# India and Brazil: the RBI and BCB payment regimes

> How the RBI Payment Aggregator Directions 2025 and Banco Central's 2025-26 resolutions reshaped market entry: PA and PA-CB licensing, the four Brazilian payment institution types, UPI and Pix access, zero MDR economics, RBI data localisation and the new PSAV regime for virtual assets.

Author: Ksenia Voronova — Lawyer, Family Office (https://wiki.private.law/en/authors/voronova)
Last modified: 2026-08-21T15:13:00.000Z
Canonical: https://wiki.private.law/en/india-brazil-payments
Topics: banking
Jurisdictions: global
Product tags: banking, compliance, crypto, stablecoin
Semantic tags: banking, compliance, crypto, stablecoin

---

India and Brazil built their payment infrastructure in a way neither Europe nor the United States has replicated: the state built the instant retail rails, handed them to the market free or nearly free, and kept the right to decide who connects. UPI processed 23.66 billion transactions worth ₹29.88 trillion in July 2026 — up 22% by volume and 19% by value year on year, per NPCI data reported by Business Standard on 1 August 2026. Pix moved almost 80 billion transactions and R$35 trillion during 2025, growth of 25.7% and 33.8% respectively, per the Banco Central's Relatório de Gestão do Pix published on 10 August 2026.

Both countries rewrote the rules for intermediaries within the past year, and both rewrote them in the same direction — narrower. On 15 September 2025 the Reserve Bank of India replaced four years of accumulated circulars with a single Master Direction and, for the first time, pulled offline acquiring inside the authorisation perimeter. On 5 September 2025 Banco Central abolished the volume thresholds that had let a small payment institution operate with no licence at all. Between them, these two changes make most of the English-language commentary on these markets obsolete.

What follows is what is actually required, what the published rules say it costs, where sources conflict, and why a foreign entrant in either country ends up as either a locally incorporated licensee or somebody else's customer.

## India: the aggregator is licensed, the gateway is not

The statutory base is the Payment and Settlement Systems Act 2007. The operative instrument is the Reserve Bank of India \(Regulation of Payment Aggregators\) Directions, 2025, RBI/DPSS/2025-26/141 of 15 September 2025. It repealed the guidelines of 17 March 2020 and 31 March 2021, the PA-CB circular of 31 October 2023, and the three A.P. \(DIR Series\) circulars of 2010, 2013 and 2015 on which the old cross-border regime rested.

The Direction draws the PA/PG line on a single test: whether the intermediary touches the money. A Payment Aggregator "facilitates aggregation of payments made by customers to the merchants... and subsequently settles the collected funds to such merchants." A Payment Gateway "provides technology infrastructure to route and facilitate processing of a payment transaction without any involvement in handling of funds."

That produces a conclusion secondary sources routinely invert: **a payment gateway is not licensable in India.** Paragraph 10\(g\) states that a PG "shall not fall within the scope of this MD"; only advisory security recommendations are addressed to it. Headlines announcing that the RBI "licenses payment gateways" describe a regime that does not exist. The practical corollary runs the other way and is less comfortable: the moment a provider receives funds into its own account it is a PA, and operating without authorisation is unlawful regardless of self-description. This is the same fork over who actually receives the money that runs through [PayFac, ISO and merchant of record](https://wiki.private.law/en/payfac-vs-iso), but framed by the enforcement machinery of the PSS Act.

There are three PA categories: PA-Online, PA-Physical \(both the acceptance device and the instrument physically present\) and PA-Cross Border. Capital is uniform across all three under paragraph 6\(a\): net worth of ₹15 crore at the time of application, rising to ₹25 crore by the end of the third financial year following authorisation. A non-bank PA must be a company incorporated in India under the Companies Act 2013 — paragraph 5\(c\). Banks need no authorisation at all — paragraph 5\(a\).

