How Payment-System Regulation Works in India

The Reserve Bank of India regulates payment systems in India, under the Payment and Settlement Systems Act. Running a payment system takes authorisation from that body, the resulting rules bind the operator and the entities participating inside the system, and the duties that follow cover governance, continuity, reporting and how the person using the arrangement is treated. Every requirement is read at rbi.org.in.

The shape of the whole problem is already sitting inside an ordinary flat. Two supplies come into that flat, water and electricity, and behind them stand two different offices in two different buildings. When the tap runs dry the household walks to the water office. When the meter reads wrong the household walks to the electricity office. So far this is ordinary, and nobody standing in that flat gets it wrong.

The noticeboard at the electricity office is thorough. The board is current, it is complete, somebody maintains it carefully, and it contains not one word about taps. That board was never written for a person standing there holding a tap problem, so there is no line at the bottom saying that water is dealt with elsewhere. A reader who works through every notice on it comes away having learned nothing about water while feeling as though they have read everything.

Payments and securities in India are two rulebooks with two bodies behind them, and neither rulebook contains a sentence saying that the other one exists. The separation between the two rulebooks is the fact the whole subject turns on. A person who knows only the securities side will meet a payment arrangement, look for its requirements in the only place they know, find nothing, and conclude something that is not true.

Indian law governs all of it, and the statute, the body issuing the rules under it and the site those rules are published on are named as each arrives. The fees, the limits, the timing requirements and the capital figures all move, so a figure repeated from memory is the one error in this subject that does real harm.

Setu Payments Private Limited, an invented operator, runs Setu Wallet, a prepaid arrangement. Bhadra Securities Private Limited, invented alongside it, is a broker and a depository participant, Yashodhan Pai is its compliance officer and Sumana Rege runs its technology. Anasuya Kolhapure, who holds securities through Bhadra Securities, completes the invented set.

Which body regulates payment systems in India, and where does its power come from?

The Reserve Bank of India regulates payment systems in India. The power to do it comes from the Payment and Settlement Systems Act, the governing lawThe statute under which the central bank regulates payment systems in India. It names the body, defines the thing regulated and grants the powers used. for this whole area. Most readers accept the first sentence at once and skip past the second, and the second is the one worth slowing down for.

Assuming the central bank regulates payments because it is the central bank is tempting, in the same easy way one assumes the traffic police handle traffic. The authority does not arise that way. A statute names the body, defines the thing being regulated, and grants the specific powers the body then uses. The authority is created by a document that can be opened and read, rather than by the general standing of the institution in the economy.

Why should that matter to somebody who only wants to know where to write? Because a power created by a document has edges, and the edges are written in the same document. Whether a particular question sits inside this body's authority is therefore a readable question with a findable answer, and the reading starts at the definition in the statute rather than at an impression of what a central bank generally does.

A payment systemAn arrangement for effecting payments between parties, as defined in the governing law. It is a defined term, not a loose description. is therefore not a category somebody invented in an office one afternoon. A payment system is a defined term in the statute, and that definition is the hinge everything else turns on. The definition decides who needs permission, whose conduct the rules reach, and which of the two rulebooks any given question belongs to. The definition is read at rbi.org.in, along with everything issued under it.

The securities side of Indian finance runs on a different statute and a different body, the Securities and Exchange Board of India, whose material sits at sebi.gov.in. The boundary between the two sets of rules falls between those two bodies. Two statutes, two bodies, two sites, and no bridge between them that anybody has built.

What counts as a payment system, and what falls outside the definition?

The definition works on function. It asks what an arrangement does with money as between parties, and it does not ask what the entity behind the arrangement considers itself to be. The distinction is small and its consequence is very large, and everything that follows keeps returning to it.

The words a firm uses about itself are not an input to the test, so two firms can describe themselves in identical words and land on opposite sides of that definition. A firm that calls itself a technology business is describing its staff, its culture and the people who put money into it. The definition is not interested in any of the three. The definition looks at the arrangement and at nothing else.

The definition also carries its own edges. Some things that look financial sit outside it, and the statute says which, in its own words, in a document that gets amended. A carve out repeated from memory is exactly the sentence somebody will later lean on, so the statute's own list is the one that governs. Whether a particular thing sits inside or outside is a reading job at rbi.org.in on the day it matters, and a short one.

Different duties attach to four different words, so the four are worth separating before going further. A reader who blurs them ends up reading a requirement addressed to somebody else. The system is the arrangement itself. The operatorThe entity running the arrangement. It answers for the system as a whole, which is a different position from taking part in one. is the entity that runs the arrangement. A participantAn entity taking part in a system that somebody else operates. It answers for its own conduct inside the system. is an entity that takes part in a system somebody else runs. And the person using the arrangement stands outside all three, bound by none of these rules and owed duties by those who are bound.

