RBI/DPSS/2016-17/53
DPSS.CO.PD. No.     /02.14.006/2016-17

March 20, 2017

All Prepaid Payment Instrument Issuers, System Providers, System Participants
and all prospective Prepaid Payment Instrument Issuers

(Draft Master Directions for Comments)

Dear Sir/ Madam,

Master Directions on Issuance and Operation of Prepaid Payment Instruments in India

As you are aware, the Reserve Bank of India has, from time to time, issued a number of circulars containing policy guidelines on Issuance and Operation of Prepaid Payment Instruments (PPIs) in India. These Master Directions have been prepared to facilitate the Prepaid Payment Instrument Issuers, System Providers, System Participants and all other Prospective Prepaid Payment Instrument Issuers to have all the extant instructions on the subject at one place.

2. The Master Directions have been prepared by incorporating all the instructions/guidelines issued on Issuance and Operation of Prepaid Payment Instruments in India up to February 28, 2017 along with certain revisions and additions to the extant instructions. The Master Directions, issued under Section 18 read with Section 10(2) of Payment and Settlement Systems Act, 2007, has been placed on the RBI web-site (rbi.org.in). A list of circulars finding reference in these Master Directions is enclosed as Appendix.

Yours faithfully,

(Nanda S. Dave)
Chief General Manager-in-Charge

1. Introduction

1.1 In exercise of the powers conferred under Section 18 read with Section 10(2) of Payment and Settlement Systems Act, 2007 (Act 51 of 2007) the Reserve Bank of India being satisfied that it is necessary and expedient in the public interest so to do, hereby, issues the directions hereinafter specified.

1.2 Short title and commencement

i.            These directions shall be called the Reserve Bank of India (Issuance and Operation of Prepaid Payment Instruments in India) Directions 2017 (Master Directions).

ii.            These directions shall come into effect on the day they are placed on the official website of the Reserve Bank of India (RBI).

1.3 Applicability: The provisions of the Master Directions shall apply to all Prepaid Payment Instrument Issuers, System Providers, System Participants and all prospective Prepaid Payment Instrument Issuers

1.4 Purpose

i.            To provide a framework for regulation, authorisation and supervision of entities operating payment systems for issuance of Prepaid Payment Instruments (PPIs) in the country;

ii.            To encourage innovation in this segment in a prudent manner taking into account safety and security along with customer protection and convenience.

1.5 For the purpose of these guidelines, the term ‘entities’ refers to banks, NBFCs and other non-bank entities who have approval / authorisation, as the case may be, for setting up and operating systems for issuance of PPIs.

1.6 Banks and non-bank entities have been issuing prepaid payment instruments (PPIs) in the country after obtaining necessary approval / authorisation under the Payment and Settlement Systems Act, 2007 from Reserve Bank of India. These entities have been operating within the framework of the initial guidelines on “Issuance and Operation of PPIs” issued in April 2009 and amended from time to time. Taking into account the developments in the field and the progress made by PPI issuers, and given the number of amendments made in the past, these guidelines are now being issued in the form of Master Directions containing all the instructions at one place.

1.7 The Master Directions incorporate all the instructions/guidelines issued on Issuance and Operation of Prepaid Payment Instruments in India up to February 28, 2017 along with certain revisions and additions to the extant instructions.

1.8 The Master Directions, covering both banks and non-bank entities, lay down the eligibility criteria and the conditions of operations for payment system operators involved in the issuance of semi-closed and open system PPIs in the country. All entities approved / authorised to operate payment systems involving the issuance of PPIs in India shall comply with these directions.

1.9 All bank and non-bank entities proposing to set up and operate payment systems for issuance of PPIs shall seek approval / authorization respectively, in accordance with the Master Directions, from the Department of Payment and Settlement Systems, Reserve Bank of India, under the Payment and Settlement Systems Act, 2007.

2. Definitions

For the purpose of these guidelines, the following definitions shall be applicable:

2.1 Issuer: Entities operating the payment systems issuing PPIs to individuals/organizations. The money so collected is used by these entities to make payment to the merchants who are part of the acceptance arrangement, and for facilitating funds transfer / remittance services.

2.2 Holder: Individuals/Organizations who obtain / purchase PPIs from the issuers and use the same for purchase of goods and services, including financial services, remittance facilities, etc.

2.3 Prepaid Payment Instruments (PPI): PPIs are payment instruments that facilitate purchase of goods and services, including financial services, remittance facilities etc. against the value stored on such instruments. PPIs that can be issued in the country are classified under three categories viz. (i) Closed system prepaid payment instruments (ii) Semi-closed system prepaid payment instruments and (iii) Open system prepaid payment instruments.

2.4 Closed System Prepaid Payment Instruments: These are PPIs issued by an entity, including individuals, proprietorship firms, partnership firms etc., for facilitating the purchase of goods and services from that entity only. These instruments do not permit cash withdrawal or redemption. As these instruments cannot be used for payments and settlement for third party services, the issue and operation of such instruments are not classified as payment systems requiring approval / authorisation by the Reserve Bank of India.

2.5 Semi-Closed System Prepaid Payment Instruments: These are PPIs which can be used for purchase of goods and services, including financial services, remittance facilities etc. at a group of clearly identified merchant locations/ establishments which have a specific contract with the issuer (or contract through a payment aggregator / payment gateway) to accept the PPIs as payment instruments. These instruments do not permit cash withdrawal, irrespective of whether they are issued by bank or non-bank PPI Issuers. Semi-closed PPIs issued by banks and non-banks would have same features, unless otherwise specified.

2.6 Open System Prepaid Payment Instruments: These are PPIs which shall be only issued by banks, can be used for purchase of goods and services, including financial services, remittance facilities etc. at any merchant locations. Banks issuing such PPIs shall also facilitate cash withdrawal at ATMs / BCs.

2.7 Limits: All ‘limits’ in the value of instruments stated in the guidelines, indicate the maximum value of such instruments, denominated in INR, that shall be issued to any holder, unless otherwise specified.

2.8 Merchants: These are establishments who have a specific contract with the PPI issuer (or contract through a payment aggregator / payment gateway) to accept the PPIs issued by PPI issuers against the sale of goods and services, including financial services.

3. Eligibility to issue semi-closed and open system PPIs

3.1 Banks who comply with the eligibility criteria, including those stipulated by the concerned regulatory department of Reserve Bank of India shall be permitted to issue all categories of PPIs, after obtaining approval from the Department of Payment and Settlement Systems, Reserve Bank of India.

3.2 However, taking into account the technical requirements, only those banks providing Mobile Banking facilities to their customer shall issue mobile phone-based PPIs (for example, mobile wallets)

3.3 Other entities, including Non-Banking Financial Companies, shall be permitted to issue only semi-closed system PPIs, including mobile phone-based PPIs (for example, mobile wallets).