The structural change of 2025 is offline. PA-P previously sat outside the perimeter. An entity carrying on only PA-P business had to apply by 31 December 2025; one that did not was required to notify its banker and wind the business down by 28 February 2026.

| **Requirement** | **RBI Directions 2025** |
| --- | --- |
| Net worth at application | ₹15 crore |
| Net worth by end of third FY | ₹25 crore |
| Form of applicant | Company incorporated in India under the Companies Act 2013 |
| Escrow | Separate account with a scheduled commercial bank in India; opened within 2 months of authorisation |
| Interest on escrow | Core portion only — lowest fortnightly average across the preceding 26 fortnights |
| Merchant settlement | No fixed T+N; by agreement, which must be "fair, equitable" and state timelines transparently |
| Simplified merchant due diligence | Turnover up to ₹40 lakh \(exports up to ₹5 lakh\): PAN, physical address verification, one certified OVD copy |
| PA-CB per-transaction cap | ₹25 lakh |
| NOC from another regulator | File with RBI within 45 days of receipt |

Paragraph 13\(a\) requires merchant records to be pulled from the Central KYC Registry with the merchant's consent; merchants onboarded up to 31 December 2025 had one year to be brought into line, and from 1 January 2026 the requirement applies in full — paragraph 13\(j\). In practice this means re-papering the whole book rather than new connections only, an exercise comparable in scale to rebuilding the [compliance stack](https://wiki.private.law/en/compliance-stack) from scratch.

## India: the cross-border perimeter after OPGSP

Until late 2023 export and import internet payments ran under the OPGSP regime: the provider held no RBI authorisation of its own, operated under a standing arrangement with an AD Category-I bank, and the bank carried the compliance burden. The caps were dollar-denominated and low — USD 10,000 per transaction on exports and just USD 2,000 on imports, with imports covering goods and software only, not services.

PA-CB inverted the structure. The non-bank intermediary now holds the authorisation itself and answers to the RBI directly, and the cap is rupee-denominated and uniform at ₹25 lakh per transaction in either direction. For export flows that is roughly a tenfold increase; for imports it is two orders of magnitude, alongside the removal of the goods-only restriction. Analysis that still quotes the USD 10,000 and USD 2,000 thresholds is describing repealed circulars.

Fund segregation is absolute: a separate Inward Collection Account and a separate Outward Collection Account, with "no co-mingling of funds or netting off for outward and inward transactions... permitted under any circumstance." A PA-CB may buy or sell foreign currency only through an Authorised Dealer; it has no independent FX access. Settlement in non-INR currencies is permitted only for Indian exporters the PA-CB has onboarded directly.

As of January 2026, 19 companies held full PA-CB licences, per Winvesta's tally: Cashfree Payments first in July 2024, then Amazon Pay India, BillDesk and Adyen, followed by a late-2025 wave including Razorpay, PayU, Pine Labs, Easebuzz, Airpay, Paytm and Mswipe. PayPal received in-principle approval in May 2025 for the export leg only; Payoneer India in January 2026. No PA-CB-specific rejections have been publicly announced.

The binding constraint on a foreign entrant is form, not capital. A foreign entity cannot hold PA authorisation directly; an Indian company is required. Foreign direct investment into that company is permitted but governed by the Government of India's Consolidated FDI Policy — paragraph 6\(d\). Hence the standard route: an Indian subsidiary, separate registration with FIU-IND, escrow at an Indian bank. The alternative is operating through an already-licensed local partner, which is precisely the arrangement whose risks are set out in [renting a licence](https://wiki.private.law/en/license-for-rent): the regulator sees the holder of the authorisation, not the beneficiary of the revenue.

Data is a separate barrier. Circular RBI/2017-18/153 of 6 April 2018 requires that "the entire data relating to payment systems operated by them are stored in a system only in India," with compliance due by 15 October 2018 and a CERT-IN system audit report by 31 December 2018. There is no mirroring exemption: an offshore copy is tolerated where processing occurs abroad, but the original must return to India and be purged from the foreign system. For a global processing platform that means a dedicated Indian stack, not a regional shard.

Layered on top is the Master Direction on Cyber Resilience and Digital Payment Security Controls for non-bank PSOs, RBI/DPSS/2024-25/123 of 30 July 2024. Payment aggregators sit in the "large" PSO category, for which the requirements applied from 1 April 2025; medium PSOs from 1 April 2026 and small from 1 April 2028. Cyber incidents must be reported to the RBI within six hours of detection.

