Imagine this: You wake up to discover your checkout page is broken. Customers can't pay. Your payment provider's website shows a notice about "regulatory action." You learn they never had proper authorization, and now you're scrambling to migrate while losing sales every hour.

This scenario plays out more often than merchants realize. In India alone, the RBI has taken action against several unauthorized payment aggregators. The merchants using them faced immediate disruption with no warning.

Payment regulation sounds like a compliance department problem, but for most merchants, it's an infrastructure problem. Your provider's compliance status directly affects whether your business can accept payments tomorrow.

This guide covers the regulations that matter, what your provider should handle, and what responsibilities remain yours.

Payment compliance explained: What merchants actually need to know

Key takeaways:

• Your immediate risk isn't regulators auditing you; it's your provider losing authorization

• PCI DSS compliance typically falls on your provider when you use hosted checkout

• In India, tokenization has been mandatory since January 2022; saved cards don't work without it

• Data localization requirements in India have real enforcement; DPDP Act penalties are theoretical for now

• Choosing an authorized, compliant provider handles most regulatory requirements on your behalf

Why does payment regulation matter for merchants?

Your immediate risk isn't regulators at your door; it's your payment provider losing authorization and your checkout going dark. Regulation affects you through your infrastructure, not direct enforcement.

Consider what happens if:

• Your aggregator loses RBI authorization. Checkout stops immediately.

• Your provider suffers a breach due to poor security. Your customers' cards are compromised.

• You're storing card data you shouldn't. You become liable for fraud losses.

RBI isn't going to audit your ₹50 lakh e-commerce store. The FTC isn't reviewing your Shopify checkout. But the providers you use are under constant scrutiny, and their compliance failures become your operational emergencies.

The practical question isn't "how do I comply with every regulation?" It's "how do I ensure my provider is compliant, so I don't have to worry?"

For background, see Understanding security in payment systems. You can also check out our whitepaper on compliance and security.

Who regulates payments?

Regulatory oversight differs by jurisdiction. Understanding who governs what helps you know which questions to ask your provider.

Key difference between markets: India has centralized payment regulation through the RBI with specific authorization requirements. The US has fragmented oversight across federal and state bodies, with no equivalent tothe  RBI's payment aggregator framework. This means compliance requirements differ significantly depending on where you operate.

What do RBI's Payment Aggregator guidelines require?

RBI's Payment Aggregator guidelines require aggregators to hold authorization, maintain escrow accounts, conduct security audits, and perform merchant KYC. Merchants must verify that their provider appears on RBI's authorized list.

What this means for you:

Using an unauthorized aggregator isn't a trade-off between lower fees and higher risk. It's using an illegal payment provider. If RBI takes action, your checkout stops immediately with no transition period.

Before signing with any payment provider in India, check the RBI's list. It takes two minutes and prevents catastrophic disruption.

What authorized aggregators provide:

• Escrow account protection for merchant funds

• Periodic Security third party audits for the PA entity

• Customer grievance redressal mechanisms

• KYC verification during onboarding

These protections exist because the aggregator handles them. You benefit without managing compliance yourself.

Zoho Payments is RBI-authorized, providing escrow protection and compliant onboarding.

For more, see Know all about payment facilitators and Understanding KYC.

What is PCI DSS, and how does it apply to merchants?

PCI DSS is the security standard for any entity handling account data like cardholder data and sensitive authentication data. If you use hosted checkout, your provider handles compliance; you don't need to complete assessments yourself.

The practical reality:

When customers enter card details on your provider's checkout page (not yours), you never touch card data. Your provider bears the compliance responsibility. Zoho Payments is PCI DSS Level 1 certified, the highest level.

When merchants have direct obligations:

You have compliance responsibilities if you:

• Store card numbers in your own systems (which you shouldn't)

• Have the card data pass through your servers

• Handle physical card data with your own terminals

Even then, using a compliant provider significantly reduces your scope.

PCI levels (for reference):

Most SMEs fall into Level 3 or 4, but with hosted checkout, your provider's Level 1 certification covers infrastructure requirements.

