Technology Law Analysis

Regulations on E-Wallets, Gift Cards and Vouchers Given a Facelift

---

• Closed loop prepaid instruments not regulated by RBI.

• RBI authorization required to issue prepaid instruments which can be redeemed for goods or services from third parties.

• Non-banks permitted to issue prepaid instruments with cash withdrawal.

• Two Factor Authentication requirement introduced for transactions via prepaid instruments.

---

Introduction

In a significant update, the Reserve Bank of India (“RBI”) released the Reserve Bank of India Master Directions on Prepaid Payment Instruments, 2021 (“PPI Regulations”)¹ in August, 2021. The PPI Regulations subsume the Reserve Bank of India (Issuance and Operation of Prepaid Payment Instruments) Directions, 2017 (“2017 Regulations”)² with immediate effect, and also consolidate various circulars on pre-paid instruments (“PPIs”) that had been issued between 2017 and 2021. These regulations are issued by the RBI under the Payment and Settlement Systems Act, 2007.³

More commonly referred to as ‘e-wallets’ or ‘gift cards’, PPIs are payment instruments that can be used for the purchase of goods or services against this stored value. The PPI Regulations impact products such as e-wallets, gift cards and vouchers, money transfer wallets, meal vouchers, metro/travel rail cards, etc. Where the 2017 Regulations allowed paper PPIs in the limited instance of prepaid paper meal vouchers (Sodexo being the best example), the PPI Regulations do not allow any form of paper PPIs.

Key Aspects of the PPI Regime

Important aspects of the now consolidated PPI regime are as follows:

1. Closed System PPIs Not Regulated by RBI

The 2017 Regulations classified PPIs into Closed System PPIs (used to facilitate the purchase of goods and services from that entity only), Semi Closed PPIs (used for purchase of goods and services, including financial services, remittance facilities, etc., at a group of clearly identified merchant locations), and Open PPIs (issued only by banks and are used at any merchant).

The PPI Regulations retain the classification of Closed System PPIs and clarify that “the issuance or operation of such instruments is not classified as a payment system requiring approval / authorization by RBI and are, therefore, not regulated or supervised by RBI”. This clarity will be welcomed by the industry as there existed divergent views on whether Closed System PPIs were required to comply with the terms of the 2017 Regulations even though they did not require authorization. Therefore, Closed System PPIs, i.e. any PPIs that are issued and redeemed by the same entity are not regulated by the RBI, and do not need to seek authorization to be offered.

2. Introduction of Small and Full PPIs

Where Closed System PPIs are issued and redeemed by the same entity, there are numerous PPI business models that allow the onboarding of third-party merchants with whom the value stored on the PPI may be redeemed. Such PPIs require authorization from the RBI before they are allowed to operate, and are of the below five categories. The RBI has replaced the erstwhile classification of ‘Semi-Closed’ and ‘Open’ PPIs with ‘Small’ PPIs and ‘Full KYC’ PPIs.

The below five categories of PPIs are:

