RBI releases guidelines for due diligence of AEPS Touchpoint Operators

Background

Following multiple reports on identity theft and compromise of customer credentials in the use of Aadhaar enabled Payment System (AePS), the Reserve Bank of India (RBI) has issued guidelines under Section 18 read with Section 10(2) of the Payment and Settlement Systems Act, 2007 on ‘Aadhaar Enabled Payment System – Due Diligence of AePS Touchpoint Operators’ on 27 June 2025 (Guidelines) to protect customers’ interest.

AePS was launched with the objective to promote financial inclusion and enable secure and interoperable digital transactions, particularly for rural populations in India residing in remote locations with limited ATMs and bank branch access. As a result, individuals in the remotest parts of the country can now withdraw money from a local shop (which is designated as an AePS Touchpoint Operator (ATO)) by providing their Aadhaar number and biometrics on the operator’s micro–ATM. To clarify, ATOs are the individuals appointed by the acquiring banks to facilitate the AePS transactions. This initiative by the National Payments Corporation of India (NPCI) has unparallel potential to facilitate interoperable digital transactions and promote financial inclusion in India. However, to avoid any missteps, the RBI has now stepped in to ensure paramount protection of customer interests.

Applicability and effective date

The Guidelines are applicable to the acquiring banks which are essentially banks which acquire transactions initiated through the devices provided by them to the ATO (Acquiring Banks). The Acquiring Banks route transactions initiated through their devices, regardless of whether the customer holds a bank account with that bank or not, to the NPCI, which then forwards it to the issuer bank (the bank where the customer’s Aadhaar linked account is held) for processing of the transaction. The Guidelines are effective on the acquiring banks from 1 January 2026.

Salient features of the guidelines

• Due diligence: Acquiring Banks are required to carry out due diligence of all ATOs before onboarding them, adopting the same standards required under the Customer Due Diligence Procedure for Individuals under the RBI’s ‘Master Direction - Know Your Customer (KYC) Direction, 2016’ dated 25 February 2016 (MD). This move will ensure the Acquiring Banks follow strict procedures as followed for individual customers onboarding under the MD. However, if the due diligence of ATOs has been done in their capacity as business correspondents (entities or individuals engaged by banks to provide financial services in unbanked or underbanked areas) / sub-agent (individuals or entities appointed by business correspondents to perform the same functions), then the same will suffice as far as the onboarding formalities are concerned. Additionally, ATOs not functioning for a period of 3 (three) months are required to go through KYC before making any new transactions.
• Ongoing transaction monitoring and risk management: The Acquiring Banks are required to monitor the activities of ATOs through the transaction monitoring systems on an ongoing basis and set operational parameters, based on business risk profile of the ATOs. Further, the Acquiring Banks are required to regularly review these parameters to adapt to emerging risks and are also required to implement strict controls, such as using Application Programing Interfaces (APIs) solely for AePS transactions to prevent unauthorized access.

Comments

The Guidelines issued by RBI aim to prevent fraud, enhance trust of users, and streamline operations of AePS which will ultimately lead to greater trust in digital banking amongst users in underserved regions. By enhancing fraud prevention, and streamlining operations, these measures pave the way for a more inclusive financial ecosystem. This proactive step also ensures that the digital banking is more actively adopted in the rural regions which have traditionally been less interested in the emerging methods of banking, empowering communities and driving India’s financial inclusion forward.

• Harsh Walia (Partner) and Rupendra Gautam (Senior Associate)
  
  For any queries please contact: editors@khaitanco.com