Note on Neobanks

Introduction: What is a Neobank?..............................................................................................4

Co-Branded Cards and PPIs.......................................................................................................5
Debit/Credit/Corporate Cards................................................................................................5
Legal Matrix.......................................................................................................................6
Approval for Co-Branded Cards....................................................................................6
Banks..........................................................................................................................6
NBFCs........................................................................................................................6
Conditions for Issuance of Co-Branded Debit/Credit Cards..........................................7
Bank’s Branding in Co-branded Cards: Meaning of Prominent Display..................8
Marketing of Co-branded Cards.................................................................................9
Liability of the Card Issuer......................................................................................10
Limited Role of Neobanks as Co-Branding Partners...............................................10
Virtual Cards: Can virtual card be issued without the need of physical card?........11
PPIs and PPI Cards...............................................................................................................11
Regulation of PPIs............................................................................................................11
Type of PPIs.................................................................................................................12
Approval for Co-Branded PPIs....................................................................................13
Banks........................................................................................................................13
Non-Bank Entities (NBFCs/FinTech entities).........................................................13
Whether PPIs can be issued through physical/virtual cards?.......................................14
Co-Branding Arrangement: Conditions for PPIs and PPI Cards.....................................14
Card-Issuer’s Branding on Co-Branded PPIs..............................................................14
Liability of PPI Issuers.................................................................................................15
Limitations on the Role of co-branding entity.............................................................15
Interest on PPIs................................................................................................................16
Outsourcing by Banking Services............................................................................................16
Outsourcing by Banks..........................................................................................................16
Kind of activities allowed to be outsourced.....................................................................17
Liability for outsourced services......................................................................................17
Issuance of Co-branded cards..........................................................................................17
Clarification to the Bank Outsourcing Guidelines...........................................................17
Internal Audit of Outsourced Activities.......................................................................18
Enhanced Scrutiny on Sub-Contractors.......................................................................18

Page 1 of 38
 Outsourcing by NBFCs........................................................................................................18
Outsourcing within a Group/Conglomerate.....................................................................19
Digital Lending by Neobanks and Role of NBFCs..................................................................19
Regulatory Framework for Digital Lending........................................................................19
Disclosure requirements with regard to Loan Agreement and Lending Partner..............20
Unlawful Recovery Methods and Harassment by BNPL Entities...................................23
Prepaid Cards loaded through Credit Lines: Current Market Practice................................24
Report of Working Group on Digital Lending.....................................................................24
Payment Gateway Services......................................................................................................25
Meaning and Functioning....................................................................................................25
Regulation............................................................................................................................26
Approval to undertake PA Business....................................................................................26
Banks................................................................................................................................26
Non-Bank Entities (Neobanks)........................................................................................26
Requirements for Authorisation...........................................................................................27
Amendment to MoA or Creation of Separate Entity.......................................................27
Capital Requirements.......................................................................................................27
Fit and Proper Criteria for Promoters of PA....................................................................27
Disclosure of Takeover/Acquisition....................................................................................28
Nodal Officer for Grievance and Regulatory Requirement.................................................28
Board Approved Policies.....................................................................................................28
Tokenisation of Card Details...............................................................................................29
Outsourcing: Whether Neobanks acting as PAs outsource services while providing
payment gateway service?....................................................................................................30
Escrow Account.......................................................................................................................30
Payment Aggregators...........................................................................................................30
Regulation........................................................................................................................31
Creation of Escrow Account........................................................................................31
Settlement of Funds through Escrow Account.............................................................31
Management of funds...................................................................................................31
Compliance Responsibilities: the PA or Bank?...........................................................32
Is Escrow Account an interest-bearing account?.........................................................32
Reports and Certificate to be Submitted by PA...........................................................32
Prepaid Payment Instruments...............................................................................................32
Regulation........................................................................................................................33

Page 2 of 38
 Deployment of Money into Escrow Account...............................................................33
Undertaking from E-commerce platforms...................................................................34
Investments..............................................................................................................................34
Fixed Deposits and Recurring Deposits...............................................................................34
Mutual Funds and Model Portfolios....................................................................................35

Page 3 of 38
 INTRODUCTION: WHAT IS A NEOBANK?
Neo banks in India are unregulated entities thereby, can’t be technically termed as banks,
however, in broad sense, they are financial service providers albeit they offer such services in
partnership with traditional banks. Neobanks only have online presence in stark contrast to
brick-and-mortar branches of traditional banks. Neobanks have integrated finance with
technology by integrating Application Programming Interface (“API”) to their interactive
user interface to explore the untapped market of tech-savvy youngsters who don’t have
access to easy credit and small business which have been ignored by the banking industry for
quite a long time.

Since Neobanks offer varied services which contain a mix of e-wallets, credits cards, buy
now pay later service (“BNPL”), payment gateway services, payroll management etc., no one
single regulation regulates their activities. Further, since many of these services are
performed with the banking partners, various other regulations come into play.

Further, there are no particular offerings that make a fintech entity a Neobank. Even
registered Prepaid Payment Instruments (“PPI”) entities i.e., the fintech firms who offer
online wallets, offering BNPL, Credit Card or other allied financial services can be termed as
Neobank. While PhonePe is an RBI registered Account Aggregator, PPI and Mutual Fund
Distributor entity, it hosts various other unregulated financial services with partnering banks
which makes in come under the wide umbrella of unregulated fintech firms with online
presence only.

Therefore, considering that neo banks are unregulated, it’s solely the offerings i.e., the
financial service that a Neo Bank provides determines what legal matrix would apply to each
product and to the neo bank.

However, in recent press conference, RBI Governor rejected the idea to regulate the neo
banks or the ‘digital only banks’ and the reason for the same was the systematic risk that
these entities may pose to the financial sector. Governor added by saying, “There is no
proposal on neo-banks or digital banks because we feel that the existing banks and NBFCs
can adopt more and more technology for delivery of banking services.”

Further, the ban on the Neobanks from loading credit in e-wallets and perhaps prepaid cards
also, has hit several fintech players offering BNPL services. Few fintech start-ups; Jupiter
and EarlySalary have already suspended their credit linked e-wallet and card services. Such

Page 4 of 38
instances depict a conservative perspective of RBI regarding Neobanks and it also gives an
impression that regulatory environment for Neobanks is highly unpredictable and is going to
be very challenging.

CO-BRANDED CARDS AND PPIS

Neobanks being unregulated entities are not authorised by RBI to undertake banking
functions. Thereby, to issue cards, Neobanks enter into an agreement with Banks to offer
cards; bearing the branding of both, the Neobank and the Bank. Such agreement is said to be
the co-branded arrangement and the cards issued thereunder are termed as ‘co-branded
cards’. It must be noted that issuance of co-branded cards is not limited to Neobanks.
Merchants like Flipkart, Amazon, Indian Oil etc. may also act as co-branding entities to offer
such cards to their customers.

In Indian Fintech landscape; Slice, UNI, Lazypay, Fi, Open etc. offer cards while marketing
them as their own product, however, in essence such cards are co-branded cards.

These cards, issued in the form of Prepaid cards, Debit cards, Credit Cards and Corporate
Cards, are governed by RBI through different yet similar norms. While buy now pay later
(“BNPL”) entities offer prepaid cards; often in association with SBM Bank and fund/load
such cards with credit lines sanctioned from NBFCs, other entities like Fi and Open offer
Debit and Corporate cards respectively.

On the other hand, Neobanks also offer online wallets. Jupiter, Paytm, Amazon Pay etc offer
such wallets and in legal parlance they are known as Prepaid Payment Instruments (“PPIs”).
A PPI is a product which enables purchase of goods and services against the value stored in
it. Apart from online wallets, it comprises of gift cards, metro smart cards, prepaid vouchers
etc. PPIs are regulated and only authorised non-bank entities can issue PPIs.

In current fintech arena, PPIs are being modelled in quite a creative manner. PayTM wallet is
a classic example of online wallet offered by an authorised PPI issuer. Non-bank entities with
no authorisation have also entered the game by forming co-branding arrangements with
authorised PPI issuers. Jupiter offers BNPL service through online wallet issued under co-
branding arrangement with LivQuick; an authorised PPI issuer. Further, prepaid cards issued
by BNPL entities are also PPIs but issued in form of cards. Prepaid cards also come under the
ambit of PPIs and can be issued by banks only. Since Neobanks are non-bank entities, they

Page 5 of 38
cannot independently issue prepaid cards. Thereby, they adopt the route of offering co-
branded cards.

Debit/Credit/Corporate Cards

Neobanks provide the Debit and Credit cards which are issued to the customer within seconds
with entire process done online at your fingertips. As observed earlier, these are co-branded
cards issued by Banks in tie-up with Neobanks.

Corporate cards are debit and credit cards, issued to the businesses exclusively for business
expenses. These can be used by multiple employees for business related transactions. Open
currently offers corporate cards in form of debit or credit as per the preference of the
enterprise. Again, these are also offered under co-branding arrangement with Banks.

Legal Matrix

As per the latest mandate of RBI, the co-branded arrangement for debit, prepaid and credit
cards will be governed by the Master Direction – Credit Card and Debit Card – Issuance
and Conduct Directions, 2022 dated April 21, 2022 (“Card Directions”) with effect from
July 1, 2022. Chapter VI of the said directions exclusively deals with the co-branded cards
while providing for various conditions thereunder.