4. Cross Border Transactions

4.1 Foreign Exchange Prepaid Payment Instruments: Persons authorized under Foreign Exchange Management Act (FEMA) to issue foreign exchange denominated prepaid payment instruments and where such entities issue such instruments as participants of payment systems authorised by the Reserve Bank of India, are exempt from the purview of these guidelines. The use of such payment instruments shall be limited to permissible current account transactions and subject to the prescribed limits under the Foreign Exchange Management (Current Account Transactions) Rules, 2000, as amended from time to time.

4.2 Full-KYC reloadable semi-closed and open system PPIs issued by Bank PPI Issuers having AD licence shall be permitted to be used in cross-border transactions (for permissible current account transactions only), subject to adherence to extant norms governing such transactions, including extant Liberalised Remittance Scheme norms. Prefunding of online merchant’s account shall not be permitted using such Rupee denominated PPIs. Issuers shall enable this facility only on explicit request of the PPI holders and shall apply, to begin with, a per transaction limit of not exceeding Rs.5000/- for such cross-border transactions.

5. Capital and other eligibility requirements

5.1 Licensed / Scheduled Banks and Registered Non-Banking Financial Companies (NBFCs) shall be permitted to issue PPIs obtaining approval / authorisation from Reserve Bank of India.

5.2 All entities, seeking approval / authorisation from the Reserve Bank of India under the Payment and Settlement Systems Act, 2007 henceforth, shall have a minimum positive net worth of Rs. 25 crore as per the last audited balance sheet and the same shall be maintained at all times. Entities shall submit a certificate for compliance with the networth requirement at the time of making application for authorisation and also annually by end-September as per the audited balance sheet.

5.3 Net-worth will consist of ‘paid up equity capital, preference shares which are compulsorily convertible into equity capital, free reserves, balance in share premium account and capital reserves representing surplus arising out of sale proceeds of assets but not reserves created by revaluation of assets’ adjusted for ‘accumulated loss balance, book value of intangible assets and Deferred Revenue Expenditure, if any’. It shall be noted that while CCPS reckoned for computation of net worth can be either non-cumulative or cumulative, these should be compulsorily convertible into equity shares and the shareholder agreements should specifically prohibit any withdrawal of this preference capital at any time.

5.4 Newly incorporated entities which may not have an audited statement of financial accounts shall submit a certificate from their Chartered Accountants regarding the current net worth along with provisional balance sheet. They shall also submit documents in support of the capital infusion and the funds available to undertake this business.

5.5 The final approval in the case of banks and NBFCs shall be determined on the basis of the recommendation of the concerned regulatory / supervisory department of the Reserve Bank of India as applicable.

5.6 The existing non-bank PPI issuers shall also comply with the enhanced capital requirements by September 30, 2020 for the financial position as on March 31, 2020, failing which they shall not be permitted to carry on this business beyond December 31, 2020. Till such time, the existing PPI issuers shall continue to maintain the capital requirements under which they were authorised.

5.7 Applicant entities having FDI/FII should meet the minimum capital requirement as applicable under extant Consolidated FDI policy guidelines of Government of India.

5.8 Non-bank entities applying for authorisation shall be a company incorporated in India and registered under the Companies Act 1956 / Companies Act 2013.

5.9 The Memorandum of Association (MOA) of the applicant entity shall cover the proposed activity of operating as a PPI issuer.

6. Authorisation Process for non-bank entities

6.1 A non-bank entity desirous of setting up payment systems for issuance of PPIs shall be required to apply for authorization in Form A as prescribed under Regulation 3(2) of the Payment and Settlement System Regulations, 2008.

6.2 The applications shall be initially screened by RBI to ensure prima facie eligibility of the applicants. RBI shall also check ‘fit and proper’ status of the applicant and management by obtaining inputs from other regulators, government departments and self-declarations of the entities directors, as deemed fit. Applications of those entities not meeting the eligibility criteria, are incomplete / not in the prescribed form with all details, shall be returned with no refund of the application fees.

6.3 In addition to the compliance of the proposal to the applicable guidelines, RBI shall also apply checks, inter alia, on certain essential aspects like customer service and efficiency, technical and other related requirements, before granting authorization to the applicants.

6.4 Subject to meeting the eligibility criteria and other conditions, the Reserve Bank of India issues an ‘in-principle’ approval. The validity of in-principle approval issued by RBI shall be six months from the date of granting such in-principle approval. The entity shall submit a satisfactory System Audit Report to RBI within these six months, failing which the in-principle approval shall lapse automatically. An entity can obtain one-time extension of six months by making a request in writing in advance with valid reasons. The RBI reserves the right to decline such request for extension.

6.5 Subsequent to the issue of the in-principle approval, if any adverse features regarding the entity/ promoters/ group come to the notice of the RBI, the RBI may impose additional conditions and if warranted, the in-principle approval shall be withdrawn.

6.6 Entities granted final authorization shall commence business within six months from the grant of Certificate of Authorization failing which the authorization shall lapse automatically. An entity can obtain one-time extension of six months by making a request in writing in advance with valid reasons. The RBI reserves the right to decline such request for extension.

6.7 The Certificate of Authorisation shall be subject to review and shall be valid for five years unless otherwise specified.

6.8 PPI Issuers, considering introducing any material changes in the processes other than those approved / authorized, shall obtain prior approval of the RBI and also submit a system audit report, if required.

6.9 Entities seeking renewal of authorization shall apply in writing to RBI at least three months before the expiry of validity period, failing which RBI reserves the right to decline the renewal request.

6.10 Non-bank PPI Issuers, shall henceforth obtain prior written permission of the Reserve Bank in respect of:

a.       any takeover or acquisition of control¹ of non-bank entity, which may or may not result in change of management;

b.      any change in the management of non-bank entity, which would result in change in more than 30 per cent of the directors, excluding independent directors. Prior approval shall not be required for those directors who get re-elected on retirement by rotation.

7. Safeguards against Money Laundering (KYC/AML/CFT) Provisions

7.1 The Know Your Customer/Anti-Money Laundering/Combating Financing of Terrorism guidelines issued by the Reserve Bank of India, from time to time, shall apply mutatis mutandis to all the entities issuing PPIs.

7.2 As PPI issuers are operating a Payment System, provisions of Prevention of Money Laundering Act, 2002 and Rules framed thereunder, as amended from time to time, are also applicable to PPI issuers. Entities shall put in place necessary systems to ensure compliance with these guidelines.

7.3 The use of INR denominated PPIs for cross border transactions shall not be permitted except as provided for at paragraph 4.2 of the Master Directions.

