Annual system audit including cybersecurity audit by CERT-In empanelled auditors, mandated under the RBI 2025 PA Master Direction. Security Brigade delivers regulator-ready PA-PG compliance with technical depth that goes beyond checkbox audits.
Payment Aggregators operating under RBI authorisation must undergo annual system audits conducted by CERT-In empanelled auditors. Security Brigade combines deep payment ecosystem expertise with cybersecurity-first audit methodology to deliver PA-PG compliance that satisfies regulators and strengthens your security posture. Trusted by leading payment aggregators, fintechs, and banks across India.
Trusted by India's leading enterprises
What is in force
The Reserve Bank of India (Regulation of Payment Aggregators) Directions, 2025 took effect on issue. If your compliance programme is built on the 2020 guidelines, it is built on a repealed text.
| What | As the Directions state it | Reference |
|---|---|---|
| Who they apply to | All bank and non-bank entities undertaking the business of Payment Aggregator as defined in the Directions, and additionally all Authorised Dealer banks and Scheduled Commercial Banks which engage with entities undertaking PA business, to the extent specified. Payment Gateway is defined in the Directions as an entity providing the technology infrastructure to route and facilitate processing of a payment transaction. | Para 3(a) |
| What they replaced | The Guidelines on Regulation of Payment Aggregators and Payment Gateways of 17 March 2020 and 31 March 2021, and the PA – Cross Border directions of 31 October 2023, are repealed with the issuance of this Master Direction, subject to savings for applications already pending. | Chapter VI |
| The audit | "An annual system audit, including cyber security audit, conducted by CERT-In empanelled auditors shall be carried out and report thereof shall be submitted to the respective Regional Office of DPSS, RBI within such timelines as may be prescribed by RBI." The auditor credential is named in the instrument itself, and the report has a stated destination. | Quoted from the Directions |
| Net worth | A minimum net worth of ₹15 crore at the time of tendering the application for authorisation, rising to ₹25 crore by the end of the third financial year, and maintained on an ongoing basis thereafter. Computation follows the RBI circular of 16 January 2015 on computation of net worth, with compulsorily convertible preference shares included. | Chapter II |
| Data storage | A PA shall comply with the data storage requirements applicable to Payment System Operators as laid out in the RBI circular of 6 April 2018, the storage-of-payment-system-data circular. The obligation is inherited by reference and never restated, which is why PA programmes routinely miss it. | Storage of Payment System Data |
| Form of entity | A non-bank PA shall be a company incorporated in India under the Companies Act, 2013, and its Memorandum of Association should cover the proposed activity of operating as a Payment Aggregator. Merchant funds sit in a separate escrow account with a Scheduled Commercial Bank in India. | Chapters II and V |
Who they apply to
What they replaced
The audit
Net worth
Data storage
Form of entity
Where these audits fail
Across payment-aggregator engagements the same four positions recur. The difference between them is almost never the security controls.
| State | What it means | What follows |
|---|---|---|
| Evidenced, and mapped to the text | Controls run, they produce records, and each record is mapped to the provision it answers, so the audit is a reading exercise, not a discovery one. | The cheap case. It is cheap because the mapping was done once, when the programme was built, instead of reconstructed annually under time pressure. |
| Controls without records | Access reviews happen, reconciliation happens, vendors are assessed, and none of it leaves an artefact with a date and a name on it. | The most common finding by a distance. A system audit reports what it can evidence, so an unevidenced control is indistinguishable from an absent one at the moment it matters. |
| Scoped to the payment path only | The assessment covers the transaction flow and stops there, leaving merchant onboarding, settlement reconciliation, refunds, disputes and the vendor estate outside. | An audit that passes and a business that is exposed. Merchant onboarding controls and settlement handling are where aggregator risk concentrates, and they are not on the transaction path. |
| Data storage assumed | Production is in India and nobody has checked the backups, the disaster-recovery copy, the logs, the analytics pipeline or the third-party processors. | The obligation arrives by reference from the 2018 circular and not as its own chapter here, so it is read as background. It is the one we most often find unverified. |
The inherited obligation
One clause of the Directions does a great deal of work in a single sentence: a Payment Aggregator shall comply with the data storage requirements applicable to Payment System Operators, as laid out in the Reserve Bank’s circular of 6 April 2018 on storage of payment system data. Nothing else in the chapter elaborates it, and that is exactly why it gets missed. A compliance team reading the Master Direction end to end finds chapters on authorisation, capital, escrow, merchant onboarding and security, and one cross-reference that looks like a footnote. It is not a footnote. It brings the whole of the 2018 storage regime onto the aggregator, including the annual System Audit Report the storage circular requires from a CERT-In empanelled auditor, board-approved before it reaches the Reserve Bank. In practice this means two things for scoping. First, the data question is not answered by where the production database runs: it is answered by where every copy of the data lives, which means backups, the disaster-recovery site, application and transaction logs, analytics and reporting stores, and any third-party processor in the chain. Second, an aggregator that treats the system audit and the storage audit as one exercise, with one evidence base, spends materially less than one that discovers in month eleven that they are two submissions with two audiences. We scope them together for that reason.