Approval for Co-Branded Cards

Banks

Banks have the general approval for issuance co-branded debit, prepaid and credit card as per
the Paragraph 17(a) of the Card Directions. Thereby, Banks don’t need to a prior approval of
RBI to issue co-branded cards.

With respect to Debit card, banks were granted general approval to issue co-branded debit
cards vide Guidelines for issue of debit cards by banks dated December 12, 2012 (“Debit
Card Guidelines”). Before such general approval, Banks could issue co-branded debit cards,
however, a one-time prior approval from RBI was necessary.

Whereas for Credit cards, there has never been a mandate of prior approval from RBI for
issuance co-branded credit cards. Paragraph 1.3.3 of the Master Circular on Credit Card
Operations of banks dated July 2, 2007 validated the practice of issuance of co-branded
credit cards and advised banks to do undertake proper due diligence before entering into such
arrangement.

Page 6 of 38
Thereby, in brief, issuance of both debit and credit co-branded cards by Banks doesn’t require
a prior approval from RBI.

NBFCs

With effect from July 1, 2022, in accordance with Card Directions, NBFCs will be allowed to
undertake credit business independently without any tie-up with Scheduled Commercial
Banks (“SCBs”). Until now, only two public sector NBFCs were allowed to issue credit cards
– SBI Cards and Bank of Baroda Cards.

In contrast to Banks, as per Paragraph 4(d) of the Card Directions, NBFCs need RBI’s
approval to undertake credit card business. The approval can be sought only when such
NBFCs meet the requirement of minimum net owned fund of Rs. 100 Crore. In addition, a
Certificate of Registration is also required.

Paragraph 96 and Paragraph 82 of Master Direction - Non-Banking Financial Company -

Systemically Important Non-Deposit taking Company and Deposit taking Company
(Reserve Bank) Directions, 2016 (“NBFC NDSI”) and Master Direction - Non-Banking
Financial Company – Non-Systemically Important Non-Deposit taking Company (Reserve
Bank) Directions, 2016 (“NBFC ND-NSI”) also respectively allow the concerned NBFCs to
issue credit cards considering the conditions stated thereunder which are same as mentioned
in Paragraph 4(d) of the Card Directions.

However, NBFCs can’t issue co-branded cards with Neobanks. NBFCs can enter into a co-
branding arrangement with Banks only, as inferred from Paragraph 22 of the Card Directions.
It fails to mention any tie-up with any non-bank entities except Banks. Further, as per
Paragraph 97 and Paragraph 83 of NBFC NDSI and NBFC ND-NSI respectively, NBFCs can
enter into co-branding arrangement for credit cards with SCBs only. Even in this case, a prior
approval of RBI is required which shall be valid for 2 years and a review thereafter.

Leading fintech start-ups; Slice and Lazypay, currently have the NBFC licence.
GaragePreneurs Internet Pvt Ltd. is the parent company of Slice and has secured NBFC
licence for operating Quadrillion Finance Private Limited; lending partner of Slice.
Meanwhile, Lazypay is part of the PayU Group and PayU Finance Pvt. Ltd. is the lending
partner of Lazypay. Further, various fintech entities are in race to get NBFC licences.

Page 7 of 38
Since NBFCs can issue credit cards on their own once they get RBI’s approval, Neobanks
will be able to indirectly issue credit cards themselves through the NBFCs owned by their
parent entities.

Neobanks might turn to such route considering the RBI’s latest crackdown on the loading of
PPIs by non-bank PPI issuers via credit lines raised from NBFCs. Neobanks offering prepaid
cards for their BNPL service are likely to be severely impacted and might have to shutdown
their card operations. However, further clarifications with respect to co-branding
arrangements with non-bank entities would be needed for Neobanks to consider issuing credit
cards through their own NBFCs considering how unpredictable RBI’s response to fintech
lending is turning out to be.

Conditions for Issuance of Co-Branded Debit/Credit Cards

Bank’s Branding in Co-branded Cards: Meaning of Prominent Display

Co-branded card is defined in Paragraph 3(ix) of the Card Directions as; “a card that is
issued jointly by a card-issuer and a co-branding entity bearing the names of both the
partnering entities.” Accordingly, names of both the Bank and the Neobank should be
present on the card. The manner in which the said branding shall be done is provided in
Paragraph 17 of the Card Directions.

Paragraph 17(b) of the Card Directions mandates co-branded debit/credit cards should
explicitly indicate in the card itself that it is a co-branded card. Further, Paragraph 17(c) of
the Card Directions in addition states that co-branded cards should prominently bear the
branding of the card issuer.

The virtual cards issued through the Neobank’s app have branding of the Neobanks and card
network i.e., VISA or Mastercard only. No branding of the card issuer is present on virtual
cards across the fintech space. The definition of co-branded card as observed should bear the
names of both the partnering entities. Thereby, Neobanks like Fi, Open, Jupiter etc. offering
debit cards may be at the risk of violating Paragraph 17(b) and (c) of the Card Directions
because neither there is any explicit indication nor prominent display of the card issuer’s
brand on such virtual cards.

Further, in case of physical cards, the card issuer i.e., the Bank’s branding is printed on the
backside of the card. In light of such market practice, the interpretation of ‘prominent’ needs

Page 8 of 38
to be analysed. Would placement of card issuer’s name at the backside of the card amount to
prominently displaying the issuer’s brand?

As per definition of co-branded card, names of the both the partnering entities should be
present. Further, even though branding of the issuing Bank is displayed at the backside of the
card, it is an explicit display of the card issuer’s branding as mandated through Paragraph
17(b) of the Card Directions.

However, it would be difficult to satisfy Paragraph 17(c) of the Card Directions. Considering
RBI’s strict stance against Neobanks, the word ‘prominent’ shall mean that the card issuer’s
branding should be done in an upfront manner and hence be shown on the frontside of the
card. Also, RBI added Paragraph 17(c) in addition to the condition given in Paragraph 17(b)
of the Card Directions. The intention of the RBI behind such addition is clearly that branding
of co-branded cards should not depict that non-bank entities are issuing such cards. Paragraph
17(b) of the Card Directions itself mentions that co-branding partner shall not advertise or
market the card as its own product. Thereby, RBI intends that at first look itself, the card shall
depict it is a co-branded card with issuing Bank’s branding being prominently displayed on
the card i.e., on the frontside of the card itself.

It must be noted that neither Paragraph 3(ix) of the Card Directions while defining the co-
branded card nor Paragraph 17(c) while mandating prominent display of card issuer’s name,
explicitly state that that the front part of the card shall mention the name of both the entities.
Thereby, this is open to interpretation and clarification is needed for the same. But in case of
virtual co-branded cards, there is a clear violation of the directions as observed above.

Marketing of Co-branded Cards

Card Directions vide Paragraph 17(b) has prevented the co-branding partner i.e., the Neobank
to advertise or market the card as their own product. However, the major players in the
market appear to advertise the card offered by them as their own product. Only in their T&Cs
or while issuing it they disclose the actual banking parent.

Furthermore, Paragraph 17(b)’s last sentence states that the name of issuer of the card i.e.,
bank should be clearly shown in all the marketing/advertising material. It is observed that Fi
& Niyo’s Instagram and Google Ads feature their partnering bank’s name to comply with
such directions. But there are other facets of marketing and advertising where such
disclosures are done in an obscure manner.

Page 9 of 38
Website of a Neobank is a primary marketing channel for them. It is clearly evident from the
websites of Fi and Open that they market their debit/credit cards as their own. Only when the
User scrolls to the end section of website or visits T&Cs, banking partners are shown.
However, nothing is explicitly displayed.

Packaging of the card shall also come under the ambit of marketing. Fi’s packaging doesn’t
bear any branding of Federal Bank; the card issuer of Fi’s Debit card. This effectively gives
the impression that Fi is itself issuing the card.

Moreover, with respect to Open, in its T&Cs, it states that the corporate card will carry the
branding of Open. However, it fails to state that since it is a co-branded card, branding of
Open as well as Bank will be there on the said card.

Neobanks with regard to such practices seem to be bypassing the RBI’s directions. Since
these directions come into effect from July 1, 2022, it is expected that such Neobanks will
amend their T&Cs and incorporate necessary changes in their marketing/advertising materials
soon.

Liability of the Card Issuer

Card-issuers are liable for any infraction or lapse by the co-branding partners as per the
Paragraph 20 of the Card Directions. For any acts of Neobanks, it is the Banks who would
come under the RBI scanner because as per Paragraph 20, issuance of co-branded cards is a
financial service outsourced by Banks to the co-branding partners and the same is governed
by the Guidelines on Managing Risks and Code of Conduct in Outsourcing of Financial
Services by banks dated November 3, 2006 (“Bank Outsourcing Guidelines”). Outsourcing
of banking services has been discussed in detail in the later section below.

Almost every other card; debit/credit/prepaid, offered by Neo Banks is marketed on pretext of
cashback and instant discount offers. Paragraph 20 of the Card Directions provides that
Banks should keep a check on Neobanks with respect various offers and ensure they deliver
such offers to Users in a timely fashion. If there is any case of non-delivery then it would the
Banks and not these fintech entities who would be held liable.

Moreover, as depicted in the Terms and Conditions (“T&Cs”) of Fi, Niyo & Open, they
explicitly state that the partnering bank is the entity which is responsible for issuance and
handling of the cards and any grievance is to be handled by bank themselves.