7.4 PPI Issuers shall maintain a log of all the transactions undertaken using the PPIs issued by them. This data shall be made available for scrutiny by the Reserve Bank or any other agency / agencies as may be advised by the Reserve Bank. The Issuers shall also file Suspicious Transaction Report (STR) to Financial Intelligence Unit – India (FIU-IND).

8. Issuance, loading and reloading of PPIs

8.1 All entities authorised to issue prepaid payment instruments by Reserve Bank of India are permitted to issue reloadable or non-reloadable prepaid payment instruments depending upon the permissible category of PPIs.

8.2 Issuers shall have a clearly laid down policy, with Board approval, for issuance of various categories of PPIs and all activities related thereto.

8.3 PPI Issuers shall ensure that the company name, for which authorisation / approval for issuance and operating PPI system has been given, is necessarily displayed along with the PPI brand name in all instances.

8.4 PPI Issuers shall ensure that no interest is payable on PPI balances.

8.5 PPIs shall be permitted to be loaded / reloaded by cash, by debit to a bank account, by credit and debit cards, and other PPIs (as permitted from time to time).

8.6 PPI Issuers shall be permitted to issue PPIs (as outlined under para 9.2 and 9.4 below) to employees / staff / contract workers / customers etc. (collectively called as beneficiaries) which are loaded / reloaded from full KYC bank accounts of companies / private organisations, Government organisations / departments, financial institutions, individuals (collectively called as payers) etc. Issuers shall provide this facility after completing due diligence of the payers. Loading / reloading of such PPIs shall be done after obtaining necessary authorisation and beneficiary details from the payers. The Issuers shall be responsible for all customer related aspects of these PPIs.

8.7 Cash loading to PPIs shall be limited to Rs.50,000/- per month subject to overall limit of the PPI.

8.8 PPI Issuers shall ensure that PPIs are not created in the system, including by their agents, only for the purpose of facilitating cash-based remittances to bank accounts.

8.9 The loading in the PPIs covered under these Directions shall be in INR only.

8.10 The PPIs may be issued as smart cards, magnetic stripe cards, internet wallets, mobile wallets, and any such form / instrument which can be used to access the PPI and to use the amount therein. PPIs in the form of paper vouchers shall no longer be issued from the date of the Master Directions.

8.11 Banks shall be permitted to issue and reload PPIs, using permitted payment instruments, at their branches, ATMs and through their business correspondents appointed as per the guidelines issued by the Reserve Bank in this regard.

8.12 Banks and non-banks shall be permitted to issue and reload such payment instruments through their authorised outlets or through their authorized / designated agents (other than BCs in case of banks) using permitted payment instruments subject to following conditions:-

a.       The Board approved policy shall clearly lay down the framework for engaging agents for the purpose of issuance and reloading of PPIs.

b.      Issuers shall carry out proper due diligence of the persons appointed as authorized / designated agents for issue / reloading of permissible categories of PPIs.

c.       Issuers shall be responsible for all the PPIs issued by the authorized / designated agents.

d.      Issuers shall be responsible as the principal for all the acts of omission or commission of their authorized / designated agents.

e.       Issuers shall ensure preservation of records and confidentiality of customer information in their possession as well as in the possession of their authorised / designated agents.

f.       The PPI issuers shall regularly monitor the activities of their authorized / designated agents and also carry out a review of the performance of various agents engaged by them at least once in a year.

g.      Issuers and their authorized / designated agents shall ensure adherence to applicable laws of the land, including KYC/AML/CFT norms.

8.13 PPI Issuers shall ensure that there is no co-mingling of funds originating from any other activity that the Issuer may be undertaking such as business correspondent of bank/s, intermediary for payment aggregation, payment gateway etc.

8.14 Issuance of PPIs under co-branding arrangements:

a.       Authorised PPI issuers shall be permitted to co-brand such instruments with the name/logos of financial institutions / Government Organisation etc. for whose customers/beneficiaries such co-branded instruments are to be issued.

b.      The name of the issuer shall be visible prominently on the payment instrument.

c.       The co-branding partner shall be having its presence in India.

d.      All PPI issuers desirous of issuing such co-branded PPIs shall carry out due diligence in respect of the co-branding partner and seek one time approval from Reserve Bank of India.

e.       In case of co-branding arrangements, bank PPI issuers shall adhere to the instructions contained in the circular RBI/2012-13/325 DBOD.No.FSD.BC. 67/24.01.019/2012-13 dated December 12, 2012. In case of other authorized non-bank PPI Issuers, where co-branding arrangements take place between two non-bank PPI Issuers, the agreement shall clearly indicate which partner shall be the PPI Issuer.

f.       The co-branding arrangement shall be as per the Board approved policy of the PPI issuer. The policy shall specifically address issues pertaining to the various risks associated with such an arrangement including reputation risk and the PPI issuer shall put in place suitable risk mitigation measures. The policy shall also clearly indicate the roles and responsibilities, obligations and liabilities of each co-branding partner.

g.      The PPI issuer shall be liable for all acts of the co-branding partner.

h.      The instructions/ guidelines on KYC/AML/CFT, issued by RBI from time to time, shall be adhered to, in respect of all PPIs issued under the co-branding arrangement. The PPI issuer shall not reveal any information relating to customers obtained at the time of opening the PPI and the co-branding entity shall not be permitted to access any details of customer’s accounts that may violate the PPI issuer’s secrecy obligations.

8.15 PPI issuers already having co-branding arrangements at the time of issuance of this Master Directions shall review their existing arrangements to meet the above requirements and shall also submit the details of existing co-branding arrangements to the Reserve Bank.

9. Types of Prepaid Payment Instruments

9.1 The maximum value of any prepaid payment instrument, where specific limits have not been prescribed, shall not exceed Rs 50,000/-.

9.2 Issuance of Semi-closed PPIs by banks and non-bank PPI Issuers

Banks and authorised non-bank entities shall be permitted to issue the following types of semi closed PPIs, on carrying out Customer Due Diligence as indicated for each type of PPI.

