How to Build a PPI Wallet in India (2026): RBI Rules, Routes, Architecture and Cost
AI Summary: Building a Prepaid Payment Instrument (PPI) wallet in India involves choosing the right wallet category, understanding RBI regulations, and setting up secure payment infrastructure. Businesses can apply for RBI authorisation or partner with an existing authorised PPI issuer, depending on their business model. This guide covers RBI requirements, closed and semi-closed wallet options, KYC compliance, technical architecture, essential features, and development costs to help businesses plan their PPI wallet launch in 2026. |
A wallet looks simple from the outside: add money, pay, send, withdraw. In India, the moment that wallet can be used beyond your own store, it becomes a Prepaid Payment Instrument (PPI) regulated by the Reserve Bank of India. The regulator then decides how much it can hold, who can use it, where the money sits overnight and how it talks to UPI.
The rulebook is RBI's Master Directions on Prepaid Payment Instruments, first issued on 27 August 2021 and updated as on 30 September 2026. In April 2026 RBI also released a draft of a new PPI Master Direction for comment. As of today the 2021 Directions, as updated, are the ones in force.
This guide is for founders and product teams building a wallet for India. It covers what counts as a PPI, the three ways to launch, the limits your wallet engine must enforce, the rules that turn into software, a reference architecture, how to prepare for the draft, and what drives cost and timeline. We have separate guides on digital wallet app development in general and on wallet architecture and ledgers. This one is about the RBI layer. For licences across markets, start with our Fintech Licensing Requirements 2026 guide.
What counts as a PPI
RBI defines PPIs as instruments that let users buy goods and services, financial services and remittance services against the value stored in them. The Directions sort them like this:
Type | Who can issue | Key features | RBI approval? |
Closed-system PPI | Any entity, for its own goods and services | Usable only with the issuer; no cash withdrawal; no third-party payments | No. RBI says these are not a payment system it regulates |
Small PPI | Banks and authorised non-banks, after minimum details | Goods and services only; no funds transfer or cash withdrawal; tight limits | Yes |
Full-KYC PPI | Banks and authorised non-banks, after full KYC | Goods and services, funds transfer and cash withdrawal; up to ₹2 lakh outstanding | Yes |
Gift PPI | Banks and authorised non-banks | Up to ₹10,000, not reloadable, no cash-out | Yes |
PPI for Mass Transit (PPI-MTS) | Banks and authorised non-banks | Transit, toll and parking only; up to ₹3,000 outstanding; no KYC | Yes |
If your "wallet" is store credit, loyalty value or a balance usable only on your own platform for your own goods, you may be in closed-system territory. The moment users can pay other merchants with it, you are issuing a semi-closed or full-KYC PPI and need an authorised issuer.
Three routes to launch a wallet
Route | What you build | Who holds the licence and escrow | Capital | Best for |
Closed-system wallet | Balance, top-up and spend inside your own platform | No PPI licence needed; you still follow general law on refunds and consumer protection | Ordinary company capital | Marketplaces, gaming, ed-tech or mobility platforms selling their own services |
Co-branded PPI with an authorised issuer | Your app, brand and user journeys on top of a bank or non-bank PPI issuer's platform | The issuer | Ordinary company capital, plus commercial commitments to the issuer | Fintechs and consumer brands that want a wallet or prepaid card fast |
Own PPI authorisation | Full issuer stack: KYC, ledger, escrow, limits, interoperability, audits | You | ₹5 crore net worth at application, ₹15 crore by year 3 | Payments companies for whom the wallet is the core business |
Co-branding. The Directions allow co-branded PPIs under the issuer's Board-approved policy. The co-branding partner must be a company incorporated in India (or a government department), and the policy must set out each partner's roles and responsibilities. The issuer's name must be shown prominently alongside the PPI brand name. This is how most new wallet and prepaid card programmes launch.
Own authorisation: eligibility and process
For a non-bank, the Directions require:
A company incorporated in India, with PPI issuance covered in its Memorandum of Association
A minimum positive net worth of ₹5 crore, per the latest audited balance sheet, when it applies, maintained at all times
A minimum positive net worth of ₹15 crore by the end of the third financial year after final authorisation, maintained at all times
FDI-related capital requirements where foreign investment applies
An annual net-worth certificate from a chartered accountant
RBI first grants an in-principle approval valid for six months. Within that window you must submit a satisfactory System Audit Report (SAR), or the approval lapses. A one-time extension of up to six months can be sought in advance. The SAR deadline means your platform must be built and audited inside that window. In practice that means building before you apply.