Page 10 of 38
Limited Role of Neobanks as Co-Branding Partners

RBI has further limited the role of non-bank entities post issuance of card. While the role was
limited to marketing/distribution and providing subsequent services related to the card like an
interactive platform which current Neobanks offer, the Card Directions have gone a step
further. Paragraph 21(b) of the Card Directions prevents Neobanks to access the information
relating to transactions done from the card and further states that non-banking entities should
not be involved in any of the processes or controls relating to the card. This limits the
Neobanks to be a mere marketeer and grievance addressing entity.

These directions would put a dent in Fintech space and their business models since all
Neobanks bank on the data they accumulate with regard to each user and if they are not able
to access the various details of the transactions, it might hinder their plans to evaluate user’s
spending and accordingly shell out more credit. Further, these entities use transaction data to
offer various insights on expenses and rewards on basis of such transactions. Such practice of
harnessing data was not regulated before but with these directions, it has to be seen to what
extent Neobanks limit their access and role in card offerings.

In light of such mandate, some fintech entities are thinking to adopt a different route to
bypass the directions. FinTech entities might create a separate entity through their parent
entity that may function as Technology Service Provider which may access transaction data.
Since Banks are allowed to outsource their services vide Bank Outsourcing Guidelines,
Banks can outsource data services to such entities. Thereby, the co-branding entity which is
offering the co-branded card will not access data, however, a separate entity will get such
data from the card issuing Bank and help fintech entities to offer their services seamlessly.
RBI recently released draft guidelines for governing outsourcing of IT services dated June 23,
2022 which may in future govern such practice.

Virtual Cards: Can virtual card be issued without the need of physical card?

Many Neobanks only offer virtual cards. Under Card Directions, Paragraph 3(xii) and 3(xiv)
with regard to the Credit and Debit card respectively, provide that both can be either physical
or virtual payment instrument. Thereby, Neobanks can issue virtual only cards if they wish so
since there is no compulsion on issuance of physical cards.

However, with regard to PPI cards, it is not clear whether issuance of virtual only cards is
allowed or not. Major Neobanks in prepaid card segment like LazyPay, Slice & UNI are

Page 11 of 38
issuing physical as well as virtual cards to each user. The PPI Directions and MD-PPIs fail to
address such issue.

PPIs and PPI Cards

Regulation of PPIs

To regulate the issuance of PPIs, RBI in late 2000s came up with Issuance and Operation of
Pre-paid Payment Instruments in India (Reserve Bank) Directions, 2009 dated April 27,
2009. This circular has been replaced vide the Reserve Bank of India (Issuance and
Operation of Prepaid Payment Instruments) Directions, 2017 dated October 11, 2017 (“PPI
Directions”) which stands updated as on November 12, 2021 by Reserve Bank of India
Master Directions on Prepaid Payment Instruments, 2021 (“MD-PPIs”).

Co-branded prepaid cards i.e., co-branded PPIs issued in card format, in addition to PPI
Directions and MD-PPIs, are also governed by the Card Directions.

Before the Card Directions, the co-branding arrangement for prepaid cards was regulated
through Issuance of rupee denominated co-branded pre-paid cards dated December 12,
2021 which was later updated vide Master Circular on Credit Card, Debit Card and Rupee
Denominated Co-branded Pre-paid Card Operations of Banks and Credit Card issuing
NBFCs dated July 1, 2015 (“Prepaid Card Circular”). However, with issue of the Card
Directions, these circulars have been repealed.

Type of PPIs

Paragraph 2.3 of the PPI Directions while providing for three types of PPIs states, “PPIs are
payment instruments that facilitate purchase of goods and services, including financial
services, remittance facilities, etc., against the value stored on such instruments.” The types
of PPIs mentioned thereunder are:

1. Closed System PPIs: These PPIs are exclusive to a particular entity. They are issued
by an entity for facilitating the purchase of goods and services from that entity only.
Since such PPIs can’t be used for payments or settlement for third party services,
they don’t require any approval or authorisation from RBI. Further no cash
withdrawal is permitted from such PPIs.

Page 12 of 38
 Gift cards issued by e-commerce merchants, brand specific paper/ online vouchers,
coupons etc. are examples of Closed System PPIs.
2. Semi-Closed System PPIs: PPIs which can be used to purchase only at a set of
determined merchants or payment gateways which are permitted by the issuer to
accept such PPI come within the ambit of semi-closed PPIs. User can’t use them at
any place wherever they may wish. Further, no cash can be withdrawn from such
PPIs.

Online wallets are good examples of such PPIs. Paytm wallet/Ola Money/Amazon
Pay wallet can be used only at places where the merchants have a specific contract
with the respective PPI wallet issuer to accept and receive the money in the wallet
itself. Such a contract can be through a payment aggregator or a payment gateway
and does not need to be directly between the issuer and the establishment accepting
the PPI as a payment option. 
3. Open System PPIs: These PPIs are issued by Bank only and can be used anywhere
irrespective of the contract between the issuer and the merchant with freedom to
withdraw cash from ATM or POS terminals.

These are the PPIs under which the Neobanks are issuing a spin off version of
traditional credit cards. Since non-bank entities are not permitted to issued such
prepaid cards, Neobanks tie-up with Banks under co-branded arrangement as
observed above to issue such prepaid cards. User of the card is not allowed to load
the card, however, such cards are loaded through credit lines raised extended from
NBFCs. Thereby, in this manner, Neobanks are able to offer BNPL service through
an open system PPI issued in card format.

Approval for Co-Branded PPIs

Banks

As per Paragraph 3.1 of the MD-PPIs, Banks need one time approval to issue PPIs. With
respect to co-branded open system PPI, the Card Directions vide Paragraph 17(a) has given
general approval to issue co-branded prepaid cards. Such general approval to issue co-
branded prepaid cards was given first time through Prepaid Card Circular in 2015. Before
such circular, bank had to take one-time approval to issue co-branded PPIs.

Page 13 of 38
Therefore, if a bank has the approval for issuance of PPI, it can issue co-branded PPI cards as
well. In case of Neobank providing the co-branded PPI card, the issuing Bank needs to have
RBI approval for issuance of PPIs.

Non-Bank Entities (NBFCs/FinTech entities)

PPIs can be issued only by such NBFCs/FinTech entities who have received authorisation
from RBI to function as authorised PPI Issuers. As per Paragraph 4.1 of the MD-PPIs, non-
bank entities are permitted to issue PPIs only after obtaining authorisation from RBI
considering they meet the eligibility criteria as given under Paragraph 4 of the MD-PPIs.
Such authorisation is granted in line of the process entailed in Paragraph 5 of MD-PPIs.

Thereby, only registered PPI entities can issue PPIs as given in the list provided in
Certificates of Authorisation issued by the Reserve Bank of India under the Payment and
Settlement Systems Act, 2007 for Setting up and Operating Payment System dated May 25,
2022 under the head; ‘Prepaid Payment Instruments’.

It must be noted that non-banks can only issue closed and semi-closed system PPIs. If a non-
bank entity issues a co-branded semi-closed system PPI, then the non-bank issuer shall take
one time approval from RBI for issuance of co-branded PPIs as per Para 7.11(i) of the MD-
PPIs.

Jupiter offers a BNPL product named JupiterEdge. It is an online wallet offering BNPL
service which is loaded with credit lines extended from NBFCs. Online wallet is a PPI as
observed above and Jupiter is not an RBI authorised PPI issuer. Hence, such online wallet is a
co-branded PPI offered in tie-up with LivQuik; an authorised PPI Issuer. Herein, the LivQuik
must have one time approval from RBI to issue co-branded PPI for carrying out such
exercise.

In conclusion, if a Neobank wishes to issue a co-branded semi-closed system PPI; firstly, it

should be an RBI authorised PPI Issuer or if the Neobank is not authorised, it shall partner
with an RBI authorised PPI Issuer and secondly, the non-bank issuer of the said PPI shall
take one-time approval for issuance of co-branded PPIs.

Whether PPIs can be issued through physical/virtual cards?

As it was observed, that Neobank entities issue “Prepaid Cards” by partnering with Banks.
Such prepaid cards are open system PPI which can be issued only by Banks.

Page 14 of 38
Para 7.7 of the MD-PPIs states that “The PPIs may be issued as cards, wallets, and any such
form / instrument which can be used to access the PPI and to use the amount therein.” In
light of such direction, open system PPIs can be issued in card or in form of similar type.
However, Neobanks being non-banks, they can’t issue open-system PPIs, nor they can issue
cards.

To provide the facility of “Prepaid Cards”, fintech firms engage in the co-branding
arrangement with the Banks to issue such cards. The PPI Directions and MD-PPIs provide
directions for such arrangement also.

Co-Branding Arrangement: Conditions for PPIs and PPI Cards

Paragraph 7.11 of the MD-PPIs exclusively deals with various conditions that need to be
taken care of while issuance of co-branded cards and online wallets. Para 7.11(f) permits a
PPI issuer to co-brand the PPIs with the name/logo of the Neobank entity for whose customer
such online wallets/cards are issued. Thereby, it is this Paragraph which enables the
Neobanks to provide prepaid cards with their brand names.

Card Directions also apply to the co-branded prepaid cards as per Paragraph 17(a) of the said
directions. Chapter IV of the directions deals with the co-branding arrangement and in
addition to compliances as given in MD-PPIs, issuing Banks will have to comply with Card
Directions also.

Card-Issuer’s Branding on Co-Branded PPIs

Be it a Bank or an RBI Authorised non- bank PPI Issuer, as per Paragraph 7.11(g) of the MD-
PPIs, the prepaid card or the online wallet shall prominently show the name of such PPI
issuer. Further, with respect to prepaid card, Paragraph 17(c) of the Card Directions in
addition states that co-branded cards should prominently bear the branding of the card
issuer.

