Payout API RBI Compliance Checklist 2026

This checklist consolidates the RBI guidelines that apply to any
fintech originating push payments through a payout API in 2026. We’ve
written it from the point of view of the engineering + compliance teams working
together: each item maps to a technical control you can audit.

Disclaimer — this article summarises publicly available RBI circulars and
NPCI operating rules current as of 2026. It is not legal advice; validate with
your compliance officer before acting on any specific item.

1. Licensing fit — pick your lane

You cannot originate payouts directly; you rely on a licensed party. The
three common paths:

• PPI (Prepaid Payment Instrument) issuer — you operate on top of a PPI wallet, pay out from customer balances. Requires your provider to hold a PPI licence.
• PA-PG (Payment Aggregator / Payment Gateway) — RBI PA-PG framework (March 2020 + subsequent amendments) is the dominant licence for acquiring merchants. Provider must be RBI-authorised.
• Banking-BaaS partnership — an RBI-licensed bank partners via APIs; settlement is on the bank’s books.

2. KYC & customer due-diligence

• ☐ Beneficiary KYC before first credit (PAN + account proof at minimum; full V-KYC for >₹50,000/month cumulative).
• ☐ Name-match between PAN holder and bank-account holder for account-verification flows.
• ☐ Re-KYC cadence defined (typically 24 months for low-risk, 12 months for medium, 6 months for high).
• ☐ UBO (Ultimate Beneficial Owner) traced for all corporate beneficiaries.
• ☐ Sanctions-list screening (UN, OFAC, MHA) at onboarding and on a recurring basis.

3. Transaction monitoring (AML / PMLA)

• ☐ Real-time rules engine — velocity, amount, geography, device-fingerprint.
• ☐ Suspicious Transaction Report (STR) workflow with FIU-IND filing SLA (within 7 days of suspicion).
• ☐ Cash Transaction Report (CTR) for any aggregated single-day ≥ ₹10 lakh equivalent.
• ☐ Alert tuning — reviewed quarterly, documented.

4. Data localisation (RBI circular on storage of payment system data)

RBI’s April 2018 circular, reinforced since, requires end-to-end
payment data to be stored only within India. Practical implications:

• ☐ All primary datastores (OLTP + OLAP) in AWS ap-south-*, Azure Central India, or on-prem India DC.
• ☐ Backups also India-region; if cross-border egress is needed for processing, delete the India data within 24 h and keep only India-stored copy.
• ☐ CDN / log-shipping audited — many incidents originate from CloudFront, Datadog or Sentry ingesting payment data to US/EU regions.
• ☐ Annual board-approved System Audit Report submitted to RBI.

5. Reconciliation & settlement

• ☐ T+1 three-way reconciliation: your ledger ↔ payout-provider ledger ↔ bank settlement file.
• ☐ Automated break-flagging with SLA for resolution (commonly T+2 for ≥ ₹10k breaks).
• ☐ Unreconciled balances reported to finance weekly, to board monthly.

6. Audit trail & log retention

• ☐ Immutable, append-only logs for every state transition on every transaction.
• ☐ 10-year retention (PMLA) for financial records; 7 years for auxiliary logs.
• ☐ Logs include: user, IP, user-agent, device-fingerprint, reason code, operator (if internal).
• ☐ WORM-style storage (Object Lock / immutability) to prevent tampering even by DBAs.

7. Customer-facing obligations

• ☐ Grievance policy published on website (Nodal Officer name + contact).
• ☐ Complaint-escalation matrix: L1 (24 h) → L2 (7 days) → RBI Ombudsman.
• ☐ Visible fee disclosure pre-transaction.
• ☐ Refund SLA stated (most regulators converging on T+7 for retail refunds).

8. Security controls (technical)

• ☐ PCI-DSS scope minimisation (see our dedicated guide — coming soon).
• ☐ Encryption at rest (AES-256) and in transit (TLS 1.2+; 1.3 preferred).
• ☐ Secrets management via KMS; no credentials in env files or code.
• ☐ Quarterly VAPT with remediation SLA.
• ☐ Annual board-approved cyber-security policy.

9. Operational resilience

• ☐ RTO < 2 h, RPO < 15 min for core payout services.
• ☐ Multi-AZ active-passive, tested DR drill twice yearly.
• ☐ Incident post-mortem < 5 business days; customer-facing incidents published within 24 h.

10. Board & governance

• ☐ Information-security committee with quarterly minutes.
• ☐ Risk-management framework document, reviewed annually.
• ☐ Fit-and-proper declarations for directors and senior management.

A note on keeping this checklist fresh

RBI issues material circulars every 2–3 months. We revise this article
quarterly; the last update date is visible in the byline above. For the live
list of circulars, the authoritative source is
rbi.org.in.

Related NxtBanking resources

• Webhook Security — HMAC Signatures
• UPI API Integration Guide
• BBPS API Integration Guide
• Build a Multi-Bank Payout System via API