Sl. no	Features	Small PPI (with cash loading)	Small PPI (without cash loading)	Full KYC	Gift Cards	Mass Transit System (MTS)
1.	Purpose	Only for purchase of goods and services at a group of identified merchants/ establishments		Can be used for purchase of goods and services (across multiple merchants), funds transfer or cash withdrawal.	Can be purchased by a person and redeemed by another person with a group of identified merchants/ establishments.	May be used at mass transit systems for fare collection, and merchant outlets whose activities carried on within premises of the MTS.
2.	KYC required / user details to be collected	Minimum details - mobile number (verified by OTP), self-declaration of name, identification number of any ‘mandatory document’ or another recognised official document.4		Authentication of the user to be completed as per RBI mandated regulations.5	Authentication of the purchaser to be completed as is done for Small PPI.	As decided by the Issuer.
3.	Conversion	Shall be converted into full-KYC PPIs within 24 months from the date of issue, failing which, no further credits permitted.	N/A	N/A	N/A	N/A
4.	Reloadability	Shall be reloadable and issued only in electronic form. Can be reloaded via cash.	Shall be reloadable and issued in card or electronic form. Reloading to be done from bank account/ credit card/ full-KYC PPI. No reloading via cash	Shall be reloadable in nature and issued only in electronic form.	Not-reloadable	Reloadable
5.	Cash withdrawal / Funds transfer	Not allowed		Allowed For bank-issued PPIs: Subject to limit of INR 2000 (approx. USD 26) per transaction; Overall monthly limit of INR 10,000 (approx. USD 133) across all locations. For non-bank issued PPIs: Maximum of INR 2000 (approx. USD 26) per transaction within an overall monthly limit of INR 10,000 (approx. USD 133).	Not allowed	Not allowed
6.	Limits of funds transfer	N/A		In case of pre-registered beneficiaries, funds transfer limit shall not exceed INR 200,000 (approx. USD 2662) per month per beneficiary. For all other cases – limit is INR 10,000 per month (approx. USD 133).	N/A	N/A
7.	Monthly/yearly loading limits	Monthly – INR 10,000 (approx. USD 133). Yearly – INR 1,20,000 (approx. USD 1600).		No separate limit – PPI issuer may decide	Maximum value shall not exceed INR 10,000	No specified limit – PPI issuer may decide
8.	Outstanding amount limit	Shall not exceed INR 10,000 (approx. USD 133).		Shall not exceed INR 2,00,000 (approx. USD 2662)	N/A	Shall not exceed INR 3,000 (approx. USD 40)
9.	Closure of PPI	Allowed to close the PPI at any time; Closure proceeds can be transferred ‘back to source account’		PPI issuer to give an option to close the PPI and transfer the balance as per the applicable limits	PPI may be revalidated (including through issuance of new instrument) when requested by PPI holder.	PPI may be revalidated (including through issuance of new instrument) when requested by PPI holder.
10.	Interoperability	Mandatory – see below for detail			Not mandatory - have the option to offer interoperability	Exempt from providing interoperability
11.	Additional Factor Authentication Required	All wallet transactions involving debit to the wallet, including cash withdrawal, shall be permitted only by validation through a Additional Factor Authentication (such as One-Time-Passwords or PINs). Through recent RBI circulars,6 recurring payments up to an amount of INR 5,000 per transaction may be exempt from the AFA requirement subject to customer consent and preferences.			Not mandatory	Not mandatory
12.	Validity/Redemption	PPIs issued in the country shall have a minimum validity period of one year from the date of last loading / reloading and can have a longer validity period as well. Non-bank PPI issuers cannot transfer the outstanding balance to their Profit & Loss account for at least three years from the expiry date of PPI. Refunds must be made in the event the PPI holder requests a refund after this three year period.
13.	Maintenance of Logs	PPI issuers are to maintain a log of all the transactions undertaken using the PPIs for at least ten years, which must be made available for scrutiny to RBI or any other agency / agencies as may be advised by RBI.

3. Eligibility for Authorization

Both banks and non-bank entities may apply for authorisation from the RBI to issue Small or Full KYC PPIs. Key points on the eligibility criteria to seek authorisation are as follows:

1. Type of entity: Non-bank entities applying for authorisation must be company incorporated in India and registered under the Companies Act, 1956 / 2013.⁷ It would therefore not be possible for entities that are LLPs or sole proprietorships to apply.

2. Charter Documents: The Memorandum of Association (MoA) of the non-bank entity must cover the proposed activity of issuance of PPI.

3. Net worth: PPI issuers are required to have a minimum positive net worth⁸ of INR 50,000,000 (approx. USD 680,000) at the time of submitting the application, with a requirement that PPI issuers must achieve a minimum positive net worth of INR 150,000,000 (approx. USD 2,040,000) by the end of the third financial year from the date of receiving final PPI authorization. This net worth is to be maintained at all times, and PPI issuers are required to submit their Net Worth Certificate (issued by a Chartered Accountant) every year.

4. Application and Authorization Process

1. Application Process: Applicants must apply for authorization by submitting Form A⁹ to the RBI. Once Form A has been submitted and if the RBI finds that the applicant has met the eligibility criteria, they shall issue an “in principal” approval, which is valid for 6 months, which may be extended for a year at the discretion of the RBI. The applicant would then be required to submit a satisfactory System Audit Report (SAR) and a net worth certificate of INR 5 crore within these six months. Once this is submitted, RBI may then grant a final certificate of authorization, which maybe for a perpetual period, subject to meeting certain conditions,¹⁰ as was clarified in a circular issued in December 2020¹¹.

2. Introduction of a Cooling Period to Ensure ‘Serious Applicants’: As was clarified in a circular issued in December 2020,¹² the there is a cooling period of one year before the following entities may re-apply for PPI authorization:

   • PPI issuer whose Certificate of Authorization (“CoA”) is revoked or not-renewed for any reason; or

   • CoA is voluntarily surrendered for any reason; or

   • Application for authorization has been rejected by RBI; or

   • New entities that are set-up by promoters involved in any of the above categories.