Anasuya Kolhapure, when she uses a payment arrangement to put money into her account at Bhadra Securities Private Limited, is standing in the fourth position. She is not a participant in anything. She is the person to whom the consumer facing duties are owed. The position is a much better one to occupy and a much worse one to be confused about. A person who believes the rules bind her is a person who will never go looking for what the rules give her.

Who needs authorisation, and what is that permission actually for?

AuthorisationThe permission required to operate a payment system. It is granted by the Reserve Bank of India under the governing law. is permission to operate a payment system, and it is granted by the Reserve Bank of India under the statute named above. Whether a given arrangement needs one is settled by the definitional test, applied to the arrangement, by somebody who has actually read the definition.

Here is where the mistake enters, and it is not a foolish mistake. A technology company builds something that moves money between its users. The people who built it know it as a product, a codebase and a set of screens. Nobody in that room feels like the sort of person who runs financial market infrastructure, so nobody in that room thinks of themselves as doing it. The definition asks how an arrangement moves money between parties, and a firm's own sense of what business it is in is not part of the test.

The everyday version is a man who cooks at home and sells the food for a fee. He does not consider himself a restaurant, he has no board outside, no printed menu and no staff, and he is entirely sincere about all of it. None of that decides whether the rules about serving food to the public reach him. The rules turn on what he is actually doing. Somebody else will assess that later, using a test he has never read. The finance version has the same shape and surprises people just as much.

The second half of the question matters as much as the first. An authorisation is permission to operate a particular arrangement as it was described, and not a general licence to do anything at all with money belonging to other people. So a change in how an arrangement moves money between parties is not only a product decision taken by a product team. A change of that kind is a question about the permission, and the question belongs before the change rather than in an explanation afterwards.

The Reserve Bank of India sets what an applicant must satisfy, what must be filed, what any of it costs and how long any step takes, and publishes all of it at rbi.org.in. Each of those items moves, and each is read at that source on the day it matters.

Do the rules reach only the operator, or the entities inside the system too?

The rules reach both, and this is the question most often answered wrongly by a firm reading about itself. The operator answers for the system as a whole. A participant answers for its own conduct inside that system. Two different positions, two different sets of duties, and neither of the two is nothing.

The everyday shape is a market building with thirty shops in it. The building manager is answerable for the fire alarm, the water tank and the lift. Each shopkeeper is answerable for not stacking cartons in the stairwell. A shopkeeper who says he does not run the building has described who installs the alarm, quite correctly, and has said absolutely nothing about who is bound by the rule on stairwells.

A firm that concluded it sits outside these rules because it runs no system of its own has answered a different question from the one that was asked. The question was never whether it operates something. The question was whether it is inside a system, and being inside somebody else's arrangement is a position the rules describe rather than a place the rules cannot see.

Bhadra Securities Private Limited is worth looking at precisely because it is unremarkable. The firm runs no payment system. It takes part in arrangements that other entities run, every working day, and that is how money reaches and leaves the accounts of people like Anasuya Kolhapure. Nothing about that makes Bhadra Securities an operator, and nothing about it puts Bhadra Securities beyond the reach of the rules governing the arrangements it sits inside.

The requirements attaching to each position are, once again, a reading job at rbi.org.in. The shape matters more than the content: which of the two positions applies is settled before any search for what must be done. Looking first and classifying afterwards produces a confident answer to a question nobody asked.

What obligations follow once an authorisation is granted?

The application is the smallest part of this. An authorisation is not an event that finishes; it is the start of a continuing state, and the obligations that follow are the substance of what being authorised actually means. A firm that treats the grant as a finish line has misread the whole arrangement, usually in a way nobody notices for a year.

Four areas hold nearly everything. The areas are stable while their contents are revised, so the areas are worth committing to memory even though the contents are not.

The four areas are stable and the requirements inside them are revised, so an area is worth learning and a requirement is worth looking up. Reporting, for one, has periods attached to it in the live text. A period carried from memory into an account that stands still is the most damaging single thing this subject can produce. The area is the durable half; the requirement itself is read at the site named, on the day it is needed.

Notice also what the four areas have in common. Not one of them asks whether the arrangement is a good product. The four ask whether it is run by somebody answerable, whether it survives a bad day, whether the body regulating it can see what is happening, and whether the person using it is treated properly. The list is a very different one from what a firm would write about itself, and the difference is the point.