However, as evident from the Neobanks which are providing such co-branded prepaid cards
in the market currently, in case of virtual cards, the issuing Bank’s branding is not displayed
on the card. Further, with respect to physical cards, the name of the issuing Bank is
mentioned on the backside of the card only. Also, if online wallets are considered, for
instance; JupiterEdge, it does not display the branding of LivQuik, the PPI Issuer of
JupiterEdge’s co-branded online wallet.

Page 15 of 38
Thereby, for online wallets there is clear violation of Paragraph 7.11(g) of the MD-PPIs and
for prepaid virtual cards, in addition to violation of Paragraph 7.11(g) of the MD-PPIs, there
is violation of Paragraph 17(c) of the Card Directions.

With respect to physical prepaid cards, there is a probable violation of Paragraph 17(c)
considering the interpretation of the word ‘prominent’ thereunder. Would placement of card
issuer’s name at the backside of the card amount to prominently displaying the issuer’s
brand?

To avoid reiteration of the arguments and the analysis, the reader is advised to refer to the
Section: Bank’s Branding in Co-branded Cards: Meaning of Prominent Display for
better clarity with respect to question on interpretation of the word ‘prominent’. Since, the
wordings of Paragraph 7.11(g) of the MD-PPIs and Paragraph 17(c) is similar, the same
analysis is applicable to PPIs also.

Liability of PPI Issuers

As stated in the Terms and Conditions (“T&Cs”) of the Slice, UNI, JupiterEdge etc. PPI
issuer i.e., Bank in the case of prepaid cards and RBI authorised FinTech entity in case of
online wallets, is the entity which is responsible for issuance and handling of the cards and
any grievance is to be handled by bank/fintech entity themselves. Paragraph 7.11(e) of the
MD-PPIs also provides the same. It’s the PPI issuer who would be liable for acts of co-
branding partner and would be responsible for the customer related aspects of the PPI.

Hence, the ultimate responsibility rests on the PPI issuers for the acts of co-branding partners.

Limitations on the Role of co-branding entity

In case of co-branding arrangements between a bank and non-bank entity, as per Paragraph
7.11(j) of the MD-PPIs, the non-banking entity should limit its role to marketing or
distribution of PPIs or providing the access to the User to any of the services with respect to
the PPI. Since such limitation is imposed on arrangements between a bank and non-bank
entity, it is inferred that it applies to open system PPIs i.e., prepaid cards only.

PPI cards offered by Slice, UNI, Lazypay etc. clearly delineate such role in their Card T&Cs
or FAQs; wherein, they explicitly provide that the card shall be governed as per T&Cs of the
card issuer i.e., Bank.

With Card Directions coming into force from July 1, 2022, role of Neobanks would be
curtailed to nothing more than a marketeer of prepaid cards. In addition to above restrictions,

Page 16 of 38
Paragraph 21(b) of the Card Directions prevents Neobanks to access the information relating
to transactions done from the card and further states that non-banking entities should not be
involved in any of the processes or controls relating to the card. This Paragraph has in effect
casted a shadow on viability co-branded prepaid cards offered by the Neobanks. Only on
basis of the data accumulated by Neobanks, they are able to determine creditworthiness and
spending patterns of their Users. If this access is stopped, Neobanks would fail to assess the
customers. Since the said direction is also applicable on debit/credit co-branded cards, to
avoid to reiteration of the analysis, the reader is advised to refer to the Section: Limited Role
of Neobanks as Co-Branding Partners.

However, there are no such limitations imposed on co-branding partner of co-branded semi
closed system PPIs. In case of JupiterEdge as observed, the online wallet is offered under co-
branding arrangement with non-bank PPI issuer; Livquik. Since there is no mention of any
limitation on non-bank co-branding partner either in PPI Directions or MD-PPIs, it is inferred
that it is up to the PPI Issuer to determine how it wishes to limit the role of co-branding
partner through co-branding agreement.

Interest on PPIs

PPIs are not interest-bearing instruments. It must be noted that any fund lying in a savings
account of a bank earns you an interest on the same, however, as per Para 7.4 of the MD-
PPIs, no interest is payable on the PPI balances and PPI issuers are warned against paying
any interest on the same. Hence, no interest shall be payable by PPI Issuers on the balances
reflected either on prepaid cards or online wallets.

OUTSOURCING BY BANKING SERVICES

Majority of the products offered by Neobanks are the financial services that are being
outsourced by the traditional banks. Such outsourcing has been enabled through the
outsourcing guidelines as given by RBI. It is only on account of such guidelines that
Neobanks are able to offer such services in partnership with banks.

Outsourcing by Banks

RBI through Guidelines on Managing Risks and Code of Conduct in Outsourcing of

Financial Services by banks dated November 3, 2006 (“Bank Outsourcing Guidelines”)
gave general approval to outsource the financial services whether in India or outside India.

Page 17 of 38
Paragraph 1.6(i) of the Bank Outsourcing Guidelines states that no prior approval of RBI
would be required for outsourcing of financial services by banks.

Kind of activities allowed to be outsourced

With regard to activities that can be outsourced, Paragraph 2 of the Bank Outsourcing
Guidelines provides that all other financial services can be outsourced except as stated
thereunder, “Banks which choose to outsource financial services should however not
outsource core management functions including Internal Audit, Compliance function and
decision-making functions like determining compliance with KYC norms for opening deposit
accounts, according sanction for loans (including retail loans) and management of
investment portfolio”.

Thereby, getting customers for cards, managing the platform to access the account, opening
of current/saving accounts, integration of APIs etc which Neobanks do in partnership with
banks does not in any manner affect the functions as stipulated in the Paragraph 2 above.

Liability for outsourced services

As we have observed from T&Cs of various Neobanks, ultimate responsibility and liability
lies on the partner banks for the services offered. Bank Outsourcing Guidelines also provide
for the same. Paragraph 4 of the Bank Outsourcing Guidelines elaborates on the bank’s role
and states that banks should have the ultimate control over the outsourced service.

Banks need to check whether proper approvals or licences have been taken by the third party.
Further, in case of any customer complaint regarding any outsourced service, customers have
the ultimate rights towards the bank and a grievance redressal mechanism needs to be put in
place by the bank for addressing the complaints regarding the outsourced service.

Issuance of Co-branded cards

These guidelines need to be taken care of while entering into co-branding arrangement for co-
branded card. Paragraph 20 of the Card directions and Chapter III Paragraph 4 of the Prepaid
Card Circular provide that co-branding arrangement in both the cases should be in
accordance with Bank Outsourcing Guidelines.

Clarification to the Bank Outsourcing Guidelines

Responsibilities of banks under Bank Outsourcing Guidelines were further clarified by RBI
through Guidelines on Managing Risks and Code of Conduct in Outsourcing of Financial
Services by Banks dated March 11, 2015 (“Additional Outsourcing Guidelines”). These

Page 18 of 38
guidelines act as clarification to the roles of the banks as mentioned in Bank Outsourcing
Guidelines.

Internal Audit of Outsourced Activities

Additional guidelines vide Paragraph 5 of the Additional Outsourcing Guidelines state that
internal audit of all outsourced activities should be conducted by the ACB of the bank and for
that purpose a proper system should also exist in the bank.

Enhanced Scrutiny on Sub-Contractors

Neobanks often engage with third parties for offering their products. Since Neobanks’
product is an outsourced financial service, the service providers would be the sub-contractors
to whom Neobanks further delegate the work. As per Paragraph 5.5.1 of the Bank
Outsourcing Guidelines, the outsourcing agreement shall have a clause regarding prior
approval/consent of the Bank for the use of sub-contractors by the service provider i.e., the
Neobank.

Thereby, the Neobank has to approach the Bank for its consent to engage sub-contractors. As
per Paragraph 3 of the Additional Outsourcing Guidelines, before giving the consent, bank
should review the subcontracting arrangements and ensure that these arrangements are
compliant with the Bank Outsourcing Guidelines. Hence, even the sub-contractors are
governed by the Bank Outsourcing Guidelines and the same conditions as discussed above
would be applicable to sub-contracting arrangements also.

Outsourcing by NBFCs
To govern NBFC’s outsourcing practices, RBI came out with Directions on Managing Risks
and Code of Conduct in Outsourcing of Financial Services by NBFCs dated November 09,
2017 (“NBFC Outsourcing Directions”). Neobanks engage with NBFCs for digital lending
and such practice is enabled through the ability of NBFC through these directions to
outsource their financial services in the same manner as done by Banks.

With regard to the outsourced financial services, Paragraph 1.2 of the NBFC Outsourcing
Directions states that outsourced financial services may comprise of application processing
with regard to loans, document processing, marketing and research, supervision of loans etc.
Neobanks undertake such exercises only. Neobanks’ primary function is marketing of the
NBFCs’ products. Further, based on the data collected and research tools, Neobanks process
loan applications to customers which are ultimately financed by NBFCs.

Page 19 of 38
Paragraph 1.6(i) of the NBFC Outsourcing Directions gives general approval to NBFCs to
outsource their financial services.

NBFC Outsourcing Directions are similar to Bank Outsourcing Directions with few
directions which are unique to NBFC sector. In light of the same, to avoid reiteration of
conditions already discussed above, reader is advised to refer to the Kind of activities
allowed to be outsourced, Liability for outsourced services and Enhanced Scrutiny on Sub-
Contractors in line with NBFC Outsourcing Guidelines.