3. Financial regulator NOC: Both banks and non-banks regulated by any “financial sector regulator” and seeking authorization under the Master Direction must submit a No Objection Certificate (NOC) from their respective regulator as part of the application for authorization.

4. ‘Fit and proper’ status: The RBI has extended the fit and proper criteria (which typically applies to banks and NBFCs) to entities applying for authorization under the Master Direction. Further, directors of the applicant are required to submit an undertaking.

5. Changes in Products/Features/Change of Control: The PPI Regulations mandate that any proposed major change, such as changes in product features / process, structure or operation of the payment system, etc., as well as any takeover or acquisition of control or change in management of a non-bank entity is to be communicated to the RBI within 15 days of such change taking place. In the past, there have been conflicts as the 2017 Regulations had a reporting requirements, while the terms and conditions of the PPI Authorisation had provided for an authorisation to be sought for the above changes. Hence, going forward, this point should be clarified in the PPI authorisation terms and conditions for consistency.

5. Co-branding

In the event an entity does not wish to seek RBI authorization itself, the PPI Regulations allow entities to co-brand with existing PPI Issuers in order to issue PPIs. In such instances, companies incorporated in India (which may also be a Government department / ministry) are allowed to co-brand with existing PPI Issuers. The PPI Regulations prescribe certain conditions for co-branding on the PPI Issuer, which include having a board approved policy that allows for such co-branding, and conducting due diligence and KYC, to name a few. Additionally, the PPI Issuer is to be liable for all acts of the co-branding partner, and will be responsible for all customer related aspects of the PPI. Whilst a one-time approval is still required for PPI Issuers to issue co-branded PPIs, the erstwhile requirement under the 2017 Regulations to report specific co-branding arrangements to the RBI has been done away with.

6. Customer Protection / Grievance Redressal

A few key conditions under the PPI Regulations are that:

1. PPI Issuers are required to disclose all important terms and conditions in clear and simple language (preferably in English, Hindi and the local language) to the holders while issuing the instruments. The Frequently Asked Questions (FAQs) pertaining to PPIs are to be displayed on the PPI Issuer’s website/application.

2. A formal, publicly disclosed customer grievance redressal framework is to be put in place.

3. PPI issuers are to clearly indicate the customer care contact details, including details of nodal officials for grievance redressal (telephone numbers, email address, postal address, etc.). Further, a detailed list of the PPI Issuer’s authorised / designated agents is also to be displayed.

4. PPI Issuers are expected to initiate action to resolve customer complaints preferably within 48 hours and endeavour to resolve such complaints no later than 30 days from the receipt of the complaint.

7. Interoperability

The 2017 Regulations had mandated that interoperability (the ability to use one payment system with another) would be implemented in phases, and that operational guidelines on interoperability would be issued. An RBI Circular issued in May 2021¹³ subsequently mandated that KYC compliant PPIs were to ensure interoperability, while PPIs for mass transit systems and gift cards are exempted. This involves interoperability of PPIs issued via wallets and card networks, PPIs issued via card networks, and PPIs issued via UPI. Technical and operational requirements have been issued in this regard.

8. Co-mingling of funds

Settlement of funds with merchants shall not be co-mingled with other businesses, if any, handled by the PPI issuer, or with any other activity that they may be undertaking such as Business Correspondents of bank/s, intermediary for payment aggregation, payment gateway, etc.

9. Cross border transactions

Use of INR dominated PPIs for cross border transactions is not permitted, except in the below instances:

1. Cross border outward transactions¹⁴ via Full KYC PPIs issued by authorized dealer banks, subject to foreign exchange laws. This feature may be enabled only on explicit request of the PPI holder and will be subject to transaction limits, i.e. not exceeding INR 10,000 per transaction, and INR 50,000 per month. Such PPIs shall not be used for cross border outward fund transfers or payments under the Liberalized Remittances Scheme (LRS).¹⁵ Further, such PPIs cannot be issued by non-banks.

2. Cross border inward transactions via Full KYC PPIs issued by both banks and non-banks appointed as Indian agent of authorized overseas principals to beneficiaries of inward remittances under the Money Transfer Services Scheme (MTSS) of RBI. This is subject to certain conditions as prescribed under the PPI Regulations.

10. Settlement/Escrow Account

Non-bank PPI issuers are to process settlements only through sponsor banks, and are required to maintain outstanding balances in an escrow account with scheduled commercial banks.

11. Outsourcing Considerations

The RBI has also released regulations for the outsourcing of payment and settlement-related activities to third party service providers non-bank payment system operators / providers, which include PPI Issuers. Hence, entities not directly regulated by the RBI may be subject to certain contractual compliances and restrictions imposed by payment system operators as part of the latter discharging their legal obligations. You may read more about this development here¹⁶.

