Merchants must verify RBI-authorised payment aggregators beyond branding

A new guide emphasises the importance of confirming the legal entity and specific authorisation category of payment aggregators, highlighting risks of relying solely on branding and outdated approvals amid RBI’s unified regulatory framework.

For merchants, the real question before signing with a payments provider is not whether the brand looks familiar, but whether the legal entity behind it is actually authorised to collect customer funds and settle them to your business for the type of payment flow you need. The guide published by Razorpay says that an RBI-authorised payment aggregator is a non-bank entity with a Certificate of Authorisation, and that merchants should verify that status from public records rather than relying on marketing claims or old announcements.

That distinction matters because “RBI-compliant” is broader than authorisation alone. The article explains that the public record can confirm the legal entity and the payment aggregator category it is allowed to operate in, but it does not by itself prove every continuing control, such as merchant due diligence, escrow handling, security, disputes or regulatory reporting. It also warns against three common errors: checking only the consumer-facing brand, assuming online approval covers physical or cross-border flows, and treating a pending application or press release as current evidence. Related reporting on payment aggregator regulation notes that the RBI framework now brings online, physical and cross-border activity into a single structure, with distinct categories that have to match the service being sold.

The verification process, as set out in the Razorpay guide, begins with the contracting legal entity and then moves through the RBI’s current authorised-operator list and application-status page. The publication says merchants should confirm the authorisation date, the relevant payment aggregator category and the exact entity named in the contract, invoice and settlement records. It also recommends checking whether the provider is authorised for PA-O, PA-P or PA-CB activity, depending on whether the merchant needs online, physical or cross-border payment aggregation. Industry explainers on the RBI rules say that this category matching is central to shortlisting a provider safely, particularly where merchant onboarding and settlement responsibilities sit with different entities.

The article goes on to argue that authorisation is only the starting point for due diligence. A payment aggregator still has to carry out merchant KYC, verify identity and background, monitor transactions against the declared business profile and maintain the right account structure for settlement. Razorpay says merchants should ask how the provider handles escrow, refunds, chargebacks, settlement timing and grievance escalation before any contract is signed. The piece also notes that recurring billing has its own compliance layer, because payment aggregator approval does not cover mandate handling for subscriptions. Other compliance guides agree that merchants should expect evidence of KYC controls, security audits and customer support arrangements before onboarding.

Cross-border merchants are told to be especially careful. The guide says a domestic online payment aggregator approval does not automatically permit inward or outward cross-border collection, and that merchants should check whether the RBI entry shows PA-CB inward, PA-CB outward or both. It also says the provider should be able to support the documentation needed for related bank reporting processes where applicable. Separate industry coverage of the RBI framework adds that the updated rules keep inward and outward cross-border permissions distinct, so the direction of payment flow has to be matched carefully to the authorisation shown on the public list.

For Razorpay itself, the guide says the public record should be checked under the legal entity Razorpay Payments Private Limited, not the brand name alone. It says the company’s payment aggregation services moved to that entity from January 1, 2026, after an RBI-approved transfer, and that the current RBI list shows online, physical and cross-border permissions. The article therefore treats authorisation as something to verify, not assume, even when the provider is well known. Broader reporting on payment aggregators also points to the continuing importance of the RBI’s list and the distinction between final approval and a pending application, underscoring why merchants are advised to keep dated records of the public entry and the contract terms they sign.