RBI proposed regulation states that “no entity can store card transaction data from August 2025.”

With the exception of the card issuer and card networks, no party involved in a card transaction would be permitted to hold data starting on August 1, 2025, according to the Reserve Bank of India’s new draft guidelines on the regulation of Payment Aggregators (PAs).

It said that companies may save the last four digits of a card number and the name of the card issuer for transaction monitoring or reconciliation reasons, but that any such data that has already been kept would be deleted. The RBI has released draft guidelines for regulating PAs and requested feedback from the general public.

Physical Point of Sale (PA-P) regulations provide that non-banks offering PA-P services must have a minimum net value of Rs. 15 crore when they apply for authorization from the RBI and a minimum net worth of Rs. 25 crore by March 31, 2028, according to the central bank.

Additionally, it said that current non-bank PA-P may stop operating by July 31, 2025, if they are unable to meet the networth criterion or do not submit an application for authorization within the allotted period. By October 31, 2025, banks must shut non-bank PA-P accounts (used for PA activity) that were in existence as of the date of this circular, unless such PAs can provide documentation pertaining to an authorization application they filed to the RBI.

Additionally, it said that businesses offering PA-P should notify RBI of their plan to request authorization within 60 days in order to control the service. Currently, by May 31, 2025, players like MSwipe and Pine Labs must seek for authorization.

Co-founder and CEO of Signzy Ankit Ratan said that the regulator has emphasized in its rules that PAs cannot take a “one size fits all” approach when it comes to compliance. They must have systems in place that track the merchants’ transactions over time, apply risk-based payment limitations, and identify any risks early on.