(i) PPIs upto Rs.20,000/- by accepting minimum details of the customer

a.       The amount outstanding at any point of time in such PPIs shall not exceed Rs. 20,000/-.

b.      The total value of amount loaded / reloaded in such PPIs during any given month shall not exceed Rs. 20,000/-.

c.       These PPIs can be reloadable in nature and shall be issued only in electronic form, including cards.

d.      The minimum details shall include One Time Pin (OTP) verified mobile number (at least in case of e-wallets / m-wallets)and self-declaration of name, address, gender, date of birth and unique identification number of any of the ‘officially valid document’ defined under Rule 2(d) of the PML Rules 2005, as amended from time to time.

e.       These PPIs shall be converted into full KYC semi-closed PPIs within a period of 60 days from the date of issue of PPI, failing which no further credit shall be allowed in such PPIs. However, the PPI holder shall be allowed to use the balance available in the PPI.

f.       PPI issuers shall ensure that this category of PPI is not issued to the same user in future using the same mobile number and same minimum details.

g.      Fund transfers from such PPIs to bank accounts and also to PPIs of same issuers (and to PPIs issued by other issuers as and when enabled) shall not exceed Rs 10,000/- per month.

h.      PPI Issuers shall decide the limit of funds transfer where the funds have to be transferred ‘back to source’ (payment instrument from where the PPI was loaded) or ‘own bank account of the PPI holder’ (duly validated by the Issuer) within the overall PPI limit.

i.        PPI issuers shall also give the holders an option to close the PPI and transfer the balance as per the applicable limits of that category of PPI. For this purpose, the Issuers shall provide an option, including at the time of issuing the PPI, to the holder to provide details of pre-designated bank account or other PPIs of same issuer (or other issuers as and when permitted) to which the balance amount available in the PPI shall be transferred in the event of closure / expiry of validity period of such PPIs.

(ii) PPIs upto Rs.1,00,000/- with full KYC²

a.       The amount outstanding in such PPIs shall not exceed Rs.1,00,000/- at any point of time.

b.      These PPIs can be reloadable in nature and shall be issued only in electronic form, including cards.

c.       PPI Issuers shall decide the limit of funds transfer where the funds have to be transferred ‘back to source’ (payment instrument from where the PPI was loaded) or ‘own bank account of the PPI holder’ (duly validated by the Issuer) within the overall PPI limit.

d.      PPI Issuers shall provide the facility of ‘pre-registered beneficiaries’ whereby the PPI holder can register the beneficiary by providing their bank account details, details of PPIs issued by same issuer (or different issuers as and when permitted).

e.       In case of such preregistered beneficiaries, the funds transfer limit shall not exceed Rs. 1 lakh per month per beneficiary. PPI Issuers shall set the limits within this ceiling taking into account the risk profile of the PPI holders and other operational risks, etc.

f.       The funds transfer limits for all other cases shall be restricted to Rs.10,000/-per month.

g.      PPI Issuers shall clearly indicate these limits to the PPI holders and also provide necessary options to PPI holders to set their own fund transfer limits.

h.      PPI issuers shall also give the holders an option to close the PPI and transfer the balance as per the applicable limits of that category of PPI. For this purpose, the Issuers shall provide an option, including at the time of issuing the PPI, to the holder to provide details of pre-designated bank account or other PPIs of same issuer (or other issuers as and when permitted) to which the balance amount available in the PPI shall be transferred in the event of closure / expiry of validity period of such PPIs.

9.3 Migration of existing minimum details semi-closed PPIs issued by banks and non-banks

a.       PPI Issuers shall ensure that all the existing minimum detail semi-closed PPIs³ issued by them as on the date of issue of the Master Directions, are converted into full KYC semi-closed PPIs as indicated in para 9.2 (ii) above, by June 30, 2017, failing which no further credit shall be allowed in such PPIs.

b.      PPI Issuers shall make their customers aware of these changes and shall give all such existing semi-closed PPI holders a one-time option to transfer the existing balance in the PPI to other PPIs of same issuer or to a bank account without any transaction limit. No charges shall be levied by the PPI Issuers on the PPI holders for such fund transfers.

c.       Till the conversion of these PPIs to full KYC semi-closed PPIs (i.e. till June 30, 2017), all limits as applicable to PPIs under category 9.2 (i) of these Master Directions shall be applicable.

d.      The above conditions shall also apply to the migration of existing PPIs issued under paragraph 7.2(ii) of Master Circular DPSS.CO.PD.PPI.No.01/02.14.006/2016-17 dated July 1, 2016.

e.       PPI Issuers shall submit the data relating to migration of existing PPIs in the prescribed format on a monthly basis.

9.4 Issuance of open system PPIs by banks

a.       Only banks shall be permitted to issue open system PPIs after full KYC⁴ in addition to semi closed PPIs listed above.

b.      These PPIs shall be reloadable in nature and issued only in electronic form, including cards.

c.       The amount outstanding at any point of time in such PPIs shall not exceed Rs.1,00,000/-.

d.      Funds transfer limits from such PPIs shall be same as semi-closed full KYC PPIs (as per paragraph 9.2 (ii) of these Master Directions).

e.       Funds transfers from such PPIs shall also be permitted to other open system PPIs, debit cards and credit cards.

10. Specific categories of Prepaid Payment Instruments

10.1 Issuance of prepaid Gift instruments

Bank and non-bank entities are permitted to issue prepaid gift instruments subject to the following conditions:

a.       The maximum validity of the prepaid gift instruments shall be three years.

b.      Maximum value of each prepaid gift instrument shall not exceed Rs. 20,000/-.

c.       These instruments shall not be reloadable.

d.      Cash withdrawal as well as fund transfer shall not be permitted for such instruments. However, PPI Issuers shall permit transfer of outstanding balance in the PPI ‘back to source’ (payment instrument from where the PPI was loaded) in case the purchaser requests for the same.

e.       KYC details of the purchasers of such instruments shall be maintained by the PPI Issuer and made available on demand.

f.       Entities shall adopt a risk based approach, duly approved by their Board, in deciding the number of such instruments which can be issued to a customer, transaction limits, etc.

10.2 Issuance of prepaid Meal instruments

Banks and non-bank entities shall be permitted to issue prepaid meal instruments under B2B arrangements subject to following conditions:

a.       Such PPIs shall be issued only in electronic form, including cards, and are reloadable.

b.      Entities presently issuing meal vouchers under B2B arrangements in paper voucher form shall commence issuance of such PPIs in electronic form, including cards, at the earliest, but not later than December 31, 2017. Prepaid meal instruments in paper voucher form shall not be accepted beyond December 31, 2017.

c.       PPI Issuers shall enter into arrangements only with employers whose due diligence has been completed.

d.      Such PPIs shall be loaded / reloaded only from the funds deployed by the employers (for instance, from their bank account) with suitable authorization to the PPI Issuers to credit the PPIs of the employees.

e.       PPI issuers shall obtain and maintain the details of employees (name, address, gender, employee identification etc.) as obtained from the employers, to whom such PPIs are being issued and funds are loaded/reloaded.

f.       The minimum validity of the prepaid meal instruments shall be one year from the date of loading. Existing paper vouchers shall not be valid beyond December 31, 2017.

g.      Maximum value in such PPIs at any point of time shall not exceed Rs.1,00,000/-.

h.      Cash withdrawal or fund transfer shall not be permitted for such instruments.