## India: UPI, the market-share cap, and the economics of zero MDR

UPI is owned and operated by NPCI. A non-bank application — a Third-Party Application Provider — does not connect to UPI directly. In [NPCI's own wording](https://pay.google.com/intl/en_in/about/external/npci/), "TPAP is a service provider to the PSP and participates in UPI through PSP," where the PSP is a bank that is a member of UPI. The app owns the customer interface; the bank owns membership of the payment system. Both PSP and TPAP must additionally store all UPI payment data only in India.

Above that sits the market-share ceiling: no single TPAP is to exceed 30% of transaction volume. On 31 December 2024 NPCI pushed the effective date to December 2026, the second such extension. The rule remains unenforced: no mechanism for compelling a reduction has been published, and the leaders' actual shares sit well above the cap. For an entrant the ceiling cuts both ways — it offers no protection today, but it supplies the regulatory basis for a future redistribution of volume.

UPI's economics rest on zero MDR: merchant discount rates on person-to-merchant transactions are prohibited. Compensation comes from the budget. On 19 March 2025 the Union Cabinet [approved a scheme](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2112771&reg=48&lang=2) with an outlay of ₹1,500 crore for financial year 2024-25: an incentive of 0.15% of transaction value, applying only to transactions up to ₹2,000 and only for small merchants. Large merchants receive nothing. The 2026 Budget allocated ₹2,000 crore for FY27 and left MDR at zero.

This is where the sharpest divergence from the received account appears. The Parliamentary Standing Committee on Finance, drawing on a Department of Financial Services reply of 17 July 2026, recorded that the ₹2,000 crore allocation covers only about 11% of the industry's estimated ₹20,700 crore in UPI operating costs. In the same reply the DFS named two options under consideration: a tiered incentive structure phasing out government support over the next few years, and "examining the feasibility of restoring MDR for certain high-threshold transactions/merchants." The Finance Minister subsequently clarified that any MDR would apply "only to a limited category of merchant transactions above a high threshold," with consumer UPI remaining free. Neither option had been notified as of 20 August 2026. Zero MDR, presented in most market commentary as a settled feature of the Indian landscape, is officially discussed as a temporary construct funded to roughly one-ninth of its cost.

## India: prepaid instruments

The operative instrument is the Master Direction on Prepaid Payment Instruments of 27 August 2021, as updated on 27 December 2024. A small PPI: no more than ₹10,000 outstanding at any point, ₹10,000 loaded per month and ₹1,20,000 per year. A full-KYC PPI: up to ₹2,00,000 outstanding, with mandatory interoperability through authorised card networks and UPI. Gift PPIs are capped at ₹10,000 and mass transit PPIs at ₹3,000. A non-bank issuer needs positive net worth of ₹5 crore at application, rising to ₹15 crore by the end of the third financial year.

On 24 April 2026 the RBI issued a draft replacement Master Direction with comments due by 22 May 2026. The draft keeps the ₹2 lakh full-KYC ceiling but adds sub-limits absent from the current text: a ₹2 lakh monthly debit limit, ₹25,000 per month on peer-to-peer transfers, ₹10,000 per month on cash loading, and a ₹5 lakh monthly debit limit for foreign nationals and NRIs. As of 20 August 2026 the draft remains a draft; its limits cannot be treated as operative law.

## Brazil: four types of payment institution, and the end of thresholds

The framework comes from Lei 12.865/2013, with detail in Resolução BCB nº 80 of 25 March 2021. Article 3 defines four modalities: emissor de moeda eletrônica \(prepaid accounts\), emissor de instrumento de pagamento pós-pago \(post-paid instruments\), credenciadora \(acquiring, onboarding merchants without maintaining accounts\) and iniciador de transação de pagamento \(payment initiation, holding neither accounts nor funds\).

Until September 2025 authorisation was not universal. Articles 10 to 13 set a descending ladder: an e-money issuer became subject to authorisation at R$500 million in transactions or R$50 million in stored balances through 2021, R$300 million and R$30 million for 2022-2024, R$250 million and R$25 million in 2025, falling to R$100 million and R$10 million by 2028; post-paid issuers and acquirers faced a R$500 million threshold.