For details, see PCI compliance: An overview.

What are the card tokenization requirements in India?

Since January 2022, merchants in India have not stored actual card numbers. Saved cards must use network tokens, and customers must explicitly consent to tokenization.

As the RBI directive states: "No entity in the card transaction/payment chain, other than the card issuers and/or card networks, shall store the actual card data."

What this means practically:

If you offered "save card for future purchases" before 2022, that functionality now requires tokenization. Your provider handles implementation. Checkout flows capture consent, the network generates a merchant-specific token, and that token gets stored.

If saved cards stopped working for some customers in early 2022, this mandate is why. Cards needed re-tokenization with fresh consent.

For subscription businesses: Tokenization is essential. Without it, recurring billing on saved cards doesn't work in India.

Zoho Payments supports RBI-compliant tokenization for saved cards and recurring billing.

For more, see Secure transactions with payment tokenization.

Card security is only one part of compliance. Payment data also falls under broader data protection laws that govern how information is stored, accessed, and shared.

How does data protection regulation apply to payments?

Payment data is personal, confidential/sensitive data under regulations. Requirements include consent, security safeguards, and, in India, mandatory local storage.

India: DPDP Act and data localization

The Digital Personal Data Protection Act (2023) treats payment data as personal data requiring:

• Consent for data processing

• Security safeguards for stored data

• Customer rights to access and erasure

• Breach notification obligations

Penalties can reach ₹250 crore, but enforcement priorities remain unclear as rules are finalized. The more immediate concern is RBI's data localization mandate, which requires payment system data to be stored only in India. RBI actively enforces this.

US: Fragmented state requirements

The US lacks a federal data protection law equivalent to DPDP. Instead, state laws create a patchwork:

• California's CCPA/CPRA gives consumers data rights

• Similar laws exist in Virginia, Colorado, and Connecticut

• Payment data falls under these requirements

Practical steps:

• Ensure your provider stores data in the required jurisdiction

• Review data retention policies

• Update privacy notices to describe payment data collection

For breach prevention, see Preventing data breaches in online payments.

How can merchants build and maintain compliance?

Compliance comes down to four steps: verify your provider's authorization, use hosted checkout to avoid card data exposure, train staff on security basics, and review certifications annually.

1. Verify your provider

• India: Confirm RBI authorization on the official list

• Everywhere: Request PCI DSS Attestation of Compliance

• Check tokenization and data localization support

2. Use compliant integration

• Hosted checkout or payment links keep card data off your systems

• Never store card numbers, CVVs, or full track data

• Use tokenization for saved cards

3. Handle your responsibilities

• Train staff not to write down or request card numbers verbally

• Restrict payment dashboard access to necessary personnel

• Document data handling procedures

4. Stay current

• Watch for RBI circulars if operating in India

• Verify provider certifications annually

• Review when regulations change (your provider should notify you)

Additionally, merchants should advise customers against entering cardholder data in any fields other than those designated for payments. Personally Identifiable Information (PII) should be appropriately entered as input in relevant text fields, ensuring that the data is encrypted by default.

Staying compliant without the complexity

Payment regulation sounds daunting, but for most merchants, compliance means choosing the right provider and following basic security practices.

Three things to remember:

1. Your provider carries most compliance burden. RBI authorization, PCI DSS certification, tokenization, data localization—these are provider responsibilities. Your job is to verify they handle them.

2. Don't undermine your provider's work. Storing card data you shouldn't, sharing dashboard credentials, ignoring security training—these create liability even with a compliant provider.

3. The regulatory landscape will evolve. DPDP Act rules will clarify. New RBI circulars will be issued. A compliant provider absorbs this complexity, notifying you when something changes.

Zoho Payments is RBI-authorized, PCI DSS Level 1 certified, supports tokenization, and stores data in India. It integrates across the Zoho ecosystem, including Books, Invoice, Inventory, and CRM. See how it simplifies compliance for your business.