The regulatory framework for fintech in India: Payments Vision 2025, the regulatory sandbox and account aggregators, digital lending and payment aggregator rules, data protection and localisation, cybersecurity and compliance timelines.

The Reserve Bank of India (“RBI”) has built a structured regulatory framework for India’s financial technology sector, one of the largest fintech markets in the world. The rapid digitisation of financial services, accelerated by the shift to digital payments during 2020 and 2021, has made that framework central to how fintech businesses are structured and operated.

The scale of adoption explains the regulatory attention. In the financial year 2022–23 alone, the Unified Payments Interface (“UPI”) processed more than 8,300 crore transactions worth about ₹139 lakh crore. With that growth have come concerns about consumer protection, data security, mis-selling in digital lending and the stability of payment systems.

The RBI’s response operates on several fronts: a long-term vision for payment systems, mechanisms that support innovation under supervision, and sector-specific rules for digital lending, payment aggregation and data. Other regulators, including the Securities and Exchange Board of India (“SEBI”) and the Insurance Regulatory and Development Authority of India (“IRDAI”), govern fintech activity within their own sectors. This article sets out the principal elements of that framework and the compliance obligations that follow.

RBI’s Strategic Framework for Fintech Regulation

The RBI’s approach seeks to balance support for innovation with prudential oversight. It operates through a combination of policy direction, supervised testing and shared digital infrastructure.

Payments Vision 2025

The RBI’s Payments Vision 2025,1 released in June 2022 under the theme “E-Payments for Everyone, Everywhere, Everytime”, is built on five anchor goalposts: integrity, inclusion, innovation, institutionalisation and internationalisation. Among its stated targets are a more than threefold increase in the number of digital payment transactions and sustained high growth in UPI volumes.

The Vision also addresses the Central Bank Digital Currency. The RBI launched pilots of the Digital Rupee (e₹) in the wholesale segment in November 2022 and in the retail segment in December 2022, and these pilots continue to be expanded in scope and participation.

Regulatory Sandbox and the Reserve Bank Innovation Hub

The RBI’s regulatory sandbox, established under an enabling framework issued in 2019, allows new financial products and services to be tested in a controlled environment with regulatory relaxations. Its cohorts have addressed retail payments, cross-border payments, MSME lending and the prevention and mitigation of financial frauds, followed by theme-neutral cohorts open to a wider range of innovations.

The Reserve Bank Innovation Hub, set up by the RBI in 2021, works alongside the sandbox as a platform connecting regulators, start-ups and established financial institutions to develop and test new solutions.

Account Aggregator Framework

Account Aggregators (“AAs”) are NBFCs licensed by the RBI to enable the consent-based sharing of financial information between Financial Information Providers, such as banks, and Financial Information Users, such as lenders. The framework became operational in September 2021 and has since expanded across banks, NBFCs, insurers and securities market participants. For fintech lenders, AAs offer a regulated route to obtain a borrower’s financial data with the borrower’s express consent.

Regulatory Framework for Fintech Sectors

The RBI and other regulators have adopted sector-specific frameworks that reflect the distinct risks of each fintech vertical.

Digital Lending

The RBI (Digital Lending) Directions, 20252 consolidate the rules governing digital lending by regulated entities (“REs”) and their Lending Service Providers (“LSPs”). Among other things, they:

  • cap Default Loss Guarantee (“DLG”) arrangements at 5% of the amount of the loan portfolio covered;
  • require REs to provide borrowers with a Key Fact Statement setting out the key terms and all-inclusive cost of the loan;
  • give borrowers a cooling-off period within which they may exit the loan by repaying the principal and the proportionate annual percentage rate, without penalty; and
  • require an LSP that partners with multiple lenders to present all matching loan offers to the borrower in an unbiased manner, with the name of each lender, the loan amount, tenor, annual percentage rate and repayment terms.

REs were required to report the Digital Lending Apps they deploy, or that their LSPs deploy, on the RBI’s Centralised Information Management System by 15 June 2025, and the requirements for multi-lender arrangements apply from 1 November 2025.

Payment Aggregators and Co-Branded Cards

Payment Aggregators (“PAs”) require authorisation from the RBI under the Payment and Settlement Systems Act, 2007. A non-bank PA must have a net worth of ₹15 crore at the time of applying for authorisation and ₹25 crore by the end of the third financial year after authorisation. The RBI has also moved to bring offline, or physical point-of-sale, payment aggregators within the regulatory framework.3

Co-branded credit cards have also come under closer scrutiny. The RBI’s directions on credit and debit cards, as amended in March 2024, require the card issuer to be clearly identified in co-branded arrangements and restrict the role of the co-branding partner, limiting how fintech partners may participate in the card business.

Securities and Insurance Technology

SEBI regulates wealthtech platforms through its existing framework, including the SEBI (Investment Advisers) Regulations, 2013 and the SEBI (Research Analysts) Regulations, 2014. Platforms that provide investment advice or research must be registered accordingly.

IRDAI regulates insurance web aggregators, which must be registered and present product information from multiple insurers in an unbiased manner. IRDAI’s “Bima Trinity” initiative comprises Bima Sugam (an electronic insurance marketplace), Bima Vistaar (a bundled basic cover) and Bima Vahak (a women-centric distribution channel).