**That ladder no longer exists.** Resolução BCB nº 494 of 5 September 2025 amended Article 9, inserted Article 9-A, and revoked Articles 10, 11, 12 and 13 in their entirety. Brazilian practitioners put it plainly: the resolution "revoked the financial-volume and transaction-count criteria that allowed a payment institution to operate without prior BCB authorisation," and now "every payment institution, in order to commence activities in the country, must be previously authorised by the regulator." Existing unlicensed operators have a single filing window, 1 to 31 May 2026, and those who miss it may continue for a further 30 days only. English-language surveys still describing Brazil as a market with a R$500 million threshold are describing repealed rules.

Capital has been rewritten too. Resolução Conjunta nº 14 and Resolução BCB nº 517 of 3 November 2025 replaced the old fixed amounts \(R$2 million per modality, R$1 million for initiators\) with a two-part formula. The fixed component is R$2 million for each declared activity category, plus R$5 million where the institution provides technology-intensive services and up to R$10 million where several are combined; Banking as a Service, Open Finance data aggregation and Pix transactional accounts are all classed as technology-intensive. The variable component depends on activity: R$1 million for service, R$3 million for custody and administration, R$5 million for intermediation, R$7 million for lending, plus R$5 million or R$8 million for restricted and unrestricted investment activity. The result is multiplied by a funding factor — 60% for own resources, 80% for institutional, 120% for non-deposit public funds and 200% for deposits. A separate R$30 million surcharge applies to institutions using "banco" in their name.

The transition is staged: the previous minimum applies until 30 June 2026, then 25% of the positive difference is added, 50% from 1 January 2027, 75% from the second half of 2027, and full compliance from 1 January 2028.

Resolução BCB nº 495 added a governance layer: at least three directors, terms capped at four years, a formal governance policy reviewed every two years — and a requirement that the head office be premises in exclusive use, which rules out a coworking desk as a registered address. In parallel, Resolução BCB nº 518 and Resolução CMN nº 5.261 of 3 November 2025, effective 1 December 2025, mandate compulsory closure of "contas-bolsão" — accounts through which third-party funds move under someone else's name, including where they support "acting as a financial or payment institution without authorisation." For a foreign fintech accustomed to entering through a local partner's pooled account, this closes the cheapest door; account access for a licensed operator is treated separately in [banking for licensed operators](https://wiki.private.law/en/banking-for-msb).

Enforcement is measurable. Data obtained by Estadão under Brazil's freedom-of-information law and published on 27 May 2026 show that between January and April 2026 the BCB denied eight payment institutions, authorised five, received 26 new applications and archived four proceedings; for the whole of 2025 the figures were 6 denials, 35 authorisations, 82 applications and 23 archived files. The maximum review period is 360 days. Grounds for refusal: failure to demonstrate economic and financial viability, deficiencies in fraud and anti-money-laundering controls, and inadequate regulatory adherence by firms already trading.

## Brazil: Pix — mandatory participation, refunds, and the roadmap

Pix is governed by Resolução BCB nº 1 of 12 August 2020. Article 3 makes participation compulsory for BCB-authorised financial and payment institutions with more than 500,000 active client accounts; an institution crossing that line must file to join within 90 days. Others participate voluntarily. Article 3-A requires non-cooperative participants providing transactional accounts to hold minimum paid-in capital and equity of R$5 million from 1 January 2026.

At the end of 2025 Pix had 926 participating institutions, up 5.6% on the year. The structural shift matters more than the count: payment institutions now account for 50% of payer-side transactions against 25.5% in 2020, while universal banks have fallen to 35% from 55.8%. State-built rails reallocated half the payment flow from banks to non-banks in five years — an outcome European open banking has not produced in any jurisdiction, and a central exhibit in the wider argument about where the [regulatory perimeter is moving](https://wiki.private.law/en/regulatory-perimeter-trends).

Scale at end-2025: 920 million registered keys \(875.4 million held by individuals, 44.7 million by businesses\); 148.3 million individuals made or received at least one Pix in December, roughly 86% of the adult population, alongside 12.8 million businesses or 51.4% of active companies. The single-day record is 313,339,328 transactions on 5 December 2025; the single-day value record is R$193.4 billion on 19 December.

