Advice for fintechs and businesses issuing wallets, prepaid cards and gift instruments.
If your wallet or prepaid card can be used anywhere other than your own business, you need RBI authorisation. We help you choose the right PPI category, qualify and get licensed, with the 2026 draft rules in mind.
A prepaid payment instrument (PPI) stores value that the holder pays in advance and then spends on goods, services or transfers. Wallets, prepaid cards, gift cards and transit cards are all PPIs. They are governed by the RBI’s Master Directions on Prepaid Payment Instruments, issued in 2021 and most recently updated on 30 September 2026.
Whether you need a license turns on one question: where can the value be spent?
This is a closed system PPI, such as store credit or an in-app balance usable only with you. The RBI does not treat it as a payment system, so no authorisation is needed.
This needs RBI authorisation under the PSS Act. Non-banks apply to the RBI, and banks need RBI approval.
Many products start closed and drift open. A loyalty balance becomes usable at partner brands, or a corporate meal card gets accepted at third-party cafés. The moment value can be spent outside your own business, you are issuing a regulated PPI.
These are separate licenses. A wallet business that also wants to collect payments for merchants generally needs both authorisations, and funds from the two businesses cannot be mixed.
See our payment aggregator pageChoosing the PPI type is a product decision as much as a legal one, because it fixes your KYC journey, your limits and what customers can do with their balance. Under the current Master Directions:
On 22 April 2026, the RBI released draft PPI Directions to replace the 2021 framework. As of October 2026, they have not been finalised. The main proposals:
If you are designing a product now, build it so it can move to the final rules without a rebuild. We track the draft and will update this page when the final Directions are issued.
The ₹5 crore entry point is a third of what a payment aggregator needs, which is why many fintechs start with a PPI. The ₹15 crore target three years later is the number to plan your fund raising around.
Under the Companies Act, with PPI issuance covered in its MoA
At application, shown in the latest audited balance sheet and certified in the RBI’s format. A newly incorporated company can use a provisional balance sheet.
By the end of the third financial year after final authorisation, then maintained at all times
Companies with foreign investment must also meet the capital requirements of the FDI policy and the RBI’s rules on investment from FATF non-compliant jurisdictions
Entities such as an NBFC need a no-objection certificate from that regulator first
You file Form A under the PSS Regulations on the RBI’s PRAVAAH portal, with the fee, the net worth certificate and director declarations.
The RBI checks prima facie eligibility and fit-and-proper status. Incomplete applications are returned, and the fee is not refunded.
In that time, you build the system and submit a satisfactory System Audit Report, with a CA certificate on net worth. One extension of up to six months may be requested.
You must start business within six months of receiving it. The certificate is valid perpetually, subject to compliance.
One-year cooling period. If the RBI rejects an application, or a certificate is surrendered or revoked, a one-year cooling period applies. During that time, the entity and new entities set up by the same promoters cannot apply to operate any payment system.
The RBI reviews these during the in-principle stage and the system audit, so they need to be built into the product, not added after launch.
A non-bank issuer keeps customer money in an escrow account with a scheduled commercial bank, with an optional second escrow at another bank. At the end of each day, the balance must at least equal the value of all outstanding PPIs plus amounts due to merchants. Loads must reach escrow by close of business on the same day. Your auditor certifies this every quarter, within a fortnight of quarter end, and every year. After a year of audited operations, a “core portion” of the balance can earn interest. Customers themselves are never paid interest on PPI balances.
The RBI’s KYC Master Direction and the PMLA apply in full. You keep transaction logs for at least ten years and file suspicious transaction reports with FIU-IND.
Full-KYC PPIs must work across UPI, for wallets, or card networks, for cards. You need a board-approved interoperability policy. The RBI updated this requirement in September 2026.
Wallet debits need two-factor authentication. Cards must be EMV chip and PIN. You need velocity checks, transaction alerts showing the remaining balance, a cooling period after loads and new beneficiaries, and an annual system and cyber audit by a CERT-In empanelled auditor.
You need a published grievance framework with a nodal officer. Complaints should be addressed within 48 hours and resolved within 30 days. A customer who reports an unauthorised transaction within three days of a third-party breach bears zero liability. You must credit disputed amounts within 10 days and resolve the case within 90.
Every PPI must stay valid for at least one year from its last load. Holders get warnings during the 45 days before expiry. Expired balances cannot go to profit and loss for at least three years.
From the first classification question to life after launch.
Before anything else, we look at how your balance is loaded, where it can be spent and whether it can be withdrawn or transferred. Then we tell you in writing whether you are issuing a closed system PPI, a regulated PPI or something else, such as a PA product or a co-branded card that a bank issues.
We help your product team pick between Small, Full-KYC and special purpose PPIs, with the KYC journey, limits and upgrade path mapped out. Where the draft 2026 Directions would change the answer, we flag it.
This covers the MoA, the net worth plan for both the ₹5 crore and ₹15 crore thresholds, and the FDI and FATF review. We draft the board-approved policies, from issuance and KYC to agents, co-branding, interoperability, information security, grievance redressal and customer liability. We file Form A on PRAVAAH and handle the RBI’s queries, then manage the system audit within the six-month in-principle window.
We review and negotiate the escrow agreement, the sponsor bank arrangements for UPI and card network participation, and co-branding agreements.
We can support you with quarterly escrow certificates, annual filings, inspections, changes in control, and moving to the final 2026 Directions once they are notified.
Can’t find what you’re looking for? Ask us directly and a member of our payments team will reply.
Ask a questionTell us where the balance can be spent, how it is loaded and whether users can transfer or withdraw it. We will tell you whether you need a PPI license, which type fits your product and what the draft 2026 rules mean for your launch.
You’ll hear from us within 30 minutes.