The Indian digital payments ecosystem has witnessed an evolutionary change over the last two decades, evolving from the conventional banking mechanisms into the highly technological one. Key to this transformation is the Payment and Settlement Systems Act, 2007 (PSS Act), which acts as the main legal framework for payment systems regulation and supervision in India. With the help of this legislative framework, which has enabled RBI to act as the macro-prudential regulator while allowing for the setting up of NPCI, the Indian digital payments ecosystem has seen great innovation – particularly in the area of UPI. But, at the same time, growth has also been accompanied by various legal, structural and financial challenges that have led to major amendments in statutory laws and regulations.

This report is a detailed study of the legislation and regulations in terms of tracking analysis of PSS Act, 2007 with an emphasis on the recent amendments in Section 10A of the Act, guidelines of NPCI for UPI and further regulatory directions issued by RBI. Using a well-formulated methodology, this report determines the legal history, legislative events, subordinate regulations, enforcement actions, and the future legal perspective of payment rails in India.

1. Baseline & Statutory Framework

The Payment and Settlement Systems Act, 2007 (PSS Act) is an act that came into being to establish an effective regulatory and supervisory framework for all the payment systems of India. Before the passage of this act, payment systems were governed by different provisions of the Reserve Bank of India Act, 1934.

a Primary Objective: Ensuring the security, efficiency, netting finality, and statutory oversight of electronic fund transfers, payment cards, clearing through paper, and modern digital payment rail infrastructure.

b Statutory Regulator: Reserve Bank of India (RBI).

c Core Provisions:

d Section 4: No entity shall operate or start any payment system without prior approval of the RBI.

e Section 10 & Section 18: Authority to the RBI to give directions, make policies, and establish standards relating to the operation of payment systems.

f Section 10A: Introduced by the Finance Act, 2019 (effective 1st January, 2020) making it unlawful for banks and system providers to levy any charges or Merchant Discount Rate (MDR) on electronic payment mechanisms under Section 269SU of the Income-tax Act, 1961 (such as UPI and RuPay debit cards).

g Section 23: Legal Finality and Irreversibility to the netting and settling process making such transactions immune from reversal even in insolvency proceedings.

h Section 25: Dishonoring of electronic fund transfers owing to insufficient balance as a criminal offense, equivalent to that of cheque bouncing under Section 138 of the Negotiable Instruments Act, 1881.

2. Legislative & Regulatory Timeline

3. Subordinate Legislation, Rules & Guidelines

RBI (Cyber Resilience and Digital Payment Security Controls for non-bank PSOs) Master Directions, 2024

a Notification to Authority: Reserve Bank of India (Department of Payment and Settlement Systems) 

b Scope: Governance, board monitoring, segregation of IT infrastructure, multi-factor authentication, and cyber threat management standardization for payment aggregators, wallet providers, and prepaid card providers.

NPCI Procedural Guidelines & Operating Circulars for UPI

a 30% Market Cap Directive: NPCI directive limiting any one Third Party App Provider (TPAP) to a maximum of 30% in terms of transaction volume on the UPI network (with periodic extensions of timelines to prevent any market disruptions).

b Interchange on PPI-UPI Transactions: Circular relating to the 1.1% interchange fee charged for merchant transactions via Prepaid Payment Instruments (wallets) on UPI.

RBI Payment Aggregator (PA) and Payment Gateway (PG) Master Directions (Updated 2024–2025)

Controls licensing, the operations of the escrow account, merchant onboarding, and cross-border PA (PA-CB) activity under Section 10(2) of the PSS Act.

4. Implementation & Rollout Status

1 Current Status: In full force in India.

a Implementation Phases:

b Payments Regulatory Board (PRB): Operational since its first board meeting.

Cyber Resilience Master Directions: Subject to a phase-wise implementation process:

Large non-bank PSOs: Compliant as of April 1, 2025.

Medium non-bank PSOs: Deadline for Compliance April 1, 2026.

Small non-bank PSOs: Phase-wise transition up to April 1, 2028.

Section 10A Amendment (MDR Framework): Legal Enablement achieved. Legal authority for the same is effective; but P2P and small merchant payments will still be free. The MDR framework (if any) will only come into effect for select merchant categories through central government notifications.

5. Enforcement & Compliance Log

a Decriminalization Enforcement (Jan Vishwas Framework): Changed approach from prosecutions to fines. Failure to produce records and return documents as per Section 30 would result in a fine of up to ₹10,00,000 (previously ₹5,00,000).

b Guidelines Related to Imbalanced Market Share: RBI and NPCI sent supervisory letters to TPAPs holding a dominant position to provide for infrastructure stability and counter concentration risk.

c Supervision of Licensing: Under Section 7 of PSS Act, RBI performed a stringent audit of PA applications and provided formal license to 68 PAs and 50 PPI issuers.