How the engagement runs
The Directions name the destination, the respective Regional Office of DPSS, so the report is written for that submission from the start, not adapted for it afterwards.
Methodology
Every engagement follows this process through Lemon, our proprietary audit management platform.
Security Brigade's PA-PG audit methodology is built on our universal SAR (System Audit Report) framework, enhanced with payment-specific controls from the RBI 2025 PA Master Direction. Every phase is tracked through our Lemon audit management platform ensuring complete evidence traceability, structured remediation, and a clean audit trail for regulatory submission.
We begin by mapping your PA or PG operations against every requirement in the RBI PA Master Direction. This includes identifying systems in scope such as applications, APIs, infrastructure, databases, cloud environments, third-party integrations, payment flows, and data stores. Scope is documented and agreed before fieldwork begins.
We document your complete payment data flow from merchant integration through transaction processing, escrow management, settlement, refund, and dispute handling. This includes data localisation verification ensuring payment data resides exclusively in India across production, backups, DR, logs, analytics, and third-party processors.
We validate each control area against the PA Master Direction requirements: merchant onboarding KYC, escrow controls, settlement flows, card and payment data handling, PCI-DSS/PA-DSS relevance, baseline technology controls, access management, encryption, key management, change management, backup, DR, and vendor controls. Evidence is collected and mapped in Lemon.
The dedicated cybersecurity audit component covers vulnerability assessment, penetration testing of payment applications and APIs, security configuration review, network segmentation validation, incident response readiness, and alignment with the RBI cyber security framework. Testing is executed through our B-52 audit engine for consistent coverage.
Every non-compliance and control gap is documented with risk rating, evidence expectation, and practical remediation guidance. We work with your CTO, engineering, security, and compliance teams to close gaps. Lemon tracks each item through to closure with validation evidence.
We deliver the final PA-PG System Audit Report including the cybersecurity audit report, control matrix, data-flow annexures, technical findings, and board-ready executive summary. The report is structured for RBI submission and includes the closure validation pack confirming all identified gaps have been addressed.
"We needed an assessment on a 3-week timeline because of a partner integration deadline. Security Brigade turned it around in 18 days, including the L2 and L3 reviews. The report was regulator-ready — we submitted it to our partner's compliance team unchanged. When speed and credibility both matter, they're the only call we make."
Continuous Compliance with ShadowMap
An annual audit proves your posture at a single point in time. Between audits, attack surfaces drift, credentials leak, sub-domains get added, vendors get breached. ShadowMap watches the boundary continuously so the next audit isn't a surprise.
Continuous discovery of internet-facing assets: sub-domains, APIs, cloud resources, open ports, SSL certificates, technology stack.
Audits are point-in-time. ShadowMap watches your boundary daily.
Explore on ShadowMap12B+ breach records indexed; monitors Telegram, paste sites, criminal forums, and ransomware leak sites for credentials, leaked data, and threat actor mentions.
Find leaked data before regulators do.
Explore on ShadowMapFAQ
The questions that decide scope and timing. Talk to our team about your payment estate.
Contact usTalk to our compliance team about your annual PA-PG system audit requirements
Typically responds within 1 business day · No commitment required
