You add a "Pay now" button, a customer taps it, and a few seconds later your dashboard says "captured". A lot happens in those seconds, and more happens over the next day or two before the money reaches your bank account. Founders who understand that chain make better choices about providers, refunds and reconciliation, and they spend less time confused when a payment shows "successful" for the customer but "pending" for them.
This guide explains how online payments move in India from checkout to settlement, who is regulated for what, and what that means for an early-stage startup. The regulatory details were re-checked against the Reserve Bank of India's own pages on 27 October 2026.
The short answer
When a customer pays you online, three kinds of players are involved. A payment gateway carries the payment instruction between your checkout and the banks or networks. A payment aggregator goes further: it collects the money from customers on your behalf and later settles it to your bank account. The banks and networks behind them, such as the card networks, the customer's bank and UPI, approve or decline the payment and move the funds.
Most products Indian founders call a "payment gateway" are, in regulatory terms, payment aggregators, because they hold and settle merchant funds. That distinction decides who is licensed by RBI and who is answerable for your money.
Gateway vs aggregator: the line RBI draws
RBI's Master Direction on Regulation of Payment Aggregators, issued on 15 September 2025, replaced and consolidated the earlier 2020 and 2021 guidelines on payment aggregators and payment gateways. Its definitions are worth knowing:
- A payment gateway (PG) is "an entity that provides technology infrastructure to route and facilitate processing of a payment transaction without any involvement in handling of funds." The direction says a PG does not fall within its scope, although it encourages PGs to follow RBI's baseline technology recommendations.
- A payment aggregator (PA) facilitates payments made by customers to merchants through the merchant's interface and "subsequently settles the collected funds to such merchants."
RBI then splits aggregators into three categories:
| Category | What it covers |
|---|---|
| PA - Online (PA-O) | Payments where the customer's instrument and the acceptance device are not physically together: website and app checkouts |
| PA - Physical (PA-P) | In-person payments, where the instrument and device are close together, such as card machines |
| PA - Cross Border (PA-CB) | Inward or outward cross-border payments for permitted current-account transactions through e-commerce |
Banks do not need separate authorisation to run a PA business. A non-bank aggregator has to apply to RBI, must be a company incorporated in India, and needs a net worth of at least ₹15 crore when it applies, rising to ₹25 crore by the end of the third financial year after authorisation. Those thresholds are why most startups use an aggregator rather than becoming one.
What happens in the seconds after "Pay"
The exact route depends on the payment method, but the pattern is the same: your checkout hands the request to your provider, the provider routes it, and the customer's bank decides.
Cards. The customer enters card details or picks a saved card in your provider's checkout. The provider sends the request through the card network to the issuing bank, which runs its checks and asks the customer to authenticate, usually with a one-time password. The bank approves or declines, and the answer travels back to your provider and then to your app. RBI's direction adds that an aggregator must not offer an ATM PIN as an authentication factor for online card payments, and must not set its own amount limits per payment mode; those limits belong to the issuer.
UPI. The customer either scans a QR code, is sent to a UPI app on the same phone, or approves a collect request. The customer's UPI app and bank authorise the debit, the UPI network routes it to the bank that receives funds for your provider, and your provider marks the order paid.
Net banking and wallets. The customer is redirected to their bank or wallet, signs in there, approves the payment and is sent back to your site.
In each case, the provider then tells your server about the result, typically through a webhook and a status API. That server-side confirmation, not the customer's browser landing on your "thank you" page, is what you should trust before you deliver anything.
Where the money goes before it reaches you
An approved payment is not yet money in your bank. With an aggregator, funds are collected first and settled to you later, in batches, according to the settlement terms in your merchant agreement. RBI's direction has a full chapter on settlement of funds and escrow accounts for aggregators, which is the regulatory backstop for merchant money held in transit.
For a founder, the practical points are:
- Know your settlement cycle. Your agreement and dashboard state when captured payments are paid out and how fees and taxes are deducted. Plan cash flow around that, not around the moment of payment.
- Reconcile three numbers. Match orders in your database, payments in the provider dashboard, and settlements in your bank statement. Most providers offer settlement reports that tie payouts back to individual payments.