10.3 Issuance of PPIs for credit of cross border inward remittance

a.       Bank and non-bank PPI Issuers, who have been appointed as the Indian agent of the authorised overseas principal, shall be permitted to issue PPIs to beneficiaries of inward remittances under the Money Transfer Service Scheme (MTSS) of the Reserve Bank of India. Alternately, such PPIs shall be permitted to be issued by the bank and non-bank PPI Issuers where the Indian agent of the overseas principal has also been appointed as the agent of the PPI Issuer.

b.      However, authorised non-bank PPI issuers shall be permitted to issue such semi-closed PPIs for a period of one year subject to review.

c.       Such PPIs shall be issued in adherence to extant norms stipulated for this purpose under the MTSS Guidelines issued by Foreign Exchange Department, Reserve Bank of India.

d.      PPI Issuers shall have clearly laid down Board approved policy for issuance of such PPIs.

e.       Only full-KYC PPIs shall be issued to the beneficiaries.

f.       The PPI shall be loaded only with the remittance proceeds received under the MTSS guidelines.

g.      The maximum value in such PPIs at any point of time shall not exceed Rs. 50,000/-.

h.      The PPIs shall be reloadable and issued only in electronic form, including cards.

i.        Splitting of single credits among different modes of payment shall not be permitted. Any amount received in excess of Rs. 50,000/- under MTSS shall be paid by credit to a bank account.

j.        Issuers shall facilitate transfer of funds from such payment instruments to a regular bank account of the beneficiary, if asked for, subject to same conditions of remittance for full-KYC PPIs as stipulated under paragraph 9.2 (ii) of these Master Directions.

k.      Issuers shall be responsible for all customer service aspects related to these PPIs.

l.        Issuers shall be liable for all acts of the agents for PPI Issuance.

m.    The roles and responsibilities of the PPI Issuers for the PPI related activities shall be distinct from the roles and responsibilities as Indian Agents under MTSS.

10.4 Issuance of PPI for Mass Transit Systems (PPI-MTS)

a.       These semi-closed PPIs shall be issued by mass transit system operator (PPI-MTS) after authorisation under the Payment and Settlement Systems Act, 2007 to issue and operate such semi-closed PPIs.

b.      The PPI-MTS shall necessarily contain the Automated Fare Collection application related to the transit service to qualify as PPI-MTS.

c.       Apart from the mass transit system, such PPI-MTS shall be used only at other merchants whose activities are allied to or are carried on within the premises of the transit system

d.      The PPI-MTS issuer shall ensure on-boarding of merchants (only those permissible as under (c) above) following due procedure applicable to any other PPI issuer

e.       The PPI-MTS shall have minimum validity of one year from the date of issue

f.       The issuer may decide upon the desired level of KYC, if any, for such PPIs

g.      The PPI-MTS issued shall be reloadable in nature and the maximum value outstanding in PPI cannot exceed the limit of Rs. 3,000/-(Rupees Three Thousand Only)at any point of time

h.      Cash-out or refund or funds transfer shall not be permitted from these PPIs

i.        All other extant guidelines for escrow arrangement, customer grievance redressal mechanism, agent / merchant due diligence, reporting and MIS requirements etc. applicable to issue of PPIs shall continue to be applicable in respect of PPI-MTS.

10.5 From the date of issuance of these Master Directions, PPI Issuers shall cease to issue PPIs of any other category as permitted earlier under Master Circular DPSS.CO.PD.PPI.No.01/02.14.006/2016-17 dated July 1, 2016.

10.6 Rupee denominated PPIs issued by banks for visiting foreign nationals and NRIs under paragraph 7.11 of Master Circular DPSS.CO.PD.PPI.No.01/02.14.006/2016-17 dated July 1, 2016 stands discontinued from the date of issuance of these Master Directions. PPI issuers shall allow the holders to use the outstanding balance in such PPIs till their validity subject to the conditions under which these PPIs were issued. PPI issuers shall, at the request of the holder, refund the unutilized balance in the PPI in adherence to extant foreign exchange regulations.

10.7 Action to be initiated in case of existing specific categories of PPIs issued by banks:

a.       All PPIs issued under paragraph 7.6, 7.7, 7.8, 7.9 and 7.10 of Master Circular DPSS.CO.PD.PPI.No.01/02.14.006/2016-17 dated July 1, 2016 and paragraph 7.9 of circular DPSS.CO.PD.No.1610/02.14.006/2016-17 dated December 27, 2016, issued and existing as on the date of this Master Direction shall be converted into full KYC PPIs as indicated under paragraph 9.2 (ii) or 9.4, as applicable, of these Master Directions by June 30, 2017, failing which no further credit shall be allowed in such PPIs.

b.      PPI Issuers shall make their customers aware of these changes and shall give all such existing PPI holders a one-time option to transfer the existing balance in the PPI to other PPIs of same issuer or to a bank account without any transaction limit. No charges shall be levied by the PPI Issuers on the PPI holders for such fund transfers.

c.       Till the conversion of these PPIs to full KYC PPIs (i.e. till June 30, 2017), all limits as applicable to PPIs under paragraph 9.2 (i) of these Master Directions shall be applicable. Where such PPIs had been issued as open system PPIs, the cash withdrawal limits, if any, shall be as hitherto.

d.      No further credit shall be allowed in PPIs which are not converted into full KYC semi-closed PPIs by June 30, 2017.

e.       PPI Issuers shall submit the data relating to migration of existing PPIs in the prescribed format on a monthly basis.

11. Deployment of Money Collected

11.1 The money collected against issuance of prepaid payment instruments at a point of time could be substantial. Further, the turnover of funds may also be rapid. The confidence of public and merchant establishments on prepaid instruments schemes depends on certainty and timeliness of settlement of claims arising from use of such instruments. To ensure timely settlement, the issuers shall invest the funds collected only as provided here-in.

11.2 For the schemes operated by banks, the outstanding balance shall be part of the ‘net demand and time liabilities’ for the purpose of maintenance of reserve requirements. This position will be computed on the basis of the balances appearing in the books of the bank as on the date of reporting.

11.3 Non-bank PPI Issuers are hereby directed by the Reserve Bank of India under the powers granted to it under Section 23 A of the Payment and Settlement Systems Act, 2007 (as amended 2015), to maintain their outstanding balance in an escrow account with any scheduled commercial bank. Accordingly, for the purpose of maintenance of the Escrow account, payment systems operated by non-bank entities for issuance of PPIs shall be deemed to be ‘designated payment systems’ under Section 23A of the said Act. Maintenance of escrow balance shall be subject to the following conditions:-

(i) The escrow balance shall necessarily be maintained with only one scheduled commercial bank at any point of time.

(ii) In case there is a need to shift the escrow account from one bank to another, the same shall be effected in a time-bound manner without unduly impacting the payment cycle to the merchants. The migration shall be completed in the minimum possible time and with the prior approval of RBI.