Outsourcing within a Group/Conglomerate

Various fintech firms’ parent companies have secured NBFC licence or are applying for
NBFC licence. GaragePreneurs Internet Pvt Ltd. is the parent company of Slice and has
secured NBFC licence for operating Quadrillion Finance Private Limited; lending partner of
Slice. Meanwhile, LazyPay is part of the PayU Group and PayU Finance Pvt. Ltd. is a
registered NBFC which acts as the lending partner of LazyPay. These Neobanks therefore are
not only marketing but are also underwriting the loans through their own licenced NBFCs.
Thereby, NBFCs are outsourcing their services within the same Group entity.

In light of the same, Paragraph 6.1 and Paragraph 6.4 of the NBFC Outsourcing Directions
need to be analysed. While 6.1 states that customers shall be informed specifically about the
company which is actually offering the product/ service, wherever there are multiple group
entities involved or any cross selling observed, 6.4 provides that marketing brochure of the
group entity should mention the nature of arrangement of the entity with the NBFC so that
customers are clear about who is selling/offering the product.

Such disclosure is provided by LazyPay in their website’s home page itself wherein, it is
explicitly mentioned that LazyPay is part of the PayU Group. However, with regard to Slice,
such disclosure is missing. Slice fails to mention any arrangement as mentioned above on
their website which can attract violation of above stated directions.

DIGITAL LENDING BY NEOBANKS AND ROLE OF NBFCS

Many Neobanks primary offering includes digital lending mostly. As stated above, such
entities shell out BNPL schemes under the garb of loans raised from NBFCs. Thereby, they
merely act as agents of NBFCs. In technical terms, NBFCs through digital apps give
Consumer Durable Loans which are effectively small unsecured loans because neither there

Page 20 of 38
is any collateral nor they can impound the purchased item from the customer. Repayment is
the only option.

Regulatory Framework for Digital Lending

In response to various fintech start-ups offering BNPL services, RBI on June 24, 2020 issued
a clarification to all Banks and NBFCs vide Loans Sourced by Banks and NBFCs over
Digital Lending Platforms: Adherence to Fair Practices Code and Outsourcing
Guidelines. (“Digital Lending Guidelines”). RBI while providing for additional checks,
reiterated that, “banks and NBFCs, irrespective of whether they lend through their own
digital lending platform or through an outsourced lending platform, must adhere to the Fair
Practices Code guidelines in letter and spirit. They must also meticulously follow regulatory
instructions on outsourcing of financial services and IT services”.

Since BNPL fintech start-ups effectively act as marketing platforms or agents for the NBFCs,
it is the NBFC which are outsourcing such financial service to them. This is in essence an
outsourcing arrangement between the NBFC and Neobanks. Hence, it is the NBFC
Outsourcing Directions as discussed above which needs to be complied with by the NBFCs
and Neobanks.

The Digital Lending Guidelines also reiterated directions provided in the NBFC Outsourcing
Directions that NBFC/Banks have the ultimate responsibility and obligations over the
outsourced activity. Outsourcing a financial service doesn’t diminish their obligations as sole
responsibility of compliance rests on them as per Bank Outsourcing Guidelines and NBFC
Outsourcing Directions.

In addition, the Digital Lending Directions insisted on compliance with Fair Practices Code
as given under Chapter VI and Chapter V of the NBFC NDSI and NBFC ND-NSI
respectively.

Disclosure requirements with regard to Loan Agreement and Lending Partner

Paragraph 4.3 of the NBFC Outsourcing Directions provides that, “In cases where the
customers are required to deal with the service providers in the process of dealing with the
NBFC, NBFCs shall incorporate a Para in the relative product literature/ brochures, etc.,
stating that they may use the services of agents in sales/ marketing etc. of the products. The
role of agents may be indicated in broad terms.”

Page 21 of 38
Neobanks do disclosure through their T&Cs the role of NBFCs and pass on the liability and
responsibility on the NBFC itself. However, this is not done in an upfront manner. It does not
enable a layman to understand that it is the NBFC which is shelling out a loan under the garb
of BNPL service offered by a Neobank. The relevant product literature of NBFCs is the loan
agreement and sanction letter. These documents state that NBFC is using the service of
Neobanks to offer loan to the User, however, such documents are not visible to the User in
case of various Neobanks.

In response to this, for active disclosure of Loan documents and information on Lending
Partners, Paragraph 4 of the Digital Lending Guidelines provided for certain instructions that
NBFCs and Banks need to follow when they engage Neobanks to source borrowers. Such
instructions are given below:

“a) Names of digital lending platforms engaged as agents shall be disclosed on the website
of banks/ NBFCs.

b) Digital lending platforms engaged as agents shall be directed to disclose upfront to the
customer, the name of the bank/ NBFC on whose behalf they are interacting with him.

c) Immediately after sanction but before execution of the loan agreement, the sanction letter
shall be issued to the borrower on the letter head of the bank/ NBFC concerned.

d) A copy of the loan agreement along with a copy each of all enclosures quoted in the loan
agreement shall be furnished to all borrowers at the time of sanction/ disbursement of loans.

e) Effective oversight and monitoring shall be ensured over the digital lending platforms
engaged by the banks/ NBFCs.

f) Adequate efforts shall be made towards creation of awareness about the grievance
redressal mechanism.”

With regard to Clause (a), as observed from various NBFC websites; like PayU Finance and
Quadrillion Finance Ltd., both mention Slice and LazyPay as their Digital Lending Partners
respectively. Neobanks’ websites also provide for the financing/lending partners under a
section of their website with NBFC’s grievance redressal mechanism stated therein. Relevant
point of contacts for raising the complaint directly to the NBFC are also mentioned. Hence,
Clause (a) and Clause (f) are effectively complied by NBFCs and Neobanks both.

Page 22 of 38
While NBFCs do state in their website and apps the lending/financing partners, nothing is
disclosed upfront to the User while he/she is executing the transaction as per Clause (b).
When executing a transaction through the app, a loan agreement is hyperlinked in a one-liner
statement which needs to be ticked by the User to depict that he/she has read the same.
However, nowhere the lending partner is disclosed upfront while execution of the transaction.

Neobanks rather disclose the name of lending partners passively than disclosing it in an
upfront manner as mandated. A BNPL user currently is able to know the name of the lending
partner i.e., the NBFC by either accessing his/her CIBIL report or referring to transaction
history on the Neobank’s platform.

With regard to the CIBIL report, only NBFC’s name is reflected but there is no mention of
corresponding digital lending platform through which such loan is sourced. This creates a
problem. If a User uses multiple BNPL apps, it would be hard for him/her to trace which
NBFC relates to which app’s monthly bill until and unless he manually checks the amount
and tally it with his respective BNPL app’s bill.

This problem could be solved considering the transaction history in Neobanks disclosed the
lending partner in an upfront manner. However, these Neobanks, fail to disclose the name of
lending partner for each transaction. Zestmoney is an exception. In transaction history of
Zestmoney, corresponding to each transaction, the name of concerned lending partner is
mentioned. Hence, in conclusion, compliance to Clause (b) is important, however, the same is
not being followed currently.

As per Clause (c), the sanction letter should be sent to the User under letter head of concerned
NBFC. As per current market practice, such disclosure is done in a passive manner by
providing hyperlinked loan agreement as stated above during execution of transaction. No
mail or message is sent to the User. A gullible investor will seldom open the Loan
Agreement, when he/she can simply tick the box and approve it to further proceed with the
transaction.

For instance, in case of Zest Money and LazyPay, once a user is in the final payment step in
an e-commerce platform and choses either of them, while paying, they will show final
confirm purchase page which contains a disclosure in following words, “By clicking on
“Confirm Purchase’ button, I agree to the terms and conditions of the Loan Agreement”.
Loan agreement is hyperlinked which takes you to the actual loan arrangement by the
concerned NBFC. However, there is neither any upfront disclosure nor any sanction letter is

Page 23 of 38
sent via message or e-mail. An upfront disclosure should rather explicitly state that the BNPL
service is in partnership with ‘xyz’ NBFC.

Also, a copy of the loan agreement should also be made available with supported documents
to the borrowers as per Clause (d). Again, such loan agreements are not sent. Only in case of
Zestmoney, in transaction history, a User can view the loan agreement and respective
enclosures with respect to each transaction. Otherwise in case of LazyPay, no such
accessibility to the loan agreement is there.

Thereby, users are not aware of a loan raised against them by an NBFC in lieu of BNPL
service availed by them. Loan document furnished to the User at the time of sanction of such
credit line is done in a passive manner which may attract scrutiny from RBI. Such loan is
extended to them for each transaction and same is reflected in the User’s Cibil report. Such
practice is in clear violation of Clause (d) as stated above.

NBFCs themselves are failing to oversee such infractions. Since two major players as
mentioned above; Slice and LazyPay, function through their own licenced NBFC, they seem
to lure customers under garb of BNPL without being transparent in their functioning.
However, such ignorance and lack of supervision may also attract RBI’s action under NBFC
Outsourcing Guidelines and Paragraph 4(e) of the Digital Lending Guidelines as stated above
for failing to monitor such actions.

Unlawful Recovery Methods and Harassment by BNPL Entities

Paragraph 4 of the NBFC Outsourcing Directions deals with NBFC’s role with regard to the
outsourced financial service. Paragraph 4.1 states that, “…..NBFCs would therefore be
responsible for the actions of their service provider including Direct Sales Agents/ Direct
Marketing Agents and recovery agents and the confidentiality of information pertaining to
the customers that is available with the service provider. NBFCs shall retain ultimate control
of the outsourced activity”.

