The PA-PG guidelines, and the slow professionalisation of who may touch your money.
On the 2020 circular that ended a decade of payment-aggregator informality, and the licence regime that replaced it.
For most of the years between 2010 and 2020, the country's online payments worked through a class of intermediary that the regulator did not formally recognise. A payment aggregator — a company that sat between a merchant and the underlying acquiring bank, collected card or net-banking payments on the merchant's behalf, and remitted the net amount to the merchant the next day — was, in regulatory terms, a non-thing. It was not a bank, not a payment system operator under the Payment and Settlement Systems Act, and not a non-banking financial company. It was, simply, a business that handled other people's money for a fee.
The arrangement worked, mostly. The dominant players built large books on the strength of fast onboarding, easy integration, and accommodating credit terms for the merchants whose money they held. The regulator watched. Occasionally the regulator wrote a circular reminding everyone that, technically, what the aggregators were doing required authorisation. Nobody read the reminders.
The March 2020 circular
In March 2020, the reminders ended. The Reserve Bank of India issued the Guidelines on Regulation of Payment Aggregators and Payment Gateways, which required every entity offering aggregation services to apply for authorisation by a specified deadline, meet a minimum net worth — initially fifteen crore, rising to twenty-five crore by the third year — undertake a fit-and-proper test, maintain an escrow account for settled funds, and submit to a long list of operational obligations. The deadline arrived. Some aggregators got their authorisation in the first round; some in the second; some, conspicuously, did not.
A licence is a regulator's way of saying that what was a business is now an institution.
The guidelines drew a careful distinction between aggregators and gateways. A gateway, in the new vocabulary, was a technology provider that facilitated the transaction but never touched the funds; a gateway needed no authorisation. An aggregator, which did touch the funds, did. The distinction has been useful for a thousand commercial conversations since, and the line between the two — gateway-only versus full aggregator — has become one of the more consequential design choices a new payments company can make.
What the regime did
What the PA-PG regime did, in the end, was professionalise the field. The barrier to entry rose; the number of meaningful players consolidated; the obligations on the survivors grew. The merchants noticed nothing. The merchants' money, in the meantime, became measurably safer.