Refunds run through MED, the Mecanismo Especial de Devolução. Under the [BCB implementation guide](https://www.bcb.gov.br/content/estabilidadefinanceira/pix/Guia_MED.pdf) a claim may be opened on transactions no older than 80 days; the receiving institution has 7 calendar days to analyse a fraud notification and 6 hours to execute the refund once the request arrives, or 48 hours to return funds where the cause was operational failure. Precautionary blocking runs up to 72 hours. Where fraud is confirmed and the funds are gone, the loss sits with the receiving PSP; the paying PSP is not required to make the customer whole from its own resources.

The Pix roadmap for 2026 and 2027 rewards careful reading, because market commentary runs ahead of it. Pix Automático — recurring debits under standing customer consent — is live, as is Pix por aproximação \(NFC\), launched in February 2025. MED 2.0 went into production on 11 May 2026 with self-service enhancements due in October 2026; hybrid boleto-plus-Pix billing and Pix Automático integration with salary accounts also land in October 2026. But **Pix parcelado was still recorded as "em discussão" as of December 2025 — no normative rules exist, and the release has moved to the 2027 agenda alongside Pix Internacional and Pix em Garantia.** There is nothing to build an instalment product on in 2026.

## Brazil: virtual assets under BCB supervision

Lei 14.478/2022 set the framework and designated the BCB as regulator of virtual asset service providers. The rules themselves arrived only in November 2025 — Resoluções BCB 519 \(authorisation procedure\), 520 \(conditions of operation\) and 521 \(the foreign exchange perimeter\). Resolutions 519 and 520 take effect on 2 February 2026; 521 does likewise, except for provisions on special operations and foreign capital, which apply from 4 May 2026.

There are three modalities: intermediária \(order execution, staking, market-making\), custodiante \(holding private keys and instruments of control over virtual assets\) and corretora, a hybrid combining both. Minimum capital is not fixed per modality: it is calculated from the set of activities performed and the risk profile and, per Matera's summary, falls between R$10.8 million and R$37.2 million. The BCB has not published a per-modality breakdown — searching for one yields a formula, not a table.

Transition: existing providers have 270 days from entry into force, so until roughly early November 2026, to file for authorisation; those that do not must cease within 30 days of the window closing. Foreign institutions have the same 270 days either to transfer operations to an authorised Brazilian provider or to withdraw. That provision is unusually hard-edged: serving Brazilian clients cross-border without local authorisation is not contemplated after autumn 2026.

The most consequential change is the foreign exchange classification. Operations in virtual assets referenced to fiat currency are brought into the FX market: [a stablecoin in Brazilian law is no longer merely a token](https://wiki.private.law/en/stablecoins) but an instrument of a foreign exchange operation, with the reporting that entails. International payments and transfers using virtual assets are capped at USD 100,000 where the counterparty is not an institution authorised to operate in the FX market. Transfers to self-custody wallets remain permitted, but the provider must identify the wallet's owner and verify the origin and destination of the assets — effectively a national implementation of [Travel Rule](https://wiki.private.law/en/travel-rule) logic, extended to self-custody.

One question stays open: how the limits and reporting will apply to mixed scenarios. Information collection on FX operations involving virtual assets begins on 4 May 2026, and no supervisory practice exists as at the date of publication.

## The entry route and what it costs

| **Step** | **India** | **Brazil** |
| --- | --- | --- |
| Form of presence | Company under the Companies Act 2013 is mandatory; a foreign entity cannot hold the authorisation | Brazilian S.A. or Ltda. required; single natural-person ownership prohibited |
| Foreign capital | Permitted, governed by the Consolidated FDI Policy | No presidential decree since 2019: Decreto 10.029 transferred recognition of foreign participation to the BCB |
| Capital | PA — ₹15 crore at application, ₹25 crore by end of third FY; PPI — ₹5 crore and ₹15 crore | Formula under Res. Conjunta 14/2025; full application from 1 January 2028 |
| Review period | Not fixed by rule; a year or more in practice | Up to 360 days |
| Mandatory filing window | PA-P — by 31 December 2025 | Existing unlicensed payment institutions — 1 to 31 May 2026 |
| Data | Storage in India only \(circular of 06.04.2018\) | No general localisation mandate; LGPD and outsourcing rules apply |
| Access to the instant rails | Only through a PSP bank; a TPAP cannot connect directly | Direct participation once authorised; R$5 million capital from 01.01.2026 |

On project budgets, an honest caveat: neither the RBI nor the BCB publishes an application fee in the way NMLS or MAS does. What is published, and therefore verifiable, is the capital requirement. Anything described as the "cost of the licence" in advisory material is a market estimate, not a regulator's tariff.

