Fintech Compliance Checklist: 2026 Guidelines for Indian Product Teams

RBI Payment Aggregator (PA) and Gateway Licensing Regulations

The regulatory framework for Payment Aggregators in India has tightened. Under revised RBI directives, companies applying for a Payment Aggregator license must demonstrate a minimum net worth of ₹15 crore at the time of application. Licensed platforms must scale this capital base to maintain an ongoing net worth of at least ₹25 crore by the end of the third financial year of registration.

Furthermore, payment gateways operate strict escrow accounts. Merchant funds must be routed through nodal accounts with scheduled commercial banks, and settlement balances must be cleared within T+2 or T+3 timelines, preventing platforms from utilizing floating merchant balances.

Prevention of Money Laundering Act (PMLA) and Suspicious Activity

Fintech platforms must register as reporting entities with the Financial Intelligence Unit (FIU-IND) and appoint a principal compliance officer. Under PMLA frameworks, platforms must run automated sanction-list screening (matching users against UN, OFAC, and local lists) at signup.

If user profiles flag suspicious indicators (such as high-frequency transactions bypassing registration limits), compliance teams must file a Suspicious Transaction Report (STR) with the FIU within 7 days. Under the guidelines, all transaction records, KYC documents, and audit logs must be preserved for at least 5 years.

CERT-In Cybersecurity Standards and VAPT Auditing

The RBI and SEBI mandate strict cybersecurity audits to protect financial databases. Fintech apps must run Vulnerability Assessments and Penetration Testing (VAPT) every six months, conducted by CERT-In empaneled auditing firms.

All database tables holding customer details must encrypt records at rest and in transit (using AES-256 and TLS 1.3 standards). Any critical security incident or database breach must be reported to the CERT-In coordinator within 6 hours of identification to avoid legal penalties.

SEBI regulations for WealthTech & RIA Products

Indian WealthTech platforms operating under SEBI Investment Advisor (RIA) rules operate under tight limits. SEBI enforces a strict fee ceiling cap: advisors can charge a flat rate of up to ₹50,000 per year per retail client, or a maximum of 1.25% of Assets Under Management (AUM) annually.

Advisors are prohibited from charging commission fees on direct mutual funds or receiving brokerage splits. Additionally, RIA apps must maintain data isolation, keeping advisory client files separate from direct distribution execution accounts.

DPDP Act and On-boarding Consent UX

The Digital Personal Data Protection (DPDP) Act has changed how fintechs design onboarding flows. Product teams must show clear consent notices during user signups, explaining what data is gathered (such as PAN cards or bank details) and how it will be used.

Startups must link user accounts with certified consent managers (like Sahasrara) to log opt-in records. Developers must also build user deletion loops that permanently erase user records across databases and cloud systems upon customer request.

Standard Escrow Operations Integration Blueprint

Fintech engineering teams must implement strict transactional isolation controls when managing customer payouts. Below is a Python script block representing how a payment gateway orchestrates settlement splits from nodal accounts, verifying merchant net worth requirements before sweeps:

def settle_merchant_balance(escrow_account, merchant_id, amount_inr):
    # 1. Verify merchant net worth is registered and verified
    net_worth = database.get_merchant_net_worth(merchant_id)
    if net_worth < 150000000:  # RBI ₹15 crore licensing floor check
        raise ComplianceError("Merchant fails minimum net worth parameters.")
        
    # 2. Execute T+2 nodal ledger sweep
    txn_ref = bank_gateway.initiate_escrow_sweep(escrow_account, merchant_id, amount_inr)
    database.log_compliance_audit(merchant_id, txn_ref, amount_inr, retention_years=5)
    return txn_ref

By enforcing these balance and audit checks programmatically, fintech products satisfy central bank guidelines, keeping ledgers clean during yearly audits.

Key Takeaways & Execution Blueprint

Maintaining fintech compliance in India requires PMs to coordinate regular reviews of capital and security audits. Product teams should map database schemas to trace sensitive PII, verifying that card vaults follow PCI-DSS token standards. Scheduling CERT-In security audits twice a year ensures infrastructure remains resilient.

Furthermore, compliance officers must set up automated PMLA screening filters to detect transaction anomalies early. Aligning consent forms with the DPDP Act secures platforms from penalties, building trust among retail users.