Exclusive: RBI extends payment aggregator merchant KYC deadline by six months, sources say

The Reserve Bank of India (RBI) has extended by six months the deadline for payment aggregators (PAs) to complete KYC and due diligence of their existing merchants, according to two people aware of the matter.

The decision was communicated to the industry over the weekend, sources told The Head and Tale. This provides payment aggregators additional time to complete the exercise that has emerged as a significant operational challenge, particularly for firms serving millions of small and informal merchants.

The extension comes weeks after payment aggregators sought more time from the central bank to comply with the September 15 deadline amid a growing backlog of merchants awaiting re-KYC.

The RBI's consolidated Master Direction on Regulation of Payment Aggregators, issued in September 2025, requires PAs to undertake customer due diligence of merchants in accordance with its KYC framework. For merchants onboarded up to December 31, 2025, the directions originally gave PAs one year from the issuance of the Master Direction to complete the required due diligence, effectively setting the September 15, 2026 deadline. 

From January 1, 2026, new merchants have had to be onboarded in accordance with the enhanced due-diligence requirements.

Under the RBI framework, PAs are required to undertake customer due diligence and with the merchant’s consent, retrieve KYC records from the Central KYC Records Registry (CKYCR). For small merchants, an alternative route can involve PAN verification, physical verification of the merchant’s place of business and verification of an officially valid document. The rules also require PAs to conduct background and antecedent checks and ensure appropriate merchant category codes are allotted.

The biggest challenge for large payment aggregators is the sheer scale of the exercise. Industry executives said firms such as Paytm, PhonePe, Google Pay have millions of merchants on their platforms, making physical verification of merchants across the country a massive manpower-intensive exercise.

The Master Directions mandates in-person KYC to be conducted only by the payment aggregator's own employees, and this cannot be outsourced to a third-party agency.

“Assuming these payments firms have 5-20 million merchants – to complete the re-KYC of existing merchants from January 1, 2026, would require the companies to recruit tens of thousands of on-roll employees just to conduct the physical verification, documentation and other checks of so many merchants. Building such significant field capacity is challenging.”

“Even if you do CKYC, you still have to do OSV (original seen and verified), latitude and longitude,” one industry executive said. 

Industry executives said video-based KYC has also not emerged as an effective solution for the long tail of merchants. According to a senior payments company official, video KYC has had a success rate of only around 2% in some merchant segments because of the stringent requirements involved.

“Video KYC is failing to solve the gap because it has a dismal 2-5% success rate due to strict technical and regulatory constraints. Video submissions are automatically rejected if the camera or the merchant’s hand shakes even slightly. The system geotags the video call, but if a merchant is travelling and the video's GPS location does not perfectly match their registered business pin code, the KYC fails,” another payments company co-founder explained.

Even where a merchant completes CKYC or video-based verification, discrepancies in the merchant's registered address or business location can trigger the need for additional verification. For small businesses, the address on their KYC documents can differ from the location from which they actually operate. In such cases, physical verification becomes necessary.

PAs can only utilize CKYC with consent to onboard a merchant if there is “absolutely no variance in the data. However, address discrepancies are extremely common because merchants frequently operate in locations different from the address listed on their original documents.”

And if there is any variance in the data, the aggregator cannot perform the verification online or via camera. Instead, a field executive from the company must physically visit the contact point or perform an in-person, original document verification.

The RBI's Master Direction defines Contact Point Verification (CPV) as physical verification of the address or place of business of a merchant. For merchants with annual turnover of up to Rs 40 lakh, or annual export turnover of up to Rs 5 lakh, the alternative due-diligence process specifically includes CPV.

The field verification can also require the PA to establish the nature of the merchant's business, including assigning the appropriate Merchant Category Code (MCC). The payments company official further stated the field personnel may therefore need to visit the merchant's premises, capture photographs and verify the actual business activity before completing the process.

“The issue is not just KYC. You have to do diligence as well,” co-founder at a payments firm added.

The six-month extension is expected to provide some breathing room to PAs that were unlikely to complete the exercise across their entire merchant base by September 15.