12. Customer Protection Guidelines

PPI Issuers must also follow certain RBI Guidelines on limiting liability of customers in unauthorized electronic banking transactions. These guidelines prescribe obligations such as reporting of unauthorized payment transactions to customer, and limiting customer liability in certain instances.

Conclusion – Need for Further Liberalization

The compilation of the various circulars released by the RBI on PPIs through the years, as well as the clarity on Closed System PPIs, opening up the offering of PPIs permitting cash-based withdrawal to non-bank PPI Issuers, and the detail on Interoperability are a welcome change to the industry. The mandate on all debits to PPI instruments requiring AFA, however, may see a mixed reaction as this would take away from the convenience that PPIs offer customers.

A few suggestions to further liberalize the regime are as follows:

• Taking a leaf out of UPI’s book, RBI could consider opening up cross border transactions to boost market entry and ease of doing business for foreign players.

• The high net worth requirements continue to be a barrier to market entry, which would explain why there are barely any new players who enter the space. Entities who do not wish to come up with these high net worth requirements often turn to co-branding or white labeling arrangements.

• When it comes to co-branding requirements, the PPI Regulations still do not allow foreign entities to co-brand with PPI Issuers, which is an unnecessary hurdle for offshore players.

• The mandatory requirement to ‘convert’ cash-loading Small PPIs to Full KYC PPIs within 24 months from the date of issue, may lead to pressure on issuers to alter their business models to provide PPI holders with added features. It should be clarified whether the requirement is for cash-loading Small PPIs to merely complete the KYC within 24 months, or whether to convert the instrument to the nature of a ‘Full KYC’ PPI as envisaged under the PPI Regulations, which can also be used for funds transfer and cash withdrawal.

Overall, while it is acknowledged that there has been limited liberalization of the PPI regime via exempting recurring payments, and extending the authorization for a perpetual period, further steps towards liberalization would be appreciated by the industry to revive the growth of PPIs in India, especially when compared to the tremendous growth and volumes of UPI, mobile banking and ‘buy-now-pay-later’ payments.

 

– Inika Charles, Aaron Kamath & Huzefa Tavawalla

You can direct your queries or comments to the authors

---

¹ https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=12156 (last accessed November 30, 2021).

² You may refer to our analysis on the 2017 Regulations here.

³ The PPI Regulations are issued under Section 18 read with Section 10(2) of the Payment and Settlement Systems Act, 2007.

⁴ As per the Master Direction on KYC: https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=11566

⁵ Id.

⁶ https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11668; https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12002; https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12051&Mode=0. (last accessed November 30, 2021).

⁷ Entities having Foreign Direct Investment (FDI) / Foreign Portfolio Investment (FPI) / Foreign Institutional Investment (FII) are required to meet the capital requirements as under the Consolidated FDI policy guidelines of Government of India.

⁸ 2.7 Net-worth : Shall consist of ‘paid up equity capital, preference shares which are compulsorily convertible into equity capital, free reserves, balance in share premium account and capital reserves representing surplus arising out of sale proceeds of assets but not reserves created by revaluation of assets’ adjusted for ‘accumulated loss balance, book value of intangible assets and deferred revenue expenditure, if any’. While compulsorily convertible preference shares reckoned for computation of net-worth can be either non-cumulative or cumulative, these shall be compulsorily convertible into equity shares and the shareholder agreements shall specifically prohibit any withdrawal of this preference share capital at any time.

⁹ https://rbidocs.rbi.org.in/rdocs/Forms/PDFs/PSSACRT130215.PDF (last accessed November 30, 2021).

¹⁰ Full compliance with the terms and conditions subject to which authorisation was granted; Fulfilment of entry norms such as capital, net worth requirements, etc.; No major regulatory or supervisory concerns related to operations of the PSO, as observed during onsite and / or offsite monitoring; Efficacy of customer grievance redressal mechanism; and no adverse reports from other departments of RBI / regulators / statutory bodies, etc.

¹¹ https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12000&Mode=0 (last accessed November 30, 2021).

¹² https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12001&Mode=0 (last accessed November 30, 2021).

¹³ https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12094&Mode=0 (last accessed November 30, 2021).

¹⁴ For permissible current account transactions under FEMA, i.e. for purchase of goods of services.

¹⁵ Further, prefunding of online merchant’s account shall not be permitted using such Rupee denominated PPIs.

¹⁶ https://www.nishithdesai.com/NewsDetails/4796 (last accessed November 30, 2021).