## Common mistakes

**Treating gateway operation as licensable in India — and, conversely, assuming "we are only a technology provider" is a defence against the PA regime.** Paragraph 10\(g\) puts PG outside the Direction, but the dividing line is the handling of funds, not the label. Once merchant money hits the company's account, the technology provider has become an unregistered PA.

**Planning Brazilian entry around thresholds abolished in September 2025.** The "start unlicensed, apply once we approach R$500 million" plan no longer works: authorisation must precede activity, and the only window for firms already trading closes on 31 May 2026.

**Treating mirrored data as compliance with the Indian localisation mandate.** The requirement is that the original be stored in India only. A regional shard in Singapore with a Mumbai copy does not satisfy it.

**Building Indian unit economics on merchant fees over UPI.** P2M MDR is zero, and the subsidy reaches only small merchants, only on transactions up to ₹2,000, at 0.15%. Revenue has to come from adjacent products, not interchange.

**Routing Brazilian flows through a partner's pooled account.** Since 1 December 2025 such accounts are subject to compulsory closure where third-party funds move through them or unauthorised payment activity is being conducted.

**Mistaking a draft for a rule.** India's April 2026 PPI draft and Brazil's Pix parcelado are both quoted as operative requirements. Neither is.

## Scenarios

**Collecting payments from Indian buyers for foreign goods or services.** This is the inward leg of PA-CB. Holding the authorisation directly means an Indian company, ₹15 crore of net worth and a dedicated Inward Collection Account. The faster route is to connect as a merchant to one of the 19 existing PA-CB holders, accepting that their compliance regime and the ₹25 lakh per-transaction cap come with it.

**Paying Indian contractors or exporters.** The outward leg of PA-CB, with a separate Outward Collection Account and an absolute prohibition on netting against inward flow. The FX leg runs only through an Authorised Dealer.

**Launching a wallet or card product in India.** This is the PPI regime, not PA: ₹5 crore at application and ₹15 crore by the end of the third year, with mandatory interoperability of full-KYC instruments across card networks and UPI. Work to the 2021 limits while tracking finalisation of the 2026 draft.

**Running a Brazilian account or acquiring business.** One of the four modalities under Res. 80/2021, authorisation mandatory regardless of volume, capital calculated under the Res. Conjunta 14/2025 formula with full application by 2028, and a head office in premises of exclusive use.

**Initiating payments in Brazil without touching funds.** The iniciador de transação de pagamento modality has historically been the cheapest on capital and the closest analogue to a European PIS licence; the capital reform narrows that advantage without eliminating it.

**Serving Brazilian clients in virtual assets.** File for PSAV authorisation before early November 2026; after that, either hold the authorisation or transfer the book to a local licensee. The cross-border model without a Brazilian entity is being closed.

**Comparing both regimes against the alternatives.** The broader framework for choosing a jurisdiction and matching licence categories sits in the [map of financial licences](https://wiki.private.law/en/fintech-license-map).

> 🍓 India and Brazil built state-owned instant rails and closed the side doors to them at the same time. On 15 September 2025 the RBI consolidated everything into one Master Direction, pulling offline acquiring inside the perimeter for the first time while leaving the payment gateway outside it — the boundary runs on the handling of funds, not on what a firm calls itself. On 5 September 2025 Banco Central abolished the thresholds that permitted unlicensed operation and opened a single filing window from 1 to 31 May 2026. In both countries a foreign entity cannot hold the authorisation directly: a local company, local capital and — in India — local data are prerequisites. The economics are more fragile than commonly assumed: the subsidy underwriting zero MDR covers roughly 11% of UPI's industry cost, and restoring MDR for large merchants is formally under study.

## Q/A

### **Does a firm that only routes payments and never holds funds need an RBI licence?**

No. Paragraph 10\(g\) of the 2025 Master Direction expressly places a Payment Gateway outside its scope, leaving only advisory security recommendations. But the boundary is the handling of funds: if merchant money lands in the company's account even briefly, the firm is a Payment Aggregator, and operating without authorisation breaches the Payment and Settlement Systems Act 2007. The legal characterisation controls, not the product description.