Limits your wallet engine must enforce
These are the limits that hit product design most directly. The Directions contain more detail and two variants of small PPIs, so treat this as a summary.
Limit | Small PPI (with cash loading) | Full-KYC PPI |
Outstanding balance | Up to ₹10,000 | Up to ₹2,00,000 |
Loading | Up to ₹10,000 a month and ₹1,20,000 a financial year | Within the overall limit; cash loading for all PPIs capped at ₹50,000 a month |
Debits | Up to ₹10,000 a month | No separate limit for purchases within the overall PPI limit |
Funds transfer | Not permitted | Up to ₹2,00,000 a month per pre-registered beneficiary; ₹10,000 a month in other cases |
Cash withdrawal | Not permitted | Permitted |
KYC | OTP-verified mobile plus self-declared name and ID number | Full KYC; V-CIP permitted |
Conversion | Must convert to full-KYC within 24 months, or no further credits | — |
Build these as a configurable rules engine, not hard-coded checks. Limits work on rolling months and financial years, depend on KYC status, and differ by instrument type. They are also likely to change (see the draft section below). The Directions also say users must be able to set their own fund transfer limits within the issuer's limits, and that limits must be clearly shown to users.
RBI rules that become software
KYC and conversion
Your onboarding service needs two tiers: minimum-detail onboarding for small PPIs and full KYC for full-KYC PPIs, including video-based KYC (V-CIP) where you use it. Track the 24-month conversion deadline for small PPIs and stop credits automatically if it passes. Our guide to unified KYC and CKYC covers the India KYC building blocks.
Escrow and the daily balance test
A non-bank PPI issuer must keep the outstanding balance in an escrow account with a scheduled commercial bank (with an optional second escrow at another bank). At the end of each day, the escrow balance must not be lower than the value of outstanding PPIs plus payments due to merchants. Credits to escrow for loads must happen no later than the close of the business day. Any shortfall must be reported to RBI straight away. The Directions also list exactly which credits and debits are allowed.
For engineering, that means:
A double-entry ledger where every wallet movement maps to a permitted escrow credit or debit type
A daily job that compares total outstanding PPI value plus merchant dues with the bank escrow balance, and alerts before close of day
Strict separation of PPI funds from any other business you run. The Directions prohibit co-mingling with funds from activities such as payment aggregation or acting as a business correspondent (if you also run collections, see our payment aggregator guide for its separate escrow rules)
No interest paid on PPI balances to users
Authentication and fraud
Debits from PPIs, other than for PPI-MTS and gift PPIs, need two-factor authentication. PPI cards follow debit-card rules for additional factor authentication. Build step-up authentication into every debit path, along with device binding, velocity limits and anomaly alerts. The Directions also set customer liability rules for unauthorised electronic transactions in non-bank PPIs, so your dispute workflow must record when a user reported a fraud and what happened next.
Interoperability and PPI on UPI
For full-KYC wallets, interoperability is mandatory. The Directions say wallets must be interoperable through UPI and cards through authorised card networks. On the UPI side, NPCI's UPI Consolidated Circular (18 September 2026) says a PPI issuer participates in UPI as a PSP with its own UPI app, may let its full-KYC PPIs be discovered on third-party UPI apps, and cannot onboard users of banks or other PPI issuers. It also says PPI wallet users cannot set up a UPI Number. If you are also building a UPI app, read our UPI TPAP app guide for the rules that shape UPI screens and APIs.
Validity, expiry and closure
PPIs must be valid for at least one year from the last load or reload. The issuer must warn users at reasonable intervals during the 45 days before expiry, in their preferred language. Users must be able to close the PPI and move the balance back to source or to a pre-designated bank account, within applicable limits. Build an expiry scheduler, a notification service and a closure flow that pays out correctly.
Grievance redressal and statements
The Directions require a publicly disclosed grievance framework with a nodal officer, an escalation matrix and turnaround times. Issuers should act on complaints preferably within 48 hours and resolve them within 30 days. Users get complaint numbers with tracking, statements for at least the past six months, and a history of at least ten transactions. Plan the complaint module and statement export from day one.
Audits and data storage
An authorised non-bank PPI issuer must submit an annual System Audit Report, including a cyber security audit by a CERT-In empanelled auditor, within two months of the end of its financial year. Payment data must follow RBI's direction on storage of payment system data, which requires the data to be stored in India. Choose India-region hosting and keep audit logs complete and tamper-evident.