Further, Paragraph 5.7 of the NBFC Outsourcing Directions provides for the Responsibilities
of Direct Marketing Agents and Recovery Agents. Recovery agents should not take any
action which may put NBFC’s reputation to risk and should observe strict customer
confidentiality as per Paragraph 5.7.2 of the NBFC Outsourcing Directions. With regard to
behaviour of agents, Paragraph 5.7.3 of the NBFC Outsourcing Directions states that, “The
NBFC and their agents shall not resort to intimidation or harassment of any kind, either
verbal or physical, against any person in their debt collection efforts, including acts intended

Page 24 of 38
to humiliate publicly or intrude the privacy of the debtors' family members, referees and
friends, making threatening and anonymous calls or making false and misleading
representations.”

In light of above stated paragraphs, it is observed that in case of defaults, recovery agents
harass the defaulted party in various ways. No confidentiality is maintained and since User’s
contacts are accessed by these Neobanks, the same data is shared with recovery agents.
Recovery agents then start calling and messaging the User’s relatives regarding the default by
the User. Such harassment is done to force the User to pay the defaulted amount.

Further, recovery agents represent themselves as agents of concerned fintech entity than the
NBFC. However, as discussed in the above section and in Paragraph of the NBFC
Outsourcing Directions above, the ultimate control rests with the NBFC. Hence, it is NBFC’s
responsibility to oversee such practice and ensure compliance.

Such practices are in violation of the Paragraph 31(3) under Fair Practices Code of the NBFC
NDSI and NBFC ND-NSI which specifically states that, “In the matter of recovery of loans,
an applicable NBFC shall not resort to undue harassment viz., persistently bothering the
borrowers at odd hours, use muscle power for recovery of loans etc. As complaints from
customers also include rude behaviour from the staff of the companies, applicable NBFC
shall ensure that the staff are adequately trained to deal with the customers in an
appropriate manner.”

Thereby, the concerned NBFC will be in violation for failing to oversee such practices. Even
the Neobanks can be held accountable since their responsibilities have been clearly carved
out in the NBFC Outsourcing Guidelines.

Prepaid Cards loaded through Credit Lines: Current Market Practice

RBI recently released a clarification regarding MD-PPIs to all the non-bank PPI issuers vide
Loading of PPIs through Credit Lines dated June 20, 2022. It questioned the exercise of
loading/reloading of the PPI instruments through credit lines extended from NBFCs.

Circular states that PPIs shall be loaded only through methods as specified in Paragraph 7.5
of the MD-PPIs. It states that, “PPIs shall be permitted to be loaded / reloaded by cash, debit
to a bank account, credit and debit cards, PPIs (as permitted from time to time) and other
payment instruments issued by regulated entities in India and shall be in INR only”.

Page 25 of 38
However, it is presumed that since such clarification is issued to non-bank PPI issuers, it does
not affect prepaid cards since they are issued by Banks.

It must be noted that the clarification has been given with respect to Paragraph 7.5 of the
MD-PPIs which is applicable to both; semi-closed system PPIs and open system PPIs.
Thereby, it is applicable to prepaid cards also. Since RBI has clarified that loading of PPIs
vide Paragraph 7.5 can not be done through credit lines, hence, even the prepaid cards can’t
be loaded through credit lines.

MD-PPIs applies to both Banks and Non-Banks. Merely because the clarification is issued to
non-banks doesn't permit Banks to circumvent the rules.

Further, MD-PPI rules on escrow account and deployment of money collected through PPIs
as given under Paragraph 12 are also being violated. Money collected in case of both; prepaid
cards and e-wallets has to hit the Bank and escrow account respectively. However, with PPIs
loaded with credit lines, such practice is not followed. Such practice has been analysed in
detail in section: Deployment of Money into Escrow Account.

Hence, RBI has not come up with a new direction. Such clarification is binding on both the
Banks as well as the Non-Banks and the Neobanks offering e-wallets and prepaid cards
loaded through credit lines extended from NBFCs might get hit severely.

Report of Working Group on Digital Lending

RBI on November 18, 2021 released a Report of the Working Group on Digital Lending
including Lending through Online Platforms and Mobile Apps to study the current market
practice of the unregulated BNPL sector and gave 26 recommendations in total to regulate the
BNPL sector and lending activity through neo banks.

The Report in details considered views of various stakeholders as provided in Annexure A

and stated the 26 recommendations while providing for the organisations who will be
responsible for its implementation like RBI itself, Government, Self-Regulatory Organisation
(to be setup as per the recommendations) and Digital India Trust Agency (an independent
body to be setup as per the recommendations).

However, the RBI Governor few days back has stated that they still don’t have any intention
to regulate BNPL market while stating that, “Buy-Now-Pay-Later which is offered by several
e-commerce companies is a lending activity, but we have to be careful and calibrated in our
approach and not start interfering everywhere,” the governor said. “If an e-commerce
Page 26 of 38
player is giving opportunity of BNPL let him carry on with that business. Our responsibility
is to keep assessing the kind of leverage that is building up in the total system and will it pose
a systemic level risk. Eventually if a real sector business fails it impacts the banking sector.
We are studying the segment, as and when it’s required, we will come out with guidelines.”

Hence, there is no set deadline when one can expect these recommendations to take shape
and be considered to regulate the BNPL market.

PAYMENT GATEWAY SERVICES

Meaning and Functioning
In today’s scenario there are multiple instruments of payment; from smart cards, online
wallets, UPI to bank transfer etc. Thereby, with more and more small businesses increasing
their online presence, there is a need for a payment network which allows a merchant to
receive payment from customers exercising multiple mode/instruments of payments. That’s
where Payment Aggregator (“PA”) and Payment Gateway Service (“PG”) providers step in.
Various fintech entities came up and enabled merchants to receive money from multiple
sources of payment from customers with entire process done online. Although Banks also
provided this facility but they lacked innovative technology required to process such
payments online while also providing for an interactive user interface. Banks mostly provided
limited payment options and lacked flexibility in enabling merchants to receive payments. An
all-in-one platform as provided by fintech startups like PayU and Razorpay, enabled any
small business or freelancer to receive payment from a customer even through a link sent as a
WhatsApp message.

Payment aggregator in simple terms is an entity which acts a middleman between the
merchant and the customer. It enables merchant to accept different payment instruments like
debit/credit card, online wallet, UPI, bank transfer etc. as per the convenience of the customer
without having to setup any account with the bank or any other hassle. Payment aggregator
undertakes this with its own or outsourced payment gateway; an online platform which
enables such transaction to take place. Payment aggregator collects funds from the
customer’s issuing bank (bank from which the payment is done) into an escrow account and
settles the amount in merchant account in acquirer bank. Such amount is settled in maximum
T+1 days or instantly as fast as 15 minutes. In normal scenario, merchant wouldn’t have been
able to do this by relying on acquiring bank only, hence, PAs help merchant connect with
acquiring bank and receive the payment.

Page 27 of 38
With Neobanks aiming to create an open banking ecosystem, such service of payment
gateway is much needed. Some Neobanks, for instance Open, offers full-fledged payment
gateway services while acting as Payment Aggregator. It also provides enabled APIs to
integrate such gateway into business’ app and website also.

While payment aggregator is an intermediary which helps in settlement of payments,

payment gateways which are mostly owned by PAs themselves, acts as an intermediary
platform which enables merchant and customer to interact and enable payment for the
good/service purchased.

Regulation
RBI has regulated this sector and PAs need to seek authorisation/licence from RBI as per
Guidelines on Regulation of Payment Aggregators and Payment Gateways dated March
17, 2020 as updated on November 17, 2020 (“PA Guidelines”). Some directions were later
revised through Guidelines on Regulation of Payment Aggregators and Payment Gateways
dated March 31, 2020 (“New PG Guidelines”). Meanwhile, PGs don’t need any approval or
authorisation; however, it is recommended they follow the Annex 2 of the said guidelines.

PAs are governed by Annex 1 of the PA Guidelines and need to also adopt the technology
recommendations for PGs given in Annex 2.

Approval to undertake PA Business

Banks

Banks don’t require a separate licence to operate as PAs as given under Paragraph 3.2 of the
PA Guidelines.

Non-Bank Entities (Neobanks)

Neobanks being non-bank entities will need authorisation under Payment and Settlement
Systems Act, 2007 (“PSSA”) to act as PA themselves as per Paragraph 3.2 of the PA
Guidelines.

It must be noted that RBI yet has not come out with the certificate of authorisation for any PA
and hence, there is no licenced PA yet. Only the guidelines are in effect and RBI is still
scrutinising the PAs to give approval.

Requirements for Authorisation

Page 28 of 38
Amendment to MoA or Creation of Separate Entity

Authorisation to act as PA is to be given considering that they are a company incorporated

under Companies Act, 1956/2013 with their MoA mentioning the intention of conducting PA
business as per Paragraph 3.3 of the PA Guidelines.

Given these directions, Neobank entities will have to either amend the MoA or create a
wholly owned subsidiary separately for conducting PA business like in case of Zomato.
Zomato has incorporated Zomato Payments Pvt. Ltd. to seek authorisation for undertaking
PA business. E-commerce platforms have adopted this practice because of the nature of
direction given under Paragraph 3.6 of the PA guidelines. Each e-commerce marketplace
needs to separate the PA business and then they can apply for the authorisation. Further as
per Paragraph 1.3 of the New PA Guidelines, e-commerce marketplaces taking services of
PAs will be considered as merchants. Post such clarification, Paragraph 3.6 of the PA
Guidelines makes more sense.

