RBI's PA/PG Guidelines: KYC Requirements for Merchant Onboarding
The Reserve Bank of India issued comprehensive guidelines for the regulation of Payment Aggregators (PAs) and Payment Gateways (PGs) through its circular RBI/2019-20/174 (dated March 17, 2020), subsequently updated through multiple amendments. These guidelines, commonly referred to as the PA/PG guidelines, brought payment aggregators under direct RBI regulation for the first time, requiring them to obtain authorisation under the Payment and Settlement Systems Act, 2007. A central pillar of these guidelines is the requirement for PAs to perform thorough KYC on the merchants they onboard, applying the same Customer Due Diligence (CDD) standards that apply to banks and other Regulated Entities under the PMLA framework.
Under the PA/PG guidelines, payment aggregators must perform KYC for all merchants (also referred to as sub-merchants) at the time of onboarding. The guidelines specify that PAs must verify the identity of the merchant and its authorised signatories, verify the merchant's business existence and legitimacy, assess the merchant's risk profile, and maintain a record of all KYC documentation. For individual merchants (sole proprietors), the KYC requirements are similar to individual customer KYC under the PML Rules, including verification of OVDs, PAN, and address proof. For entity merchants (partnerships, companies, LLPs), additional documentation is required, including the certificate of incorporation, partnership deed, board resolution, and authorised signatory identification.
The RBI's updated circular from September 2024 further tightened merchant onboarding requirements, mandating that PAs conduct enhanced due diligence for merchants in certain high-risk categories, including online gaming platforms, cryptocurrency exchanges (to the extent permitted), and merchants dealing in high-value goods. The circular also required PAs to implement ongoing monitoring of merchant transactions and to conduct periodic re-KYC to ensure that the merchant's risk profile remains current. These requirements have significantly increased the KYC burden on payment aggregators, many of whom onboard thousands of new merchants every month.
The practical challenge for payment aggregators is balancing speed of onboarding with compliance rigour. Merchants expect to be onboarded quickly, often within 24 to 48 hours, so they can start accepting payments. Traditional KYC processes involving physical document collection and in-person verification are too slow for this expectation. Video KYC has emerged as the solution that allows PAs to conduct full, RBI-compliant KYC while maintaining the fast onboarding speeds that the market demands. By conducting a live video session with the merchant's authorised signatory, PAs can verify identity, confirm business existence, and assess risk in a single interaction.
Why Payment Aggregators Need Video KYC for Sub-Merchant Verification
Payment aggregators operate on a sub-merchant model where individual merchants do not hold a direct relationship with the acquiring bank. Instead, the PA serves as the intermediary, aggregating multiple merchants under its own merchant account with the bank. This structure means that the PA bears the primary responsibility for the integrity and legitimacy of its sub-merchants. If a fraudulent merchant is onboarded and processes illegitimate transactions, the PA faces not only financial liability (chargebacks, penalties) but also regulatory consequences including potential revocation of its PA licence.
The sub-merchant ecosystem in India is vast and heterogeneous. A typical large payment aggregator may serve hundreds of thousands of merchants ranging from large e-commerce platforms to individual street vendors using QR codes. The risk profiles across this spectrum are wildly different, and the KYC approach must be calibrated accordingly. For large, well-known merchants with established businesses, a lighter-touch KYC (such as CKYC fetch or document-based verification) may suffice. But for smaller, unknown merchants, particularly those operating online without a physical storefront, a more rigorous approach is needed to confirm that the person behind the merchant account is who they claim to be and that the business is legitimate.
Video KYC addresses several specific risks in the merchant onboarding context that other KYC methods cannot. First, it confirms the physical existence of the authorised signatory, reducing the risk of fictitious identity fraud. Second, the live conversation allows the PA's agent to ask probing questions about the business, such as the nature of goods or services sold, expected transaction volumes, and the business's online and offline presence. Third, the video recording creates a powerful audit trail that can be referenced in case of future disputes, chargebacks, or regulatory inquiries. These capabilities make Video KYC the gold standard for merchant verification under the PA/PG guidelines.
The RBI has been particularly focused on merchant onboarding quality in its inspections of payment aggregators. Several PAs have received adverse observations in their inspection reports for inadequate merchant KYC, including instances of merchants being onboarded without proper identity verification or without verifying the business's legal existence. In at least one publicised case, a PA was directed to suspend onboarding of new merchants until its KYC process was brought up to the required standard. Video KYC provides the documentation and process rigour that withstands regulatory scrutiny, making it an essential component of any PA's compliance framework.
KYB vs KYC: Entity Verification and Authorised Signatory Checks
Merchant onboarding for payment aggregators involves two distinct but related processes: Know Your Customer (KYC) for the individual authorised signatory, and Know Your Business (KYB) for the merchant entity itself. KYC verifies that the person representing the merchant is who they claim to be, using standard identity verification methods such as OVD check, PAN verification, and liveness detection. KYB verifies that the business entity is legally constituted, actively operating, and authorised to engage in the declared line of business.
