Navigating RBI: A Regulatory Framework for Agent Payments

Every fintech founder in India has a complicated relationship with RBI. The regulator is simultaneously the most progressive and most demanding in the world.

But for agentic payments, RBI's existing frameworks are surprisingly well-suited. The rules aren't the obstacle — they're the foundation.

The PA/PG Framework

In 2020, RBI introduced the Payment Aggregator and Payment Gateway guidelines. These were designed for human-facing payment flows, but the core principles translate directly:

Settlement timelines. PAs must settle merchant funds within T+1. For agent transactions, this is more than sufficient — most workflows need minutes, not days.

Escrow requirements. PAs must maintain escrow accounts for funds in transit. This aligns perfectly with the agent escrow pattern — funds are held safely between agent authorization and delivery confirmation.

KYC norms. PAs must verify merchant identity. For agentic commerce, this means every vendor an agent pays must be KYC-verified. India Stack makes this trivially automatable.

Nodal accounts. Funds in transit must sit in designated nodal accounts, not co-mingled with operating funds. Clean separation of agent funds from platform funds.

The PA license isn't a barrier. It's a clear, defined path with known requirements.

The Mandate Framework

UPI mandates — the mechanism that powers recurring payments — are governed by clear rules:

Maximum amount per mandate: currently ₹1 lakh for most categories, ₹15,000 for auto-debit without additional factor
Registration requires customer authentication: the user must approve the mandate creation with UPI PIN
Pre-debit notification: 24 hours before any debit, the customer must be notified
Easy revocation: mandates can be cancelled instantly through any UPI app

For agentic payments, mandates provide the control layer. The user creates a mandate specifying:

Which agent can use it
Maximum amount per transaction
Maximum amount per period (daily/weekly/monthly)
Which merchant categories or specific VPAs are allowed

The agent operates within these bounds. The user retains full control. RBI's framework ensures the user is never locked out.

Data Localization

RBI's 2018 data localization circular requires all payment data to be stored in India. For agentic payments, this means:

Transaction logs stored domestically
Agent decision data stored domestically
User mandate information stored domestically

This is not a burden — it's a feature. Users can be confident their financial data and agent activity data stays within Indian jurisdiction. For enterprise adoption, this removes a major objection.

TDS Compliance

This is where most payment platforms stumble. India's TDS (Tax Deducted at Source) regime requires:

Section 194C: 1% TDS on contractor payments above ₹30,000 (single) or ₹1 lakh (aggregate)
Section 194J: 10% TDS on professional/technical services
Section 194O: 1% TDS on e-commerce operator payments

When an agent pays a vendor, TDS must be deducted correctly, deposited with the government quarterly, and certificates issued.

An agentic payment system must:

Classify the payment (goods vs. services vs. professional fees)
Check aggregate thresholds for the financial year
Deduct the correct TDS rate
Generate Form 26Q data
Issue Form 16A to the vendor

This is complex for humans. It's trivial for software. The rules are deterministic — given the payment type, amount, and vendor status, the TDS treatment is unambiguous. This is exactly the kind of problem AI agents should solve.

GST Input Credit

Every business paying GST wants input tax credit. When agents make purchases, they need to:

Verify the vendor's GSTIN is active
Ensure the invoice is GST-compliant
Match the invoice against GSTR-2B
Claim ITC in the correct return period

Today, accountants do this manually — or use semi-automated tools that still require human review.

An agentic system can do this in real-time: verify GSTIN at the moment of payment, capture invoice data, automatically reconcile against GSTR-2B filings, and flag mismatches immediately.

The compliance advantage of agentic payments isn't just speed — it's accuracy. Machines don't forget to claim ITC. They don't mis-classify TDS sections. They don't miss filing deadlines.

What RBI Hasn't Addressed Yet

Honest gaps in the current framework:

Agent identity. Current KYC norms are designed for humans and businesses. There's no framework for "this is an AI agent acting on behalf of entity X." This will need to be defined — likely through a principal-agent authorization framework.

Liability. If an agent makes an unauthorized payment, who is liable? The user who set up the mandate? The platform that facilitated it? The agent developer? Current consumer protection frameworks don't cleanly address this.

Transaction velocity. Current UPI infrastructure handles human transaction patterns. Agents could generate 10–100x the transaction volume per user. NPCI may need to create agent-specific rate limits or pricing tiers.

Dispute resolution. The current UPI dispute resolution process assumes human parties. When both sides of a transaction are agents, the dispute process needs to be machine-readable.

These gaps are real but bounded. They don't require new legislation — they require RBI circulars and NPCI guidelines. The foundation exists. The specifics need to be filled in.

The Regulatory Moat

Here's the counterintuitive insight: India's regulatory requirements create a moat, not a barrier.

Anyone building agentic payments in India must understand PA licensing, TDS compliance, GST integration, and data localization. This is a high knowledge barrier.

For those who've already navigated these waters, the regulatory framework is protective. The companies that build regulatory compliance into their agentic payment infrastructure from day one will be extraordinarily difficult to displace.