In case of Neobanks which exclusively deal in fintech sector, by meaning of Paragraph 3.3.
and Paragraph 3.6 of the PA Guidelines, they can continue to operate as PA with the same
underlying company without the need of creating a different arm. They can simply go ahead
by amending the MoA.

Capital Requirements

Capital requirements herein are to be met in two phases. Firstly, requirement of Rs. 15 Cr
initially at the time of applying for authorisation and then Rs. 25 Cr by the third financial year
of grant of authorisation as provided Paragraph 4.1 & 4.2 of the PA Guidelines. For such
purposes a CA certificate as per Paragraph 2.2 of New PA Guidelines need to submitted for
authorisation.

Fit and Proper Criteria for Promoters of PA

Many Neobanks don’t have a separate entity for undertaking PA business while they are
providing PG service. For instance, Open offers payment gateway service through the same
entity i.e. Open Financial Technologies Pvt. Ltd. Neobank entity itself will have to then
comply with Paragraph 5.1 of the PA Guidelines.

It requires the promoters of the PA entity to satisfy ‘fit and proper’ criteria to get
authorisation. Such criteria have been provided in Paragraph 3.1 of the New PA Guidelines.

Page 29 of 38
Meaning thereby, promoters of the Neobank entity itself will have to ensure they meet such
criteria.

Disclosure of Takeover/Acquisition
There is a larger scope of M&A activity in the FinTech space since various Neobanks are
new-age start-ups. Recently, Open launched a JV with IIFL to tap into the market of MSME
lending. In such case of takeover or acquisition, there is additional compliance which PA
Guidelines have put on the non-bank PAs. As per Paragraph 5.2 of the PA Guidelines, in case
of takeover/acquisiton/ any change in management control, the same should be
communicated to RBI. After such communication, RBI can place restrictions on new
management if the need arises considering the management doesn’t meet ‘fit and proper’
criteria.

In addition to fit and proper criteria, this is again an additional compliance. Neobank will
have to disclose their takeovers or acquisitions also because effectively the entity which is
registered as PA is the Neobank itself.

Nodal Officer for Grievance and Regulatory Requirement

While Neobanks must appoint and prominently display the details of Nodal officer for
regulatory and customer grievances in line with Paragraph 5.6 & 9.2 of the PA Guidelines.
The interpretation of word ‘prominently’ has to be inferred correctly. Will mere mentioning
of the details of Nodal officer in middle of grievance policy amount to ‘prominent display’?
Open has no prominent display of such details in its website. One has to surf through the
website and will later find the details in between its grievance policy.

Board Approved Policies

Further, PA entities are required to have board approved policies with regard to various
aspects as per the PA Guidelines. Neobanks then will need to have additional policies for
disposal of complaints / dispute resolution mechanism (Paragraph 5.5), merchant on-boarding
(Paragraph 7.1), information security (Paragraph 10.2) and IT strategy for data security
(Paragraph 1.7.3 of Technology Recommendations).

In addition to these guidelines, Neobank would need to send reports as required as per Annex
3 of the PA Guidelines. Such additional compliances are to be met by a Neobank acting as a
Payment Aggregator to effectively provide payment gateway services under the PA
Guidelines.

Page 30 of 38
Tokenisation of Card Details

Lastly, before current tokenisation rules, e-commerce platforms like Amazon or payment
apps like PayTm or be it any online merchant, used to save your card details as ‘saved cards’.
However, for enhanced security and data protection with regard to card transactions, RBI
disallowed PAs to store actual customer card credentials. Further, PAs were not allowed to
store the said card details even the on server accessed by the merchants as per Paragraph 10.4
of the PA Guidelines.

Later vide Paragraph 10 of the New PA Guidelines even the merchants onboard the PAs were
disallowed to store card details except for tracking transaction which also needs to be done as
per applicable laws.

Following, as per Paragraph 4 of the Tokenisation – Card Transactions: Permitting Card-

on-File Tokenisation (CoFT) Services dated September 07, 2021 (“Tokenisation Rules”),
PAs and merchants were permitted to store only last four digits of actual card number and
card issuer’s name for tracking purposes as stated in Paragraph 10 of the New PA Guidelines.
After June 30, 2022, such directions will have to be implemented and all card data needs to
be deleted as per Restriction on storage of actual card data [i.e. Card-on-File (CoF)] dated
December 23, 2021 (“CoF Restrictions”).

Card credentials are also known as Card-on-File (“CoF”) and vide Tokenisation Rules, RBI
extended the tokenisation framework - as given under Tokenisation – Card transactions
dated January 08, 2019 (“Tokenisation Framework”) to CoF Tokenisation (“CoFT”).

Quite similar to encryption of data, a unique code for card number i.e., token is generated by
Card Networks (VISA, Mastercard or Rupay) on request of token requestor (PAs, e-
commerce merchants or other merchants) and is later saved by the merchant or PA. Thereby,
PAs or merchants save a token instead of the actual card details of the customer. However, a
merchant can save a token and request token from card network only if the customer wishes
and expresses its consent for tokenisation of CoF (This is the reason why all payment apps
and e-commerce websites around December last year were asking users to given consent for
tokenisation lest their saved cards get deleted).

This entire framework can be found in relevant Paragraphs of the Tokenisation Framework.
Hence, no entity involved in payment system can store CoF except card issuers and card
networks as stated in Paragraph 2.b of CoF Restrictions. Neobanks acting as PAs and

Page 31 of 38
providing gateway services will have to adhere to the same by June 30, 2022 since the
deadline has already been extended twice.

Outsourcing: Whether Neobanks acting as PAs outsource services while providing

payment gateway service?

As per current market practice, Open provides payment gateway service and acts as a PA. In
its T&Cs, it has stated that Payment Gateway service is provided by integrating with various
service providers to offer an all-in-one platform for payment acceptance. PAs once
authorised; as under Section 4, Section 6 & Section 7 read with Section 2(i) of the PSSA and
relevant above stated guidelines, shall be termed as a payment system under PSSA. Further,
system provider is an entity operating an authorised payment system as per Section 2(p) of
the PSSA. Thereby, PAs are payment system providers/operators (“PSO”).

Hence, the outsourcing of PA services or any other relevant payment system service by a
Neobank would be determined as per Framework for Outsourcing of Payment and
Settlement-related Activities by Payment System Operators dated August 3, 2021. The
directions are similar to the direction as provided under Bank and NBFC Outsourcing
Guidelines. Similar set of aspects need to be taken care of while outsourcing activities and
integrating other service providers for providing PA and PG services.

ESCROW ACCOUNT
With PPIs becoming the mainstream payment instruments and PAs services being used by
numerous e-commerce platforms, it was seen that various non-bank entities were involved in
handling of public funds. To prevent any systemic risk and protect consumer interest, vide
2015 amendment to the PSSA, Section 23A was inserted whereby designated payment
system providers were to create a separate account for handing of funds by them which
effectively meant escrow account. RBI from time to time by virtue of this section can then
provide for conditions for management of funds by creation of escrow account with respect to
PPIs and PAs.

Non-bank PPIs and Non-bank PAs, both need to be authorised by RBI under PSSA as
observed above. Further, as per Paragraph 12.3 and Paragraph 8.1 of the MD-PPIs and the
PA Guidelines, for purposes of escrow account management, the operations in case of both;
PPIs and PAs, shall be deemed to be considered as ‘designated payment systems’ under
Section 23A of PSSA. Hence, in this manner escrow account is governed.

Page 32 of 38
Payment Aggregators
The manner in which payment aggregators and payment gateways function, PAs are involved
in handling and settlement of funds. As a consequence, an account to handle funds received
from customers has to be there which is managed by a third party until the funds are settled
with merchants.

Regulation

Paragraph 8 of the PA Guidelines provides for the Escrow Account Management and
Settlement Process. This Paragraph also provides for how the mechanism of settlement
occurs by a PA.

Creation of Escrow Account

As per Paragraph 8.1 of the PA Guidelines, escrow account has to be created with an SCB by
a non-bank PAs. PAs at maximum can create two escrow account and not more than that
since only one additional escrow account opening is allowed.

With respect Bank PAs, they don’t require to open a separate escrow account to manage and
settle funds since Paragraph 8.1 only mandates non-bank PAs to open escrow account.

Settlement of Funds through Escrow Account

The amount paid by the customer, firstly, comes into the escrow account and then PA settles
it later to the merchant. Paragraph 8.3 of the PA Guidelines specifically provides for that.
Any amount deducted from customer’s account shall be first remitted to the escrow account
directly and such practice should happen even in case where online wallets are used for
payment.

Consequently, final settlement with the merchant from escrow account has to be done as per
Paragraph 8.4 of the PA Guidelines which provides for specific settlement timelines for each
type of transaction. The timelines for settlement have been defined under Paragraph 1.2 of the
PA Guidelines.

While undertaking settlement with merchant, as per Paragraph 8.12 of the PA Guidelines,
PAs need to ensure that such settlement shall not be co-mingled with other business of the
PA. This is an important direction which Neobanks will have to keep in mind strictly since
apart from undertaking PA business, they have various other products to offer and therefore
no conflict should arise with respect to the said direction.