For sole proprietors, the KYC and KYB are effectively merged because the individual is the business. The V-CIP session verifies the proprietor's identity through their Aadhaar, PAN, and other OVDs. The business verification may involve checking the GST registration (if applicable), shop establishment licence, or other business registration documents. For partnerships, the PA must verify the partnership deed, identify all partners, and conduct KYC on the authorised signatory (the partner who is authorised to operate the merchant account). For companies and LLPs, the requirements expand further: certificate of incorporation from the Ministry of Corporate Affairs (MCA), memorandum and articles of association, board resolution authorising the signatory, and KYC of the authorised director or designated partner.
Video KYC plays a specific role in the authorised signatory verification step. The V-CIP session confirms that the individual who claims to be the director, partner, or proprietor is genuinely that person. The agent verifies their personal OVD (typically Aadhaar or Passport), PAN card, and, for companies and LLPs, checks that their name appears on the board resolution or authorisation letter. The live conversation also provides an opportunity to ask the signatory about the business's operations, which can reveal inconsistencies that might indicate a shell entity.
The Ultimate Beneficial Ownership (UBO) requirement adds another layer of complexity. Under the PML Rules, Regulated Entities must identify the beneficial owner of every entity they onboard. For companies, this means identifying natural persons who ultimately own or control more than 25% of the shares or voting rights. For partnerships, it means identifying partners with more than 15% share. The PA must verify the UBO's identity, which may require conducting V-CIP on individuals beyond the authorised signatory if the UBO is a different person. This layered verification process ensures that the PA has full visibility into who ultimately controls the merchant entity.
Ongoing Monitoring and Periodic Re-KYC for Merchants
The RBI's PA/PG guidelines do not treat merchant KYC as a one-time exercise. PAs are required to implement ongoing monitoring of merchant activity and conduct periodic reviews of the merchant's KYC status. This ongoing due diligence is essential because a merchant's risk profile can change over time. A legitimate business at the time of onboarding may later pivot to selling restricted goods, may be acquired by individuals with adverse backgrounds, or may begin exhibiting transaction patterns indicative of money laundering or fraud.
Transaction monitoring is the first line of ongoing merchant oversight. PAs must configure their systems to detect unusual transaction patterns, such as sudden spikes in transaction volume, unusually high ticket sizes relative to the merchant's declared business, high chargeback rates, and patterns consistent with refund fraud or transaction laundering. When anomalies are detected, the merchant's account should be flagged for review, and the PA's compliance team should investigate. In severe cases, the merchant's settlement may be held pending investigation, and the PA may need to file a Suspicious Transaction Report (STR) with FIU-IND.
Periodic re-KYC ensures that the merchant's identity, business status, and risk profile remain current. The RBI does not prescribe a specific re-KYC frequency for merchants under the PA/PG guidelines, but most PAs follow the risk-based approach outlined in the KYC Master Direction: annual review for high-risk merchants, biennial for medium-risk, and every three to five years for low-risk. Re-KYC for merchants may involve verifying that the business registration is still active (via MCA or GST portal checks), confirming that the authorised signatory has not changed, and updating the merchant's risk categorisation based on their transaction history.
Video KYC is particularly valuable for the re-KYC process because it allows the PA to re-verify the authorised signatory's identity and have a conversation about any changes to the business without requiring a physical visit. For high-risk merchants, a re-KYC video call provides an opportunity to reassess the merchant's legitimacy, ask about changes in business model or ownership, and verify updated documents. For the merchant, this is far more convenient than submitting physical documents or visiting an office. The V-CIP recording also provides a dated audit trail that demonstrates the PA's compliance with ongoing due diligence requirements.
Integrating Video KYC into Merchant Self-Onboarding Flows
Modern payment aggregators increasingly offer merchant self-onboarding through web portals and mobile apps, where merchants can sign up, submit documents, and start accepting payments with minimal manual intervention. Video KYC must be integrated into this self-service flow in a way that is seamless for the merchant while meeting all regulatory requirements. The challenge is that V-CIP requires a live interaction with a trained agent, which introduces a synchronous step into an otherwise asynchronous self-service process.
The typical integration pattern involves the merchant completing the self-service registration (filling in business details, uploading documents, providing bank account information) and then being prompted to schedule or immediately join a V-CIP call. For smaller PAs with limited agent capacity, scheduling is the practical approach: the merchant selects a convenient time slot, and the V-CIP call is conducted during the scheduled window. For larger PAs with dedicated agent teams, an immediate call option can be offered during business hours, where the merchant clicks a button and is connected to the next available agent within minutes.