(iii) The balance in the escrow account shall not, at the end of the day, be lower than the value of outstanding PPIs and payments due to merchants. While as far as possible PPI issuers shall ensure immediate credit of funds to escrow on issue, load / reload of PPIs to the PPI holders, under any circumstances such credit to escrow account shall not be later than the close of business day (the day on which the PPI has been issued, loaded / reloaded)

(iv) Following debits and credits shall only be permitted from the escrow account:

Credits

a.       Payments received towards issue, load / reload of PPIs, including at agent locations

b.      Refunds received for failed / disputed / returned / cancelled transactions.

Debits

c.       Payments to various merchants/service providers towards reimbursement of claims received from them

d.      Payment to sponsor bank for processing funds transfer instructions received from PPI holders as permitted by RBI from time to time.

e.       Payment towards applicable Government taxes (received along with PPI sale/reload amount from the buyers)

f.       Refunds towards cancellation of transactions in a PPI in case of PPIs loaded / reloaded erroneously or through fraudulent means (on establishment of erroneous transfer /fraud). The funds shall be credited back to the same source from where these were received. These funds are not to be forfeited till the disposal of the case.

g.      Any other payment due to the PPI issuer in the normal course of operating the PPI business (for instance, service charges, forfeited amount, commissions)

h.      Any other debit as directed by the regulator / courts / law enforcement agencies.

Note: The payment towards service charges and commission shall be at pre-determined rates/frequency. Such transfers shall only be effected to a designated bank account of the PPI issuer as indicated in the agreement with the bank where escrow account is maintained.

(v) PPI issuer shall be required to submit the list of merchants acquired by it to the bank and update the same from time to time. The bank shall be required to ensure that payments are to be made only to eligible merchants / purposes. There should be an exclusive clause in the agreement signed between the PPI issuer and bank maintaining escrow account towards usage of balance in escrow account only for the purposes mentioned above.

(vi) With the growing acceptance of PPIs in e-commerce payments, including in digital market places, the payment mechanism is often facilitated using the services of payment aggregators / payment gateways. In such a scenario, the emerging practice observed is that the PPI Issuer has the necessary agreements with the digital marketplace and/or the payment aggregator / gateway rather than the individual merchants who are accepting the PPIs issued by the Issuer as a payment instrument. In view of the above, PPI issuers shall obtain an undertaking along with the list of the merchants (who are actually accepting payments through the PPIs of the Issuers) from the digital marketplace and/or payment aggregator / gateway that the payments made by the Issuers is used for onward payments to the respective merchants. This undertaking and list shall be submitted by the Issuers to the bank maintain the escrow account.

(vii) Banks maintaining the escrow accounts of PPI Issuers shall maintain the updated merchant list. Such banks shall also submit a certificate to this effect to the Reserve Bank of India.

(viii) Further, there shall also be an exclusive clause in the agreement signed/to be signed between the issuer/operator and the bank maintaining ‘escrow account’, which would enable the bank to use the money in the 'escrow account' only for making payment to the merchants/holders in preference to the other creditors in the event of liquidation / bankruptcy of the issuer.

(ix) A certificate, as prescribed by the Bank from time to time shall be submitted by the authorised entities, signed by the auditor(s), on a quarterly basis. Such certificate shall be submitted certifying that the person has been maintaining adequate balance in the account to cover the outstanding value of prepaid payment instruments issued including payments due to merchants. The certificates, as per the prescribed format, shall be submitted within a fortnight from the end of the quarter to which it pertains.

(x) The entities shall also submit an annual certificate, as above, coinciding with the accounting year of the entity to the Reserve Bank of India.

(xi) Adequate records indicating the daily position of the value of instruments outstanding including payments due to merchants vis-à-vis balances maintained with the banks in the escrow accounts shall be made available for scrutiny to the Reserve Bank or the bank where the account is maintained on demand.

(xii) Settlement of funds with merchants shall not be co-mingled with other business handled, if any by the PPI issuer.

(xiii) No interest shall be payable by the bank on such balances, except as indicated in para 11.4 below.

11.4 As an exception to the above (11.3 xiii), the non-bank PPI issuer can enter into an agreement with the bank where escrow account is maintained, to transfer "core portion" of the amount, in the escrow account to a separate account on which interest is payable, subject to the following:-

i) The bank shall satisfy itself that the amount deposited represents the "core portion" after due verification of necessary documents.

ii) The amount shall be linked to the escrow account, i.e. the amounts held in the interest bearing account shall be available to the bank, to meet payment requirements of the entity, in case of any shortfall in the escrow account.

iii) This facility is permissible to entities who have been in business for at least one year (26 fortnights).

iv) No loan is permissible against such deposits. Banks shall not issue any deposit receipts or mark any lien on the amount held in such form of deposits.

v) Core portion as calculated above will remain linked to the escrow account. The escrow balance and core portion maintained should be clearly disclosed in the Auditors certificates submitted to Reserve Bank of India on quarterly and annual basis.

Note: For the purpose of these guidelines "Core Portion" may be computed as under:-

Step 1: Compute lowest daily outstanding balance (LB) on a fortnightly (FN) basis, for one year (26 fortnights) from the preceding month.

Step 2: Calculate the average of the lowest fortnightly outstanding balances [(LB1 of FN1+ LB2 of FN2+ ........+ LB26 of FN26) divided by26].

Step 3: The average balance so computed represents the "Core Portion" eligible to earn interest.

12. Validity

12.1 All prepaid payment instruments issued in the country shall have a minimum validity period of one year from the date of activation/issuance to the holder.

12.2 PPI issuers shall caution the PPI holder at reasonable intervals, during the 45 days’ period prior to expiry of validity period of the PPI. The caution advice shall be sent by SMS / e-mail / post or by any other means in the language preferred by the holder indicated at the time of issuance of the PPI. Even after the expiry of validity period, grace period of at least 60 days shall be given to the customer.

12.3 Issuers shall clearly indicate to the customer at the time of issuance and load / reload of PPIs the information about expiry period as well as forfeiture policy. Such information shall be clearly enunciated in the terms and conditions of sale of PPI. Where applicable, it shall also be clearly outlined on the website of the issuer.

12.4 PPIs with zero balance for a consecutive period of one year shall be closed automatically by the issuers, and a notice sent to the PPI holders.

12.5 PPI issuers shall give the holders an option to close the PPI and transfer the balance as per the applicable limits of that category of PPI. For this purpose, the Issuers shall provide an option to the holder to provide details of pre-designated bank account or other PPIs of same issuer to which the balance amount available in the PPI shall be transferred in the event of closure of such PPIs.

