instructions issued by the PPI issuer.
Sponsor Bank Agreements should therefore specify responsibility for settlement instructions, operation of settlement accounts, reconciliation, dispute resolution and losses arising from each party’s breach, negligence, fraud or wilful misconduct.
The objective should be to allocate liability according to the functions performed, the party’s control over the failure and its applicable legal obligations.
- Failed Transactions and Customer Compensation
Failed transactions may result in delayed reversals, incorrect debits or failure to credit the intended beneficiary. The RBI’s circular dated 20 September 2019 on Harmonisation of Turn Around Time (TAT) and Customer Compensation for Failed Transactions using Authorised Payment Systems prescribes transaction-specific reversal timelines and compensation requirements. The Master Direction on Regulation of Payment Aggregators, 2025 also expressly requires PAs to comply with this circular, as amended.
These requirements demonstrate the distinction between customer-facing responsibility and the ultimate allocation of loss between payment participants.
A customer-facing entity may be required to facilitate a reversal or compensation even where the technical failure occurred elsewhere in the payment chain. It may subsequently seek recovery from the participant responsible, subject to the applicable law and contractual arrangements.
Accordingly, agreements should specify who receives complaints, investigates failed transactions, initiates reversals, pays prescribed compensation and reconciles the resulting amounts. Customer redressal should not be delayed merely because the parties have yet to determine responsibility between themselves.
- Fraud, Cybersecurity and Data Protection
Fraud may arise from compromised credentials, fraudulent merchants, phishing, account takeover, insider misconduct or unauthorised system access. Its occurrence does not automatically establish liability for the PA or PPI issuer; the applicable customer-protection framework, the transaction involved and the conduct of the parties must be examined.
PAs must consider their obligations concerning merchant due diligence, fraud prevention and monitoring. PPI issuers must comply with applicable requirements governing transaction security, customer protection and grievance redressal.
Cybersecurity liability extends beyond direct financial loss. An incident may disrupt payment services, compromise transaction records, expose customer data or delay settlements. Agreements should therefore establish security standards, incident-notification timelines, investigation and remediation obligations, audit rights and business continuity requirements. The use of third-party technology providers also requires careful consideration. Outsourcing a function does not automatically absolve a regulated entity of its own regulatory responsibilities.
The Digital Personal Data Protection Act, 2023, and the Digital Personal Data Protection Rules, 2025, must be considered alongside their phased commencement provisions (the Rules were notified on 13 November 2025, and most substantive obligations of data fiduciaries, including notice, consent, security safeguards and personal data breach intimation, take effect eighteen months after notification, in May 2027), the Information Technology Act, 2000, and applicable RBI requirements.
Agreements should allocate responsibilities according to the actual data-processing activities of each party, including permitted use, security, disclosure, retention, deletion and breach response. A general confidentiality clause may not adequately address these obligations.
- Contractual Risk Allocation: Indemnities and Liability Caps
Indemnity and limitation-of-liability provisions are central to PA, PPI and sponsor-bank agreements. Poorly drafted clauses can expose one party to losses caused by another participant or impose liability disproportionate to the services performed. Indemnities should be linked to identifiable causes of loss, such as breach of contract, violation of applicable law, fraud, negligence, wilful misconduct or unauthorised instructions attributable to the relevant party. They should also address third-party claims, defence and settlement procedures, mitigation and the avoidance of double recovery.
Liability caps require similar scrutiny. A cap calculated solely by reference to fees paid during a short period may be inadequate where the potential exposure involves customer funds, settlement obligations or data breaches. For example, a sponsor bank’s liability cap based on fees paid by the PPI issuer during the preceding six months may not adequately reflect the risks associated with settlement accounts or critical payment functions.
The parties should assess whether the cap is proportionate to transaction volumes, foreseeable losses and operational responsibilities. Separate treatment may be appropriate for fraud, wilful misconduct, data breaches, confidentiality violations or obligations relating to outstanding funds, depending on the arrangement and applicable law.
Most importantly, contractual risk allocation cannot eliminate regulatory accountability. A regulated entity cannot avoid action for its own non-compliance merely because the agreement requires another party to reimburse the resulting loss.
- Shared Responsibility and Practical Considerations
A single payment transaction often involves several participants: PAs, PPI issuers, sponsor banks, acquiring banks, payment networks and technology providers. The entity dealing with the customer is therefore not necessarily the one responsible for the underlying failure.
A sound contractual framework should answer three distinct questions:
- Immediate responsibility: Which party must respond to the customer, restore funds or pay compensation under the applicable regulatory framework?
- Ultimate financial responsibility: Which party bears the loss, determined by reference to each party’s conduct, breach or contractual obligations?
- Dispute resolution: How will the parties investigate the incident, establish causation and recover the amounts due between them?
Agreements should support these processes through access to transaction logs, settlement records, reconciliation statements and other relevant evidence. They should also establish cooperation obligations for regulatory enquiries, investigations and customer complaints.
The evolving liability framework calls for a coordinated approach to drafting and reviewing payment agreements. Particular attention should be given to:
- Regulatory compliance: Clearly identify each party’s obligations and avoid treating outsourcing as a transfer of statutory responsibility.
- Funds and settlement: Define settlement timelines, reconciliation procedures, account-operation rights and responsibility for shortfalls or incorrect transfers.
- Customer protection: Allocate responsibility for failed transactions, reversals, unauthorised transactions and compensation.
- Fraud and cybersecurity: Establish security standards, incident reporting, investigation, remediation and audit rights.
- Indemnities and liability caps: Ensure that liability corresponds to the risks controlled by each party and that indemnities, exclusions and caps operate consistently.
- Termination and continuity: Address outstanding funds, transition assistance, record retention and continuity of customer services.
A general liability cap should not inadvertently override a separately negotiated obligation concerning outstanding funds, and an indemnity should not impose responsibility for losses expressly excluded elsewhere in the agreement.
Conclusion Liability for PAs and PPI issuers in India increasingly extends beyond transaction processing to encompass fund safeguarding, settlement integrity, fraud prevention, cybersecurity, data protection and customer redressal. While RBI directions establish the obligations that regulated entities must discharge, contracts determine how operational responsibilities and financial losses are allocated between participants. However, contractual arrangements cannot eliminate statutory obligations or automatically transfer regulatory accountability. The appropriate approach is a function-based, risk-sensitive and causation-oriented framework that links liability to the functions performed, the risks controlled and the obligations imposed by law. As India’s payment ecosystem becomes increasingly interconnected, effective contractual drafting and operational controls will remain essential to protecting customers, reducing disputes and maintaining trust in digital payments.