The V-CIP platform must be deeply integrated with the PA's merchant management system so that the agent has full context when the call begins. The agent should see the merchant's submitted application, uploaded documents, automated verification results (PAN, GST, MCA checks), and any risk flags before the call starts. This pre-processing ensures that the V-CIP call is focused and efficient, typically completing in 5 to 8 minutes for a straightforward merchant onboarding. The agent verifies the signatory's identity, confirms the business details, and completes the KYC checklist.
Post-call, the V-CIP session is submitted for checker review as per the maker-checker workflow. The checker verifies that all KYC and KYB requirements have been met, reviews the video recording if needed, and approves or rejects the merchant. Upon approval, the merchant's account is activated in the PA's system, and the merchant can start accepting payments. The entire flow, from self-registration to account activation, can be completed within a few hours if the V-CIP call and checker review are handled promptly. This represents a dramatic improvement over traditional merchant onboarding, which could take days or weeks.
Fraud Prevention: Detecting Shell Merchants via Video Verification
One of the most significant fraud risks in the payment aggregator ecosystem is the onboarding of shell merchants, entities that exist on paper but have no genuine business operations. Shell merchants are used for various illicit purposes, including transaction laundering (processing payments for illegal businesses through a seemingly legitimate merchant account), money laundering, and chargeback fraud. Detecting shell merchants at the onboarding stage is critical because once a shell merchant is activated, significant financial damage can occur before the fraudulent activity is detected through transaction monitoring.
Video KYC provides a unique capability for detecting shell merchants that document-based verification alone cannot match. During the V-CIP session, the agent can ask the authorised signatory to describe their business in detail: what products or services they sell, who their typical customers are, how they fulfil orders, where their inventory is stored, and what their monthly revenue expectations are. A legitimate business operator will answer these questions fluently and consistently. A person fronting for a shell merchant will often struggle with details, provide vague or inconsistent answers, or show unfamiliarity with basic aspects of the declared business.
Agents trained in merchant fraud detection look for several specific red flags during V-CIP sessions. These include the signatory being unable to explain the business model, discrepancies between the declared business category and the documents provided (for example, claiming to be a restaurant but providing documents for an IT consulting firm), the signatory appearing to read from a script or receive coaching from someone off-camera, reluctance to show the business premises (for merchants with physical locations), and the signatory being located in a different city from the declared business address. Each of these indicators, individually or in combination, may suggest a shell or front merchant.
Beyond the human judgement element, the V-CIP platform's technical capabilities contribute to shell merchant detection. Geo-location data can confirm whether the signatory is physically near the declared business address. AI-based analysis can detect patterns across multiple merchant onboarding sessions, flagging cases where the same individual appears to be the signatory for multiple unrelated businesses (a common indicator of a shell merchant network). Cross-referencing with the MCA database can identify recently incorporated companies with minimal capital, which are frequently used as shell entities. The combination of human observation, structured questioning, and AI-powered analysis makes Video KYC the most effective tool available for merchant fraud prevention.
How BaseKYC Streamlines Merchant KYC for Payment Aggregators
BaseKYC offers a purpose-built merchant onboarding module designed specifically for payment aggregators' needs. The platform supports both individual (sole proprietor) and entity (company, partnership, LLP) merchant onboarding workflows, with configurable KYC checklists that adapt based on the merchant's business type and risk category. The agent interface presents a structured checklist that covers both KYC (signatory identity verification) and KYB (business verification) requirements, ensuring that no step is missed.
The platform integrates with multiple data sources for automated pre-verification before the V-CIP call. PAN verification via NSDL, GST registration check via the GST portal, company status verification via the MCA21 database, and CKYC fetch via CERSAI are all performed automatically when the merchant submits their application. By the time the V-CIP agent connects with the merchant's signatory, the system has already validated the merchant's legal existence and flagged any discrepancies that require the agent's attention during the call.
BaseKYC's API-first architecture makes it straightforward for PAs to integrate the V-CIP workflow into their existing merchant self-onboarding portals. The PA's system calls the BaseKYC API to create a merchant V-CIP session, receives a unique session link, and embeds it in their merchant onboarding flow. The merchant clicks the link to join the video call, and the entire session is managed by the BaseKYC platform. Once the session is complete and approved, the BaseKYC API sends a webhook notification to the PA's system with the verification result, enabling automatic activation of the merchant account.
For ongoing compliance, BaseKYC provides a re-KYC scheduling engine that automatically identifies merchants due for periodic review based on their risk categorisation and the PA's configured review cycle. The platform sends automated notifications to merchants, schedules V-CIP sessions for re-verification, and tracks the completion status of the re-KYC programme. The Checker Module ensures that all merchant V-CIP sessions, both initial and re-KYC, go through the maker-checker workflow before approval. Comprehensive dashboards provide the PA's compliance team with real-time visibility into onboarding volumes, approval rates, average processing times, and compliance metrics, enabling data-driven optimisation of the merchant onboarding process.