12.6 The framework for forfeiture of PPIs shall be advised by the Reserve Bank of India in due course.

13. Transactions Limits

13.1 There is no separate limit on purchase of goods and services using PPIs and the holder is allowed to use the PPI for these purposes within the overall PPI limit applicable. PPI Issuers shall decide to put in place such limits taking into account the risk perception of the holders as per their risk management policy.

13.2 Transaction limits and monthly caps, if any, indicated against each category of the PPI shall be adhered to.

13.3 Handling refunds:

a.       Refunds in case of failed / returned / rejected / cancelled transactions shall be applied to the respective PPI account immediately, to the extent that payment was made initially by debit to the PPI, even if such application of funds results in exceeding the limits prescribed for that category of PPI.

b.      PPI issuers shall be required to maintain complete details of such returns / refunds etc. and be in readiness to provide them as and when called for.

c.       Further, PPIs issuers shall also be required to put in place necessary systems that enable them to monitor frequent instances of refunds taking in place in specific accounts and shall be in a position to substantiate with proof for audit purposes to the regulator.

13.4 In the case of open system prepaid payment instruments issued by banks in India, cash withdrawal at POS shall be permitted upto a limit of Rs.2000/- per day in rural areas and Rs.1000/- per day in other areas, subject to the same conditions as applicable hitherto to debit cards (for cash withdrawal at POS).

14. Redemption

14.1 The issuer of such instruments shall not dishonour customer instructions for payments/transfer of money, at approved locations, if there is sufficient balance outstanding against the instrument.

14.2 The holders of prepaid payment instrument shall be permitted to redeem the balance outstanding within the expiry date, if for any reason the scheme is being wound-up or is directed by the Reserve Bank to be discontinued.

15. Security, Fraud prevention and Risk Management Framework

15.1 PPI issuers shall put in place adequate information and data security infrastructure and systems for prevention and detection of frauds. A strong risk management system is equally necessary for the Issuers to meet the challenges of fraud and customer protection.

15.2 All PPI issuers shall put in place Board approved Information Security policy for the safety and security of the payment systems operated by them, and implement security measures in accordance with this policy to mitigate identified risks. PPI issuers shall review the security measures on on-going basis but at least once a year, and after any major security incident or breach or before a major change to its infrastructure or procedures.

15.3 Accordingly, PPI Issuers shall ensure that the following framework is put in place to address the safety and security concerns, ensure risk mitigation and fraud prevention:

a.       In case of wallets, PPI Issuers shall ensure that separate login is provided for the PPI account, and access to PPI is not made part of access to other services offered by the PPI Issuer or its associate / parent / group company etc.

b.      Issuers shall put in place appropriate mechanisms to restrict multiple invalid attempts to login/access to the PPI account, inactivity timeout features etc.

c.       Issuers shall provide customer induced options for fixing a cap on transaction value for different types of transactions / beneficiaries. Customers shall be allowed to increase the caps or exceed the cap, with additional authentication and validation.

d.      Issuers shall put in place limit on the number of beneficiaries that may be added in a day per PPI.

e.       Issuers shall introduce a system of alert when a beneficiary is added.

f.       Issuers shall introduce a system of additional factor of authentication for authenticating transactions in PPIs, including where PPIs are issued in the form of cards.

g.      Issuers shall put in place the mechanism to send alerts when transactions are done using the PPIs. In addition to the debit or credit amount intimation, the alert shall also indicate the balance available / remaining in the PPI after completion of the said transaction.

h.      Issuers shall put in place mechanism for velocity check on the number of transactions effected per day/ per beneficiary.

i.        PPI issuers shall put in place suitable cooling period for funds transfer upon opening the PPI or loading of funds into the PPI or after adding a beneficiary so as to mitigate the fraudulent use of PPIs.

j.        Issuers shall put in place suitable internal and external escalation mechanisms in case of suspicious operations, besides alerting the customer in case of such transactions.

k.      Issuers shall also put in place suitable mechanism to prevent, detect and restrict occurrence of fraudulent transactions including loading / reloading funds into the PPI.

15.4 Issuers shall put in place centralized database/ MIS to prevent multiple purchase of PPIs at different locations, leading to circumvention of limits, if any, prescribed for their issuance.

15.5 Where APIs are provided to their authorised / designated agents, Issuers shall ensure that the compliance to regulatory requirements is strictly adhered to by the systems.

15.6 PPI issuers (banks and non-banks) shall report the frauds on a monthly / quarterly basis to the concerned Regional Office (Mumbai Regional Office for banks) in the format prescribed in these Directions. Instances of fraud along with the modus-operandi adopted by the perpetrators, if known and analysed, shall be reported separately.

15.7 PPI issuers shall establish a mechanism for monitoring, handling and follow-up of cyber security incidents and cyber security breaches. The same shall be reported immediately to Reserve Bank of India. It shall also be reported to CERT-IN as per the details notified by CERT-IN.

16. Customer Protection and Grievance Redressal Framework

16.1 PPI Issuers shall disclose all important terms and conditions in clear and simple language (preferably in English, Hindi and the local language) comprehensible to the holders while issuing the instruments. These disclosures shall include:

a.       All charges and fees associated with the use of the instrument.

b.      The expiry period and the terms and conditions pertaining to expiration of the instrument.

c.       The customer service telephone numbers, including a toll-free number and website URL, where available.

16.2 PPI Issuers shall put in place a formal, publicly disclosed customer grievance redressal framework, including designating a nodal officer to handle the customer complaints / grievances, the escalation matrix and turn-around-times for complaint resolution. The framework shall include, at the minimum, the following:

a.       PPI Issuers shall disseminate information of their customer protection and grievance redressal policy widely in at least three languages, including regional languages.

b.      Customer care contact details (telephone numbers, toll free numbers, email address, postal address etc.) shall be clearly indicated on Issuer website, if available; in the mobile wallet apps, if provided; and printed on the cards, if issued.

c.       PPI agents shall display proper signage of the PPI Issuer, the customer care contacts details as above, and also the name and contact details of the nodal officials for grievance redressal.

d.      PPI Issuers shall endeavor to provide specific numbers for the complaints lodged along with the facility to track the status of the complaint by the customer.

e.       PPI Issuers shall initiate action to resolve any customer complaint / grievance not later than 48 hours and endeavor to resolve the complaint within 30 days from the date of receipt of such complaint / grievance.

16.3 In case of PPIs issued by banks, customers shall have recourse to Banking Ombudsman Scheme for grievance redressal. Banks shall also be responsible for addressing customer grievance issues for co-branded PPIs issued by them.

16.4 PPI issuers shall create sufficient awareness and educate customers in the secure use of the PPIs, including the need for keeping passwords confidential, procedure to be following in case of loss or theft of authentication data or if any fraud / abuse is detected, etc.