### **Can a firm enter the Brazilian market unlicensed while volumes remain small?**

Not since September 2025. Resolução BCB nº 494 revoked Articles 10 to 13 of Resolução BCB nº 80/2021, which contained the threshold ladder running from R$500 million down to R$100 million, and made prior authorisation compulsory for every payment institution regardless of size. Firms already trading have a single filing window from 1 to 31 May 2026, plus 30 days of continued operation after it closes for those who miss it.

### **What stops a foreign application from connecting directly to UPI?**

The access architecture. NPCI owns and operates UPI, and a third-party application participates only through a PSP bank — the bank is the member of the system, not the app. Both PSP and TPAP must also store all UPI payment data exclusively in India, which requires a dedicated Indian processing stack. A 30% volume ceiling per application also formally applies, with the effective date pushed by NPCI to December 2026.

### **What is actually available in Pix as of late 2026, and what is not?**

Pix Automático \(recurring debits under standing consent\) and Pix por aproximação \(NFC, since February 2025\) are live. MED 2.0 went into production on 11 May 2026, with self-service enhancements and hybrid boleto-plus-Pix billing due in October. Pix parcelado was still under discussion with no normative rules as of December 2025 and has moved to the 2027 agenda, alongside Pix Internacional and Pix em Garantia. There is no basis for planning an instalment product on Pix during 2026.

---

## FAQ

### Does a firm that only routes payments and never holds funds need an RBI licence?

No. Paragraph 10(g) of the 2025 Master Direction expressly places a Payment Gateway outside its scope, leaving only advisory security recommendations. But the boundary is the handling of funds: if merchant money lands in the company's account even briefly, the firm is a Payment Aggregator, and operating without authorisation breaches the Payment and Settlement Systems Act 2007. The legal characterisation controls, not the product description.

### Can a firm enter the Brazilian market unlicensed while volumes remain small?

Not since September 2025. Resolução BCB nº 494 revoked Articles 10 to 13 of Resolução BCB nº 80/2021, which contained the threshold ladder running from R$500 million down to R$100 million, and made prior authorisation compulsory for every payment institution regardless of size. Firms already trading have a single filing window from 1 to 31 May 2026, plus 30 days of continued operation after it closes for those who miss it.

### What stops a foreign application from connecting directly to UPI?

The access architecture. NPCI owns and operates UPI, and a third-party application participates only through a PSP bank — the bank is the member of the system, not the app. Both PSP and TPAP must also store all UPI payment data exclusively in India, which requires a dedicated Indian processing stack. A 30% volume ceiling per application also formally applies, with the effective date pushed by NPCI to December 2026.

### What is actually available in Pix as of late 2026, and what is not?

Pix Automático (recurring debits under standing consent) and Pix por aproximação (NFC, since February 2025) are live. MED 2.0 went into production on 11 May 2026, with self-service enhancements and hybrid boleto-plus-Pix billing due in October. Pix parcelado was still under discussion with no normative rules as of December 2025 and has moved to the 2027 agenda, alongside Pix Internacional and Pix em Garantia. There is no basis for planning an instalment product on Pix during 2026.

---

## Factual claims

- The statutory base is the Payment and Settlement Systems Act 2007.
- The structural change of 2025 is offline.
- Until late 2023 export and import internet payments ran under the OPGSP regime: the provider held no RBI authorisation of its own, operated under a standing arrangement with an AD Category-I bank, and the bank carried the compliance burden.
- Layered on top is the Master Direction on Cyber Resilience and Digital Payment Security Controls for non-bank PSOs, RBI/DPSS/2024-25/123 of 30 July 2024.
- Above that sits the market-share ceiling: no single TPAP is to exceed 30% of transaction volume.
- The operative instrument is the Master Direction on Prepaid Payment Instruments of 27 August 2021, as updated on 27 December 2024.
- On 24 April 2026 the RBI issued a draft replacement Master Direction with comments due by 22 May 2026.
- The framework comes from Lei 12.865/2013, with detail in Resolução BCB nº 80 of 25 March 2021.

---

Source: wiki.private.law — the private.law legal knowledge base. When quoting, cite the canonical page URL.
Consultation with a lawyer: https://t.me/private_law_bot