- Expect holds. Providers can delay or hold settlements during onboarding checks or disputes, so do not promise suppliers payment from money that has not settled.
Refunds, failed payments and chargebacks
Three situations cause most support tickets, and RBI's direction touches each of them.
- Refunds. The direction says all refunds must go back to the original method of payment, unless the payer specifically asks for an alternate mode that belongs to them. Build your refund flow around that, rather than offering store credit by default on a cancelled card or UPI payment.
- Failed transactions. When money leaves the customer's account but the payment fails, the aggregator's dispute mechanism must follow RBI's turnaround-time rules for failed transactions. Show customers a clear "payment pending" state and do not ask them to pay twice.
- Chargebacks and disputes. Aggregators must have a dispute mechanism that covers chargebacks raised against their merchants, and their agreements must spell out refunds, failed transactions, returns, grievance redressal and reconciliation. Read that section before you sign, and keep delivery proof and customer communication so you can respond to a dispute.
Card data and tokenisation
Your app should never store raw card numbers. Under RBI's card tokenisation framework, the actual card details are replaced by a token, and RBI's FAQ states that a token requestor "cannot store Primary Account Number (PAN), i.e., card number, or any other card detail." Saved-card features therefore run through tokens managed via your provider and the card networks. If a developer suggests storing card numbers "just for repeat orders", say no.
Choosing and onboarding a provider
Before you integrate, do three checks:
- Regulatory status. RBI publishes the status of payment aggregator applications on its website. The version we checked was "as on 16.10.2026". It separates existing online aggregators that can operate (with remarks such as "In-Principle Authorisation Granted" or "Application Under Process") from new applicants that cannot operate yet, and it flags some names with a note that no new merchants are to be onboarded until RBI advises otherwise. Look up your shortlisted provider there. Our guide to checking a fintech startup's RBI authorisation claim explains how to read these lists.
- Fit for your model. Subscriptions, marketplaces with split payouts, and international customers each need specific features. For cross-border sales, note that the direction caps a PA-CB transaction at ₹25 lakh. Compare providers in our Razorpay vs PayU vs Cashfree breakdown and the wider list of payment gateways for Indian SaaS.
- Onboarding readiness. Aggregators must carry out due diligence on the merchants they onboard, so expect to share business documents and have your website reviewed. A live site with clear pricing, refund and contact details, and terms of service written for a SaaS product, makes that review smoother.
An integration checklist for your first release
- Create orders on your server and pass only the order reference to the client.
- Verify webhook signatures on the server, and make the handler idempotent so a repeated event does not fulfil an order twice.
- Treat the client-side success callback as a hint; confirm the status with the provider's API or a verified webhook before fulfilment.
- Store provider payment IDs against your orders so refunds and disputes can be traced.
- Add GST correctly on invoices; see our GST guide for SaaS founders.
- If UPI is your main method, read our UPI integration guide for SaaS for intent, QR and recurring payment options.
When your product is ready for customers, you can list your startup on SuperLaunch and browse the startup perks directory for tools that help with launch costs.
FAQ
Is Razorpay or Cashfree a payment gateway or a payment aggregator?
In everyday language they are called payment gateways. Under RBI's definitions, a business that collects customer payments and settles them to merchants is acting as a payment aggregator. Check the provider's current status on RBI's published list rather than relying on marketing pages.
Does my startup need an RBI licence to accept online payments?
Generally, no. A merchant accepting payments for its own goods or services through a permitted aggregator or a bank is the merchant in the chain, not the aggregator. RBI's authorisation applies to entities that run the aggregation business itself. If your platform collects money on behalf of other sellers, take legal advice, because that can move you closer to aggregation.
Why is a payment "captured" but not in my bank account?
Capture means the payment was approved and taken. Settlement to your bank happens later, on the cycle in your merchant agreement, after fees and taxes are deducted. Use your provider's settlement report to match payouts to payments.
Can I refund a customer to a different account?
RBI's direction says refunds go to the original payment method, unless the payer specifically asks for another mode that belongs to the same payer.