Where do consumer facing obligations differ from the operational ones?

The operational obligations ask whether the arrangement works. A consumer facing obligationA duty owed to the person using the payment arrangement, covering what they are told, what is disclosed and how a complaint is dealt with. asks whether the person using it is treated properly: what they are told before they use it, what is disclosed to them, how a complaint is heard, and what happens when something goes wrong for that person specifically.

The two are assessed separately, and the separation is what makes the distinction worth learning. A system can be technically excellent, never stop, never lose a record, and treat the people using it badly. The reverse also exists, though it is rarer and tends to be shorter lived. Nothing in the design makes one side produce the other, so being strong on one is no evidence at all about the other.

The everyday version is a bus that runs exactly to time with a conductor who will not state the fare and will not hear a complaint. The service is excellent by one measure and unusable by another, and a passenger told to judge it on punctuality alone has been handed the wrong instrument for the complaint that is actually bothering them.

Setu Payments Private Limited is the case to work through. Suppose its arrangement runs for a year without interruption, a genuine achievement, and suppose that when a holder of Setu Wallet writes in about a problem, nobody answers, nothing is recorded and the holder is told to write again. The operational side of that year is strong. The consumer facing side is not, and the second fact is not softened by the first. The two are separate duties, they are read separately, and they fail separately.

How does this rulebook sit beside the securities one, and who stands in both?

The comparison does more work here than any definition can, so put the two firms side by side.

Setu Payments Private Limited operates Setu Wallet. Every question anybody can ask about it goes to one place: what it may issue, what it must do with the value it holds, what it must tell a holder, what it must report, and to whom. Not one of those questions is answered on the securities side. A person who went looking there would find a great deal of careful, well maintained material about brokers, depositories and the market, and nothing whatsoever about Setu Wallet.

Now set Bhadra Securities Private Limited beside it. The second shape is the commoner one and the more interesting one. Bhadra Securities is a broker and a depository participant, so its registrations sit on the securities side. Moving client money all day is simply what a broking business does, and Bhadra Securities does it constantly. Yashodhan Pai, its compliance officer, therefore reads two rulebooksThe position of a firm whose activities reach both payments and securities, so that requirements sit in two places under two bodies.: the securities one for what Bhadra Securities is registered to do, and the payments one for the arrangements through which money reaches and leaves the firm. Two bodies, two sites, two sets of documents, two consulted dates in his file.

Neither rulebook mentions the other, and nothing inside either one tells Yashodhan Pai that the other exists. He does not learn about the payments rulebook by reading the securities one more carefully. He learns about it by already knowing, or by being told by somebody, or by an enquiry arriving from a direction he was not watching. There is no fourth route, and reading harder is not one of the three.

Readers usually ask at this point why the two are not stitched together, and the answer is duller than the question deserves. The two regulate different things. One regulates dealing in securities and the entities that do it. The other regulates arrangements that move money between parties. Most firms in India sit clearly in one of the two, and neither rulebook was written with a signpost to the other for exactly that reason. The firms sitting in both are common enough to matter and scattered enough that nobody wrote them a signpost.

The position is ordinary rather than exotic. A broker moving client money is in both. A firm that runs a payment arrangement and also deals in securities is in both. Anasuya Kolhapure, buying and selling through Bhadra Securities and funding that account from a payment arrangement, is standing at the join without ever once thinking about it. From where she stands, that is exactly how it should feel.

What is expected when a payment system stops working?

Something written down long before the day it is needed. The answer is that short, and the reasoning behind it is worth more than the answer itself.

A continuity expectationWhat is required of a system when something disrupts it, including what must already exist in writing before the disruption happens. is a requirement about what happens when something disrupts a system: who decides, who is told, in what order they are told, how the arrangement returns to normal, and what gets recorded while all of that is going on. The requirement exists in advance. Nobody creates it during the disruption, and nobody drafts the document on the day.

Ask why it works that way and the answer is almost embarrassingly plain. The moment a system stops is the moment nobody has any time to decide anything. Every hour that follows is spent by people who are tired, partly informed and being asked questions by three parties at once. Decisions taken in that hour are worse than decisions taken in a quiet room six months earlier, and everybody involved knows it. The requirement sits where it sits for precisely that reason.

The household version is the list of numbers taped inside a cupboard door. Nobody writes that list during a fire. The list is written on an afternoon when nothing at all is wrong, by somebody who had the time to think about who should be called first, and its entire value comes from having existed before it was needed.