Data Protection and Security Framework

Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 establish a framework built around Data Principals, Data Fiduciaries and Data Processors. Fintech businesses will usually be Data Fiduciaries, responsible for determining the purpose and means of processing personal data.

Processing must generally be based on free, specific, informed and unambiguous consent, preceded by a notice. Data Principals may withdraw consent at any time, after which the Data Fiduciary must, within a reasonable time, cease processing and have its Data Processors do the same.

Penalties under the Schedule to the DPDP Act are significant. Failure to take reasonable security safeguards to prevent a personal data breach can attract a penalty of up to ₹250 crore, and failure to notify the Data Protection Board and affected Data Principals of a breach can attract a penalty of up to ₹200 crore.

Payment System Data Localisation

Since the RBI’s circular of 6 April 2018,4 payment system operators must ensure that the entire data relating to the payment systems operated by them is stored in a system only in India. This includes end-to-end transaction details and information collected, carried or processed as part of the payment instruction.

Processing may take place outside India, but the data must then be stored only in India and deleted from systems abroad within one business day or 24 hours of processing, whichever is earlier.5 For cross-border transactions, a copy of the domestic component may also be stored abroad. Compliance is verified through a System Audit Report prepared by an auditor empanelled with CERT-In.

Cybersecurity and Incident Reporting

Under the directions issued by CERT-In on 28 April 2022,6 service providers, intermediaries, data centres and body corporates must report specified cyber security incidents to CERT-In within six hours of noticing them and maintain logs of their ICT systems for a rolling period of 180 days. RBI-regulated entities are, in addition, subject to the RBI’s Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, 2023, and to their sector-specific cyber security frameworks, which include their own incident reporting obligations.

Compliance Architecture and Regulatory Timelines

Regulatory compliance has become a determinant of operational viability for fintech businesses. Because the RBI, SEBI, IRDAI and other authorities regulate different aspects of the sector, businesses need a compliance framework that maps each of their activities to the correct regulator and set of rules.

Licensing Requirements and Applications

From 1 May 2025, the RBI requires regulated entities to submit applications for authorisations, licences and regulatory approvals through its PRAVAAH (Platform for Regulatory Application, Validation And AutHorisation) portal.7

The authorisations a fintech business requires depend on its operating model. For example:

  • payment aggregators and issuers of prepaid payment instruments require authorisation from the RBI under the Payment and Settlement Systems Act, 2007;
  • lending on the business’s own balance sheet requires registration as an NBFC under Section 45-IA of the Reserve Bank of India Act, 1934, while a platform that only sources loans for REs operates as an LSP under the Digital Lending Directions; and
  • there is no licensing regime for crypto-asset businesses in India, but virtual digital asset service providers must register with the Financial Intelligence Unit–India under the Prevention of Money Laundering Act, 2002.

Operational Compliance Framework

The regulatory environment calls for a structured compliance function. Essential components include:

  1. appointing dedicated compliance officers responsible for monitoring regulatory developments;
  2. conducting scheduled internal and external audits to identify compliance gaps;
  3. maintaining complete documentation of compliance activities; and
  4. running regular training programmes on regulatory requirements for employees.

Fintech businesses that build compliance into their operations from the outset are better placed to obtain authorisations, partner with regulated entities and avoid penalties. As regulators continue to refine the framework, a compliance-first approach is essential for businesses seeking to scale in India.

Footnotes

  1. Reserve Bank of India, Payments Vision 2025, June 2022, https://rbidocs.rbi.org.in/rdocs/PublicationReport/Pdfs/PAYMENTSVISION2025844D11300C884DC4ACB8E56B7348F4D4.PDF. ↩

  2. Reserve Bank of India (Digital Lending) Directions, 2025, issued on 8 May 2025. ↩

  3. Reserve Bank of India, Draft Directions on Regulation of Payment Aggregator – Physical Point of Sale, April 2024. ↩

  4. Reserve Bank of India, circular on Storage of Payment System Data, 6 April 2018. ↩

  5. Reserve Bank of India, Frequently Asked Questions on Storage of Payment System Data, https://www.rbi.org.in/commonman/english/Scripts/FAQs.aspx?Id=2995. ↩

  6. CERT-In, Directions under Section 70B(6) of the Information Technology Act, 2000, 28 April 2022. ↩

  7. Reserve Bank of India, circular on processing of regulatory applications through PRAVAAH, April 2025. ↩

Thought Leadership

Further Reading

Alagh & Kapoor Law Offices

Disclaimer

The Bar Council of India does not permit advocates to solicit work or advertise in any manner. By clicking “I agree”, you acknowledge that:

  • you are seeking information about Alagh & Kapoor Law Offices of your own accord, and there has been no solicitation, advertisement or inducement by the firm or its members;
  • the information on this website is for general information only and is not legal advice; and
  • using this website does not create a lawyer–client relationship.

The firm is not liable for any consequence of action taken on the basis of this website’s content. All content on this website is the intellectual property of Alagh & Kapoor Law Offices.

Leave this website