Page 33 of 38
Management of funds
To protect consumer and merchants’ interest both, as per Paragraph 8.6 of the PA Guidelines,
PAs shall ensure that at the end of the day, the amount in escrow account shall not be less
than the amount already collected from customers or the amount due to the merchants.

In addition to this, only particular set of credits and debits are permitted as provided under
Paragraph 8.9.1.1 & 8.9.1.2 of the PA Guidelines respectively.

Compliance Responsibilities: the PA or Bank?

Escrow is maintained by a bank and is opened by the PA, then who is responsible for
compliance? As per Paragraph 8.11 of the PA Guidelines, both the PA and the Bank (with
whom the escrow account is opened) are responsible for the compliance.

However, with regard to each compliance, the responsibility might shift to either of them and
RBI shall have the final decision on it.

There are few compliances which have to exclusively need to taken care of by Banks only.
Under Paragraph 8.14 of the PA Guidelines, firstly, bank should permit only eligible
merchants to receive payment as per the list of merchants acquired by the PA submitted to the
Bank. Secondly, in the agreement signed between the PA and the Bank, there must be an
exclusive Paragraph pertaining to the usage of balance in escrow account only for the
purposes mentioned.

Is Escrow Account an interest-bearing account?

No. escrow accounts are non-interest-bearing accounts as per Paragraph 8.15 of the PA
Guidelines. However, there is a caveat.

PAs can get interest on the ‘core portion’ of the amount but such amount needs to be
transferred to a separate account considering PA and Bank have signed an agreement to that
effect. In this case also, sub-paragraphs under Paragraph 8.15 of the PA Guidelines determine
how such core portion fund has to be managed.

Reports and Certificate to be Submitted by PA

Neobanks in addition to compliance with management of escrow account, need to submit
Reports as mentioned in Annex 3 of the PA Guidelines. Audit Certificate on Maintenance of
Balance in Escrow Account as per Paragraph 8.13 of the PA Guidelines and Bankers’
Certificate on Escrow Account Debit and Credits. Both need to submitted quarterly by the
15th of the month following the quarter end.
Page 34 of 38
Such reports keep more check on the functioning of PAs but also increases the compliance
need of Neobanks since they need to take care of multiple compliances for each respective
offering.

Prepaid Payment Instruments

PPIs are issued in the form of prepaid cards, online wallets, e-vouchers, gift cards etc. Users
transfer money to these PPIs and then use them for payment. Money is stored online with PPI
operating entities i.e., Banks or Neobanks. Question is where do they store/invest such money
until it is used for payment by the User?

Regulation
The money collected against issuance of PPI is stored in an Escrow account. Paragraph 12 of
the MD-PPIs states the process of how the money collected by a PPI entity has to be
deployed and provides for the management of the Escrow Account.

As per Paragraph 12.3 of the MD-PPIs, Neobanks banks offering PPIs shall have to maintain
the outstanding balance i.e., the amount transferred to the PPI but not yet used by the User, in
an escrow account with a SCB. An additional escrow account can also be maintained but not
more than two escrow accounts can be opened by the non-bank PPI Issuer.

The conditions for maintenance of escrow account by non-bank PPI issuer is similar to the
requirements of escrow account by non-bank PA. Thereby, to avoid reiteration of conditions,
reader is advised to refer to conditions with respect of PA as stated in the previous section.

Deployment of Money into Escrow Account

As per Paragraph 12.1 and Paragraph 12.3 of the MD-PPIs, any money collected by non-bank
PPI issuer shall first hit the escrow account.

With regard to PPIs issued by Banks, the deployment of money is governed by the Paragraph
12.2 of the MD-PPIs. Banks don’t need to create an escrow account. Herein the outstanding
balance; the money collected through the prepaid cards (PPI issued by Bank) and due to the
User, shall be part of the ‘net demand and time liabilities’ for the purpose of maintenance of
reserve requirements. Hence, in case of PPIs issued by Banks also, any money collected
through loading/reloading of PPIs, the same shall hit the Bank first.

However, in case of prepaid cards issued by BNPL entities, the cards are loaded/reloaded
through the credit lines extended from NBFCs. The money is either handled by the co-
branded entity itself till it is transferred to the merchant or is directly transferred to the
Page 35 of 38
merchant in lieu of loan extended to the User. The money isn’t transferred to the Bank even
though the issuer of such prepaid card is the Bank. Such loading/reloading through credit line
should become the part of ‘net demand and time liabilities’ as per Paragraph 12.2 of the MD-
PPIs.

Further, in case of non-bank PPIs, similar pattern is witnessed. The online wallet is
loaded/reloaded through credit lines raised from NBFCs; however, the money doesn’t hit the
escrow account as per Paragraph 12.1 and Paragraph 12.3 of the MD-PPIs. It is directly
transferred to the merchant.

The recent RBI’s ban on loading of PPIs via the credit lines extended from NBFCs is to
address such market practice and violation. Escrow accounts were created for a purpose and
Neobanks seemed to bypass it through their BNPL service offered on top of PPIs.

Undertaking from E-commerce platforms

As per Para 12.3 (viii) of the MD-PPIs, PPI issuer should obtain an undertaking from
respective digital marketplaces, PAs and PGs with whom it has agreements for acceptance of
the PPI to the effect that payment made through its PPI are used for onward payments to the
respective merchants, Later, such undertaking should be submitted to the bank maintaining
the escrow account.

Reports and Certificate to be Submitted by non-bank PPI issuer

With respect to the reports to be submitted to the RBI, the non-bank PPI Issuer needs to
submit Audit Certificate on Maintenance of Balance in Escrow Account as per Paragraph
12.3(ix) and Paragraph 19 of the MD-PPIs. This has to be submitted Quarterly and also at the
end of accounting year of the non-bank PPI issuer entity. This is done to ensure that non-bank
PPI issuer has enough balance to meet the outstanding amount to the Users.

To keep a further real time check, as per Paragraph 12.3(x) of the MD-PPIs, adequate records
indicating the daily position of the value of instruments outstanding and payments due to
merchants vis-à-vis balances maintained with the banks in the escrow accounts shall be made
available for scrutiny to RBI or the bank where the account is maintained on demand.

If a Neobanks happens to be a PA and also offers online wallets or some other PPI offering
(except prepaid card), it will have to do two similar set of compliances and filing of reports;
one for acting as a PA and other for offering PPIs.

Page 36 of 38
 INVESTMENTS
Neobanks is an uncharted path and various fintech entities are trying their luck in it. Since
there are no set of defined boundaries as to what constitutes a Neobank, there is a lot to be
offered to customers who wish to access banking products in fastest way possible and also at
the comfort of their home. One of the innovative fintech start-up, Fi, has tapped into the
investments market.

Fixed Deposits and Recurring Deposits

Fi through it in-app features such as FIT, Investment Jars etc. enables users to save daily,
monthly or yearly and route those investments into Smart deposits; which are in essence
recurring deposits and into Mutual Funds. Further, it also provides option of investing in
Fixed Deposit in quite a flexible manner. Fixed Deposit and Recurring deposits both are
opened in partnership with Federal Bank.

Smart deposits are linked with auto-invest FIT rules; a rule where you can save daily,
monthly or in a defined frequency, and then the saved amount is constantly added to
recurring deposits opened by Fi on behalf of customers with Federal Bank. A recurring
deposit i.e., smart deposit as per Fi has to be opened first with an initial minimum investment
of Rs. 300 with certain time period and then later by linking auto-save FIT rules to it, an
amount as low as Rs. 10 can be invested in a recurring deposit (It is allowed to invest as low
as Rs.10 in a Recurring Deposit). Whereas, the Fixed deposits are usual fixed deposits which
Fi opens with Federal Bank and minimum investment amount is Rs. 1000.

It is through the Bank Outsourcing Guidelines that the Fi and Federal Bank are able to pull
off this venture. The guidelines have already been discussed at length above and in similar
manner apply to the deposits also.

Mutual Funds and Model Portfolios

Fi offers mutual fund but has tweaked SIP option by providing the auto-invest FIT rules.
Trough such rules, one can daily, weekly or monthly invest in a mutual fund. However,
various questions need to be answered to understand this product:

 Is Fi collecting the daily/weekly/monthly amount and then investing it on a lumpsum

basis into the mutual fund chosen by the User? Or this is a SIP feature in a named
differently?

Page 37 of 38
 Since daily and weekly SIP is available on limited mutual fund schemes, thereby,
such feature is limited or can be applied to all mutual funds?
 Secondly, what are outsourcing laws of mutual funds which allow a third party to host
and operate mutual fund on its platform while also receiving the payment of the same
from the unitholders on behalf of mutual fund?
 Thirdly, whether Fi or any Neobank would need registration with Association of
Mutual Funds of India (“AMFI”) for distribution of mutual funds on its online
platform?

It must be noted that PhonePe’s arm; PhonePe Wealth Broking holds a registration
with the AMFI under ARN No. 187821 and is authorized to act as a distributor of
mutual funds. Thereby, it is assumed that Neobanks need such registration, however,
further check has to be done to reach a definite conclusion.
 Lastly, considering routing of money from self-defined investment tool i.e., auto-
invest FIT rules to the mutual fund and smart deposits, whether Fi needs to be a SEBI
registered Investment Advisor?

As stated above, Fi’s parent is a wealth management entity and is a SEBI Registered
Investment Advisor (INA200015185).

With respect to this further compliances and issues need to be looked with respect to
Securities and Exchange Board of India (Investment Advisers) Regulations, 2013 for better
conclusion.

Page 38 of 38