Reporting a disruption belongs to the same rulebook and the same body. The Reserve Bank of India sets what must be reported, in what form and how quickly, and all of it is read at rbi.org.in. The timing requirement in particular is the one a reader most wants and the one a reader is most likely to be handed in a stale version by somebody who half remembers it.

What is reported, and who is it reported to?

Reports run upward to the body that authorised the arrangement, and they run there whether or not anybody has asked for them. Three kinds sit under the single word reporting, and separating them removes most of the confusion people carry about it.

The first kind is periodic. Something goes at a stated interval about how the system is running, and it goes because the interval arrived rather than because a question was asked. The second is event driven. Something happens, and the happening itself creates the obligation to report it. The third is a response to a specific enquiry, arriving with somebody's name on it and a person waiting at the other end. Most firms genuinely feel only that third kind.

An entity that has never been asked anything is not thereby an entity with nothing to report, and that sentence catches more firms in this area than any other. A periodic obligation does not wait for a request. Silence from the regulating body is not a statement that a firm is up to date; it is only silence, and reading it as approval is a habit that ends badly and slowly.

The two rulebooks reappear here in their least forgiving form. Reporting something to the securities body about a securities matter does not discharge an obligation on the payments side, and reporting to the payments side discharges nothing on the securities one. The two are not two windows at the same counter. Each is a counter in a different building, and each keeps its own record of what was handed over and when.

The Reserve Bank of India publishes what must be reported, how often and in what format at rbi.org.in, and the Securities and Exchange Board of India publishes the same for its own side at sebi.gov.in. Both are revised, and both are read at the source on the day the answer matters.

Where is every requirement in this area actually read?

Two sites carry almost everything anybody working in this area will need. The Reserve Bank of India publishes the governing law, the directions issued under it, and the lists of entities authorised to operate payment systems, all at rbi.org.in. The Securities and Exchange Board of India publishes the securities side at sebi.gov.in, on the far side of the boundary between the two.

But the site is the third step and not the first, and the ordering is what makes the difference in practice. Before anything is opened, the arrangement is described in plain words, without the firm's own vocabulary about itself. Then the description is placed in one rulebook or the other: is this about dealing in securities, or about the movement of money between parties? Only then is a site opened.

Searching first and classifying afterwards is how careful people conclude there is no rule. A search engine matches words. The engine holds no view about which rulebook the search is in, and it returns an empty result with exactly the same confidence it returns a full one. An empty result on the wrong site is indistinguishable, on the screen, from a complete answer.

One more habit is worth forming. The version date of whatever is opened is compared with the date any secondary account records for its own reading, and that consulted date sits in the block below. A secondary account is a map of where things are kept. The live text is the thing itself, and the two are never confused by anybody who has been caught out once.

How does a compliance officer, a technology lead or a household use this?

Three people use the two rulebook idea every week, for three different reasons, and seeing all three is what turns it from a fact into a working habit.

Yashodhan Pai, the compliance officer at Bhadra Securities Private Limited, uses it to sort. The document he must read, the site he must open and the body he will eventually answer to all differ from the moment a question is classified, so every question that reaches him is classified before it is worked on. He also keeps a plain written list of which arrangements the firm runs and which it merely takes part in. Those are two different positions carrying two different sets of duties, and nobody else in the firm has any reason to maintain the distinction.

Sumana Rege, who runs technology at the same firm, uses it in a way that is less obvious and worth far more. The definition looks at how an arrangement moves money between parties, and a release can change precisely that, so a technology change can move an arrangement across the definition line without a single person intending it. A change to what a system does with money is a question for the payments rulebook before it is a line in a release note. A firm where the technology side never asks that question will one day be told the answer by somebody outside it.

An analyst reading a firm from the outside uses it to see what the firm actually is. A business described in a single line may be standing in two rulebooks. Two rulebooks mean two sets of obligations, two sets of things that can go wrong, and two bodies' worth of correspondence sitting in the file. None of that is visible in a description, and all of it becomes visible the moment somebody asks which arrangements the firm runs and which ones it merely participates in.

And a household uses this once, on a bad day, so it has to be learned on a good one. When money is stuck inside a payment arrangement, the difference between a person who knows which body stands behind that arrangement and a person who does not is the difference between a letter that reaches somebody and a letter that is filed politely somewhere it can do nothing at all. Anasuya Kolhapure may use this knowledge twice in her life, and on both occasions it will matter more to her than any other fact about the two rulebooks.

Setu Payments Private Limited, Setu Wallet, Bhadra Securities Private Limited, Anasuya Kolhapure, Yashodhan Pai and Sumana Rege are invented.
Educational material. Not advice on any investment, tax, budget or market position.