RBI proposes measures to strengthen Prepaid Payment Instruments framework

The Reserve Bank of India issued a draft framework proposing specific security and operational measures for Prepaid Payment Instruments (PPIs), inviting stak...

What Happened

The Reserve Bank of India issued a draft framework proposing specific security and operational measures for Prepaid Payment Instruments (PPIs), inviting stakeholder comments until May 22, 2026.
On transaction security, the draft proposes extending RBI's zero-liability and limited-liability protections to unauthorised PPI transactions — ensuring customers are not penalised for fraud arising from third-party negligence or system breaches.
Refund norms have been clearly codified: refunds for failed, returned, rejected, or cancelled transactions must be applied to the respective PPI immediately, even if such refund causes a temporary breach of the prescribed balance limit for that PPI category.
Notably, refunds for transactions originally conducted via other payment instruments (e.g., bank transfer or UPI) cannot be credited into a PPI wallet — preventing round-tripping of funds.
On grievance redressal, all PPI issuers must establish a public grievance framework, appoint a designated nodal officer, and specify a clear escalation matrix — moving beyond informal complaint handling.
Issuers must disclose all applicable charges, instrument validity periods, and terms and conditions in simple, accessible language before the customer loads or uses the PPI.
Non-bank issuers face stricter operational oversight through quarterly auditor certification of escrow balances and mandatory fit-and-proper assessment of promoters regarding financial integrity and character.

Static Topic Bridges

Unauthorised Transaction Liability — RBI's Consumer Protection Architecture

The RBI's framework for limiting customer liability in unauthorised electronic transactions (first formalised in 2017 and progressively extended) establishes that a customer's financial liability for fraudulent transactions depends on where the negligence lies. If the breach is entirely on the bank or third party's side, the customer bears zero liability. If the customer has shared credentials negligently, liability is capped but not entirely zero. Prompt reporting triggers the most favourable liability outcome.

Zero liability: fraud due to bank/third-party negligence, reported promptly.
Limited liability: third-party fraud with customer reporting within 4 working days (₹5,000–₹10,000 cap depending on account type).
The protection explicitly covers digital payment instruments including debit cards, credit cards, and now PPIs.

Connection to this news: The 2026 PPI draft extends this liability shield to PPI-based transactions — a significant consumer protection upgrade, given that many PPI users are first-time or low-income digital payment participants who may be more vulnerable to fraud.

Grievance Redressal in Regulated Financial Services

In India, regulated financial entities — banks, NBFCs, payment system operators — are required to maintain internal grievance redressal mechanisms and comply with the RBI's Integrated Ombudsman Scheme (RBI-IOS), 2021. The IOS provides a single-window complaint resolution mechanism for customers of RBI-regulated entities, including PPI issuers. A well-functioning internal grievance system (nodal officer, escalation matrix) is a prerequisite before a customer can approach the Ombudsman.

The RBI Integrated Ombudsman Scheme (2021) merged three earlier ombudsman schemes (banking, NBFC, digital payments) into a unified framework.
Complaints must first be raised with the regulated entity; if unresolved within 30 days, the customer may approach the Ombudsman.
CEPAC (Centralised Receipt and Processing Centre) handles ombudsman complaints digitally.

Connection to this news: The draft's requirement for a public grievance framework with a named nodal officer and escalation matrix directly aligns with the IOS's prerequisite of internal resolution before ombudsman intervention — strengthening the first line of consumer protection.

Escrow Accounts and Capital Adequacy for Non-Bank PPI Issuers

Non-bank PPI issuers (e.g., fintech wallets) are not deposit-taking entities and thus do not benefit from the banking system's depositor protection infrastructure. To safeguard customer funds, the RBI requires non-bank issuers to hold customer balances in a separate escrow account with a scheduled commercial bank. This account is ring-fenced from the issuer's operational funds and cannot be used for business expenses.

Escrow balance certification must be done quarterly by a statutory auditor — creating a periodic verification checkpoint.
Minimum net worth requirements (₹5 crore at application, ₹15 crore within 3 years) provide capital adequacy safeguards alongside fund segregation.
Fit-and-proper assessment of promoters ensures that individuals with a history of financial misconduct cannot run PPI businesses.

Connection to this news: The proposed security measures around escrow certification and promoter eligibility directly address the risk of financial misconduct or misappropriation of customer funds held in digital wallets — a concern heightened by high-profile fintech failures globally.

Digital Payment Security — Cyber Risk in the PPI Ecosystem

PPIs, by virtue of being entirely digital instruments, are inherently exposed to cyber threats including phishing, SIM-swap fraud, and account takeovers. The RBI's approach to PPI security is layered: authentication requirements (AFA for registration and high-value transactions), liability frameworks (limiting customer exposure to fraud), and now operational safeguards (clear refund timelines, grievance mechanisms). This aligns with the RBI's broader cybersecurity framework for regulated entities issued in 2023–24.

The RBI Master Directions on Cyber Resilience and Digital Payment Security Controls (2023) set baseline cybersecurity standards for payment system operators.
Transaction monitoring, anomaly detection, and fraud reporting systems are required of all regulated payment entities.
The 2026 PPI draft complements cybersecurity rules by addressing the post-fraud consumer remediation side — through liability norms, refunds, and grievance redressal.

Connection to this news: The proposed measures — immediate refunds on failed transactions, codified liability limits, and mandatory grievance frameworks — constitute the consumer-facing dimension of PPI security, converting technical security standards into tangible protections that users can rely on.

Key Facts & Data

Consultation deadline: May 22, 2026
Consultation channel: RBI's "Connect 2 Regulate" portal
Zero-liability extension: Now explicitly covers unauthorised PPI transactions
Refund rule: Immediate credit to PPI even if it temporarily breaches balance limits
Refund restriction: Refunds of non-PPI-originated transactions cannot be credited to PPIs
Grievance requirement: Nodal officer appointment + public escalation matrix mandatory
Disclosure requirement: All charges, validity, terms in simple language before use
Escrow certification: Quarterly by statutory auditor (non-bank issuers)
Net worth requirement: ₹5 crore (application) → ₹15 crore (within 3 years) for non-bank issuers
Promoter assessment: Fit-and-proper criteria on financial integrity and character
Regulatory framework: Payment and Settlement Systems Act, 2007; RBI Integrated Ombudsman Scheme, 2021