6. Judicial & Legislative Challenges

a Policy Representation of Zero MDR: Payment Council of India (PCI), and acquiring banks have raised their concerns regarding Section 10A. It was pointed out that any restrictions on revenue model would adversely impact the development of POS network and security initiatives in rural areas. The legislative change made to Section 10A is directly based on this feedback.

b Writ Petition for Interoperability and Localization of Data: Constitutional petitions have been filed in High Courts against data localization policies and exclusive payment handles, which resulted in mandatory interoperability provisions issued by RBI.

7. Comparative & Connected Regulatory Perspective

a Comparison between PSS Act and Income-Tax Act (Section 269SU): In the past, Section 10A of the PSS Act used to be a direct extension of Section 269SU of the Income-tax Act, 1961. With the statutory change, the rigid relation has been separated giving discretionary power to the Ministry of Finance and RBI to notify electronic channels along with transaction limits without making any amendments to the tax law.

b Structure for NPCI-RBI Oversight: Although RBI is the statutory regulator under the PSS Act, NPCI is responsible for regulating retail payment systems and providing network standardization for UPI. Thus, there is a dual-level structure wherein statutory rules of the RBI get implemented through NPCI circulars.

8. Comprehensive Legislative Evolution Report

I. Historical Evolution & Baseline Architecture

India saw a change in structure of payments' regulatory supervision owing to the passing of the Payment and Settlement Systems Act, 2007. Prior to the passing of the said act, there was no legislation governing the settlement finality and netting of digital clearings. The Payment and Settlement Systems Act protected netting under Section 23 and gave the Reserve Bank of India exclusive powers as the only licensing and supervising body of payment systems operating in the country under Section 4. In this scenario, the Reserve Bank of India helped in setting up National Payments Corporation of India (NPCI), which is an umbrella organization of retail electronic payment systems set up in the year 2008. This separation of duties helped the RBI to supervise the payment systems statutorily and give responsibilities of standards of UPI, IMPS and RuPay to NPCI.

II. Transition to Zero-MDR and Digital Expansion

To boost the usage of digital payments after the launch of UPI in 2016, Section 10A was brought into force in the PSS Act via Finance Act 2019 (effective from January 1, 2020). Under this clause, no bank or payment system provider could levy any fees or Merchant Discount Rate (MDR) on any electronic payment mode that is prescribed by the Reserve Bank of India. Although this resulted in an increase in the number of transactions (as the share of UPI in total retail transactions grew to almost 86%), it put a strain on the acquiring banks and non-bank payment service providers.

III. Recent Statutory Reforms & Current Regulatory Horizon

To tackle such sustainability issues, Parliament has made amendments to Section 10A of the PSS Act, 2007. Some of the important aspects of these amendments include:

1. Decoupling from the Income-Tax Restrictions: The amendment changes the references to Section 269SU of the Income-tax Act and replaces it with a standalone provision where the Central Government can specify notified electronic payment methods through a notification.

2. Enabling Provisions for Tiered MDR: This amendment also does away with the statutory ban on any charges, making it possible to have targeted fee structures in the future.

3. Protection for Consumers and Small Businesses: Person-to-Person (P2P) payments and everyday consumer transactions would always be free in the future. The fee structure in future would be applicable only for merchant transactions over certain turnover levels. Apart from the legislative changes, the RBI has also enhanced supervisory controls by creating the Payments Regulatory Board (PRB) and Master Directions on Cyber Resilience.

Regulatory evolution of Payment and Settlement Systems Act, 2007 reflects consistent effort to maintain the delicate balance between achieving fast financial inclusion and sustaining the underlying infrastructure. Implementation of Section 10A in 2019 effectively spurred digitalization by removing merchant fees, making UPI the widely used everyday utility. Yet, with growth of transaction volumes, it became apparent that without adequate system of digital security, fraud prevention, and physical infrastructure there is no room left for zero revenue approach. Recent statutory changes in Section 10A, alongside with formation of Payments Regulatory Board (PRB) and implementation of RBI Master Directions on Cyber Resilience reflect major transition towards regulatory maturity. Removal of charge policies from the inflexible framework of tax regulations allows for creating more sophisticated, tiered MDR structure to cater the needs of large companies, while protecting the retail customer at the same time. In addition, proactive efforts by NPCI to limit the market shares of Third-Party App Providers (TPAPs) deal with system-wide concentration risks In the future, success of Indian payment system will depend on striking the right balance between retaining high level of customer trust and accessibility while establishing financially sustainable acquisition business model.

Nandhika Betty