Who Requires an RBI PA and PG Audit?
Audit obligations depend on whether you operate as a payment aggregator or only as a payment gateway.
Online Payment Aggregators (PA-O)
Physical Payment Aggregators (PA-P)
Cross-Border Payment Aggregators (PA-CB)
Applicants for PA Authorisation
Payment Gateways Adopting RBI Baselines
E-Commerce Firms with PA Businesses
Our RBI PA and PG Audit Approach
A structured, regulation-mapped audit covering systems, security controls and cyber resilience.
Deliverables You Can Expect
Regulation-specific outputs for your compliance team and RBI submission.
System & Cyber Security Audit Report
Annual audit report against applicable RBI PA requirements
Regulatory Gap Assessment
Gaps mapped to the PA Directions and cyber resilience directions
Executive Compliance Summary
Board-level view of compliance posture and priorities
Benefits of RBI PA and PG Audits
Timely RBI Submission
Annual audit completed with clear, organized evidence
Enhanced Payment Security
Transaction and fraud control weaknesses prioritized
Reduced Regulatory Risk
Gaps identified before RBI reviews them
Stronger Governance
Board-ready reporting mapped to RBI requirements
Authorisation Readiness
Clear view of controls for applicants
Merchant & Bank Trust
Independent evidence for partners and acquirers
Why Payment Aggregators Choose QRC
RBI-focused expertise. Payment security depth. Actionable, audit-ready outcomes.
Audits aligned to the PA Directions 2025 and RBI's cyber resilience directions for non-bank PSOs.
Combined review of governance, security controls, infrastructure and operational practices.
QRC Assurance and Solutions is listed by CERT-In as an empanelled information security auditing organization.
Experience across RBI PSS, PCI DSS, data localization and ISO 27001.
Supporting Services
Services that complement your PA audit across application testing, data storage and payment compliance.
Web Application Security (WAPT)
Tests checkout and merchant portals for exploitable weaknesses.
Learn More
Mobile Application Security
Tests payment and merchant mobile apps for security weaknesses.
Learn More
RBI Data Localization Audit (SAR)
System Audit Report on storage of payment data in India.
Learn More
24×7 Managed SOC Services
Continuous monitoring to support detection and incident reporting.
Learn MoreReal-World RBI PA Audit Outcomes
How payment aggregators have used QRC audits to meet RBI's annual audit expectations.
RBI PA and PG Resource Center
Practical resources to help payment aggregators and gateways understand RBI requirements.
RBI Cybersecurity Directions 2026: A Complete Compliance Guide
RBI's approach to cybersecurity regulation has evolved from advisory circulars to mandatory directions. The regulatory landscape for financial institutions now…
RBI issues new norms for digital payments
With rising cases of cyber fraud RBI published a Master Direction providing necessary guidelines.
Merchant’s guide for payment security requirements
Ecommerce, online payment transactions are advancing their path in this developing technology.
Frequently Asked Questions
RBI's Payment Aggregator Directions, issued in September 2025, consolidate the earlier PA and PG guidelines. Non-bank PAs must also follow RBI's Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank payment system operators.
Yes. The PA Directions require an annual system audit, including a cyber security audit, by a CERT-In empanelled auditor, with the report submitted to RBI within the timelines it prescribes.
Payment gateways that only provide technology, without handling funds, fall outside the PA Directions. RBI encourages them to adopt its baseline technology recommendations, which QRC can review.
They are the online, physical (point of sale) and cross-border categories of payment aggregators under the PA Directions. Your category shapes the audit scope.
QRC is a CERT-In empanelled auditor, which the PA Directions require for the annual system and cyber security audit.
Timing depends on the entities, systems and locations in scope and how readily evidence is available. QRC confirms a realistic timeline after the scoping call.
Ready to Complete Your RBI PA Audit?
Define your scope, identify priority gaps and prepare for RBI submission.