Reference architecture
Module | Responsibilities |
Onboarding and KYC | Minimum-detail and full KYC, V-CIP, conversion tracking, re-KYC |
Wallet ledger | Double-entry ledger, holds, reversals, instrument types (small, full-KYC, gift) |
Limits and rules engine | Configurable monthly, yearly and outstanding limits by PPI type and KYC tier |
Load service | Top-ups by UPI, cards, net banking and agents; cash-load caps |
Spend and transfer service | Merchant payments, P2P to pre-registered beneficiaries, bank transfers, 2FA |
UPI and card connectors | PSP integration for PPI on UPI; card network and processor for PPI cards |
Escrow reconciliation | Daily escrow-versus-outstanding check, permitted transaction mapping, shortfall alerts |
Expiry and closure | Validity tracking, 45-day expiry notices, closure payouts |
Risk and fraud | Velocity rules, device risk, AML monitoring, suspicious transaction reporting workflow |
Grievance and statements | Complaint numbers, tracking, six-month statements |
Admin and regulatory reporting | Board-policy configs, agent list publication, audit logs, RBI reporting |
If you launch on a co-branded model, the issuer runs the ledger, escrow and regulatory modules. You build the app, onboarding UX, risk signals and customer support, and integrate the issuer's APIs. Design your data model so a later move to your own authorisation is a migration, not a rebuild.
Planning for the 2026 draft Master Direction
In April 2026 RBI released a draft Master Direction on PPIs for public comment. News coverage and legal commentary report that it proposes changes to small PPIs and tighter limits on some full-KYC PPI transfers and cash loading. It also keeps the ₹5 crore and ₹15 crore net-worth structure. As of 1 November 2026 RBI has not issued it in final form.
Two practical steps protect your build:
Keep every limit configurable by PPI type, KYC tier and period.
Separate policy from code so a change in rules is a configuration and testing exercise, not a release cycle.
When the final Direction arrives, check the transition timelines before changing production limits.
Cost and timeline drivers
We do not quote fixed prices because scope varies widely. These are the drivers that matter:
Driver | Why it matters |
Route | Co-branded is an app and integration build; own authorisation adds ledger, escrow, audits and the in-principle approval clock |
PPI types | Small, full-KYC, gift and cards each add rules, limits and tests |
Interoperability | UPI PSP integration and card network certification are projects in their own right |
Load channels | Agents and cash loading add agent onboarding, due diligence and the ₹50,000 cash cap |
Risk and AML tooling | Transaction monitoring, case management and reporting |
Audit readiness | The SAR within six months of in-principle approval, plus the annual SAR with a CERT-In cyber audit |
Draft MD changes | Rework risk if limits are hard-coded |
Build plan in phases
Decide the route: closed system, co-branded with an issuer, or your own authorisation.
Design the ledger and limits engine around PPI types and KYC tiers.
Build onboarding, load, spend and P2P flows with 2FA.
Add escrow reconciliation, expiry, closure, grievance and statements.
Integrate UPI and, if needed, card issuance for interoperability.
Audit and launch. For your own authorisation, time the build so the SAR fits inside the in-principle window.
Build your PPI wallet with Fintegration
Fintegration builds payment, lending and banking platforms for fintechs in India and the US. We can help you pick between closed-system, co-branded and own-authorisation routes, design the wallet ledger, limits engine and escrow reconciliation, and integrate UPI, KYC and card issuing. Talk to our team to scope your wallet build.
FAQ
1. Do I need an RBI license to launch a PPI wallet in India?
Yes, non-bank companies generally need RBI authorisation to issue PPI wallets in India. Alternatively, you can partner with an authorised PPI issuer, depending on your business model.
2. How much does it cost to build a PPI wallet app in India?
The cost depends on app features, security, payment integrations, compliance, and infrastructure. RBI capital requirements, licensing expenses, and ongoing operational costs should be budgeted separately.
3. What is the difference between a closed wallet and a semi-closed PPI wallet?
A closed wallet works only with the issuing business and generally does not require RBI PPI authorisation. A semi-closed PPI wallet can be used at participating merchants and falls under RBI regulations.
4. Can I launch a PPI wallet in India without getting my own RBI license?
Yes. You may build a wallet experience by partnering with an RBI-authorised PPI issuer. The authorised issuer remains responsible for regulated activities, while your company provides agreed technology and customer-facing services.
5. What features are required to build an RBI-compliant PPI wallet?
A PPI wallet typically needs customer onboarding, applicable KYC checks, wallet loading, transaction history, security controls, fraud monitoring, and grievance redressal. Additional requirements depend on the PPI category and permitted services.