16.5 PPI Issuers shall clearly outline the amount and process of determining customer liability in case of unauthorized / fraudulent transactions involving PPIs. This framework shall be consistent with the customer liability limit instructions issued by the Reserve Bank of India from time to time.

16.6 PPI issuers shall provide an option for the PPI holders to generate / receive account statements. The account statement shall, at the minimum, contain details such as date of transaction, debit / credit amount, net balance and description of transaction. The PPI issuer shall also provide transaction history for a reasonable amount of period.

16.7 PPI Issuers shall report the receipt of complaints and action taken status thereon in the prescribed format and frequency.

16.8 PPI Issuers shall ensure transparency in pricing and the charges as under:

a.       Ensure uniformity in charges at agent levels

b.      Disclosure of charges for various types of transactions

c.       Specific agreements with agents prohibiting them from charging any fee to the customers directly for services rendered by them on behalf of the PPI Issuers

d.      Require each retail outlet/sub-agent to post a signage indicating their status as service providers for the PPI issuer and the fees for all services available at the outlet

e.       The cash collected from the customer should be acknowledged by issuing a receipt (printed or electronic) on behalf of the PPI issuer

17. System Audit:

17.1 The System Audit is to be conducted by a firm of Chartered Accountants. The System Audit may be conducted by a Certified Information Systems Auditor (CISA) and registered with Information Systems Audit and Control Association (ISACA) or by a holder of a Diploma in Information System Audit (DISA) qualification of the Institute of Chartered Accountants of India (ICAI) on an Annual basis.

17.2 The scope of the System Audit shall include the following:

a.       Technology deployed so as to ensure that the authorized payment system is being operated in a safe, secure, sound and efficient manner.

b.      Evaluation of the hardware structure, operating systems and critical applications, security and controls in place, including access controls on key applications, disaster recovery plans, training of personnel managing systems and applications, documentation, etc.

c.       Compliance as per security best practices, specifically the application security lifecycle and patch/vulnerability and change management aspects for the authorised system and adherence to the process flow approved by the Reserve Bank.

d.      Comment on the deviations, if any, in the processes followed from the process flow submitted to the Reserve Bank while seeking authorisation.

17.3 Authorised entities which follow an April-March financial year, shall submit the System Audit report within two months of the close of financial year i.e. by 1st June of that year. Authorised entities following a calendar year annual closing, shall submit their System Audit reports by 1st March of the following year.

17.4 Banks shall also be guided by the circular DBS.CO/CSITE/BC.11/33.01.001/2015-16 on Cyber Security Framework in Banks dated June 02, 2016, which inter alia, covers requirements for mobile-based applications.

17.5 All PPI Issuers shall, at the minimum, put in place following framework in respect of mobile wallets:

i.            The PPI mobile app should not be allowed to be installed on rooted devices i.e. system level access should not be allowed.

ii.            Application Life Cycle Security: The source code audits to be conducted by professionally competent personnel/ service providers or have assurance from application providers/ OEMs that the application is free from embedded malicious / fraudulent code.

iii.            Security Operations Centre SOC: Integration of system level (Server), application level logs of mobile applications (PPIs) with SOC for centralised and coordinated monitoring and management of security related incidents.

iv.            Anti-Phishing: PPI Issuers should subscribe to Anti-phishing/ anti-rouge app services from external service providers for identifying and taking down phishing websites/ rouge applications in the wake of increase of rogue mobile apps/ phishing attacks.

v.            Risk based Transaction Monitoring: Risk based transaction monitoring or surveillance process shall be implemented as part of fraud risk management system.

vi.            Vendor Risk Management: (a) PPI issuer may necessarily enter into agreement with the service provider that amongst others provides for right of audit / inspection by the regulators of the country; (b) Reserve Bank of India shall have access to all information resources (online/ in person) that are consumed by PPI provider, to be made accessible to RBI officials by the Banks when sought, though the infrastructure / enabling resources may not physically be located in the premises of PPI provider; and (c) Further, PPI issuer have to adhere to the relevant legal and regulatory requirements relating to geographical location of infrastructure and movement of data out of borders.

vii.            Disaster Recovery: PPI issuer should consider having DR facility to achieve the RTO/ RPO objective for the PPI system. PPI issuers should have BCP/ DR capabilities and shall adequately and effectively support the PPIs cyber resilience objectives and should be so designed to enable the PPI issuer to recover rapidly from cyber-attacks/ other incidents and safely resume critical operations aligned with recovery time objectives while ensuring security of processes and data is protected.

viii.            Data loss prevention (DLP)/ Data Masking Solutions: DLP solution at end-points, network need to be implemented. Data Masking solution need to be implemented.

18. Interoperability

Entities meeting the revised eligibility criteria and adhering to other instructions on safety, security, risk mitigation etc. contained in these Directions shall be allowed to participate in other interoperable payment systems, as and when specificdirections are issued in this regard.

19. Reporting requirements

PPI Issuers shall submit the reports as per prescribed templates and frequency.

Quarterly certificate on balance in Escrow Account by Auditor

Other information: Average time taken for payments to merchants

Share of Funds transfer in total payments made

Net-worth Certificate

This is with reference to the paragraph 5.2 and 5.3 of these Master Direction on PPIs. We have perused the records maintained by the Company. On the basis of our perusal of the records, the audited/ unaudited financial statements for the period ended _______ and the information and explanations given to us, we certify that the Company’s net-worth computed in accordance with the paragraph 5.3 of these Master Directions as at ________ is Rs. _______ (refer Annexure-A for computation).

This certificate has been provided by us at the request of the Company and prepared solely for the purpose of submission to the RBI.

Annexure A

Computation of net-worth of __________ as on _________

Monthly Certificate on Fraud Reporting

Name of PPI issuing entity:
Month:

Note: Others may include cases detected by the PPI issuing entity itself

Appendix

List of Circulars consolidated for the Master Circular

¹ ‘Control’ shall have the same meaning as under Section 2 (27) of the Companies Act 2013 and for listed company shall include any additional parameters as per SEBI guidelines, if applicable.

² In case KYC is done using One Time Pin (OTP) based e-KYC, then the instructions as applicable to opening this type of account / PPI shall be applicable.

³ Includes the minimum detail PPIs as per paragraph 7.2(i) of the Master Circular DPSS.CO.PD.PPI.No.01/02.14.006/2016-17 dated July 1, 2016 and PPIs issued to merchants as per paragraph (ii) of the circular DPSS.CO.PD.No.1288/02.14.006/2016-17 dated November 22, 2016

⁴ In case KYC is done using One Time Pin (OTP) based e-KYC, then the instructions as applicable to opening this type of account / PPI shall be applicable