支付聚合商与支付网关：结算与托管账户管理及其他指示准则

Payment Aggregators facilitate e-commerce sites and merchants to accept various payment instruments from customers without the need for merchants to create a separate payment integration system of their own. Payment Gateways (PGs) provide technology infrastructure to route and facilitate the processing of an online payment transaction without any involvement in the handling of funds. PAs and PGs allow customers sitting on one end of the world to make payments to a person sitting at another end without any fear of fraud.

Payment Aggregators manage the funds of a merchant. Therefore, their activities are required to be more regulated. Reserve Bank of India (RBI) has issued “Guidelines on Regulation of Payment Aggregators and Payment Gateways” vide RBI/DPSS/2019-20/174 dated 17th March 2020 to regulate payment aggregators.

This article discusses the guidelines issued to operate the Payment Gateway entities:

1. Policy of taking Merchant On-Board

The Merchants obtain services of the payment gateways to get hassle-free payment from their customer through any mode. However, as per the Guidelines issued, the Payment aggregators are required to note the following points while taking a merchant on board:

• PAs shall have a Board approved policy for merchant on-boarding.
• PAs shall undertake background and antecedent checks of the merchants and shall make sure that the merchant does not have any intention of duping the customers and does not sell fake or prohibited products, etc.
• The merchant’s website specifies the terms and conditions of the service and the timeline for processing returns and refunds.
• PAs shall be responsible for checking Payment Card Industry-Data Security Standard (PCI-DSS) and Payment Application-Data Security Standard (PA-DSS) compliance of the infrastructure of the merchants on-boarded.
• Merchant sites shall not save the customer card and such related data. For this purpose, the PAs may carry out a security audit of the merchant.
• Agreement with merchant shall have provision for security and privacy of customer data. PA's agreement with merchants shall include compliance with PA-DSS and incident reporting obligations.
• The PAs shall obtain periodic security assessment reports either based on the risk assessment (large or small merchants) or at the time of renewal of contracts.

2. Settlement and Escrow Account Management

The Payment Aggregators collect the funds from the customers and then transfer the same to the merchant. RBI specified the following guidelines that how payment aggregators shall manage the funds and within how much time the funds should be credited to merchants' accounts.

延伸阅读： 支付聚合商与支付网关指南：含义、授权及资本要求

a. Escrow Account:

• Non-bank PAs shall open an escrow account with any scheduled commercial bank and all the funds collected from the customers shall be received in such escrow account.
• An additional escrow account may be maintained with a different scheduled commercial bank at the discretion of the PA.
• The PAs can shift the escrow account from one bank to another. However, the same shall be carried out in a time-bound manner without impacting the payment cycle to merchants, under advice to RBI.

b. Time cycle of receipt of funds in an escrow account and transfer of funds from the escrow account

• The following are the key terms used:
  • Tp’ – date of charge/debit to the customer’s account against the purchase of goods/services.
  • ‘Ts’ – date of intimation by the merchant to the intermediary about the shipment of goods.
  • ‘Td’ – date of confirmation by the merchant to the intermediary about delivery of goods to the customer.
  • ‘Tr’ – date of expiry of refund period as fixed by the merchant.

• Amounts deducted from the customer’s account shall be remitted to the escrow account of the PA on a Tp+0 / Tp+1 basis. The same rules shall apply to non-bank entities where wallets are used as a payment instrument.
• The Final settlement with the merchant shall be effected as under:

• Settlement of funds with merchants shall not be co-mingled with other businesses, if any, handled by the PA.

c. Guidelines on Refund transactions:

• Credits towards reversed transactions, where initial funds were received through PA, shall be routed back through the escrow account except where the refund is directly managed by the merchant and the customer is aware of the same.

d. Other terms and conditions

• At the end of the day, the PA shall maintain the minimum amount collected from the customer as per ‘Top’ or the amount due to the merchant.
• PAs shall be permitted to pre-fund the escrow account with their own or merchant’s funds. However, in the latter scenario, the merchant’s beneficial interest shall be created on the pre-funded portion.
• The escrow account shall not be operated for ‘Cash-on-Delivery’ transactions.

e. Permitted Debits or credit to or from the escrow account

• Where more than one escrow account is maintained, credit and debit from one escrow account to the other shall be permitted. However, inter-escrow transfers should be avoided as far as possible and if resorted to, the auditor’s certification shall mention such transactions.
• Permissible Credits:
  • Payment from various customers towards the purchase of goods or services.
  • Pre-funding by merchants or PAs.
  • Transfer representing refunds for failed/disputed/returned/canceled transactions.
  • Payment received for onward transfer to merchants under promotional activities, incentives, cash-backs, etc.

• 允许的借记项：
  • 向各类商户付款。
  • 根据商户的具体指示向任何其他账户付款。
  • 针对失败或有争议的交易进行退款转账。
  • 向中介机构支付佣金。此金额应按预先确定的费率/频率支付。
  • 支付通过促销活动、激励措施、现金返还等方式收到的款项。

F. 遵守印度储备银行（RBI）准则：

• 为维持储备金要求，托管账户中的余额应被视为“净需求与定期负债”（NDTL）的一部分。应考虑报告日托管账户中银行的余额。
• 实体和托管账户银行应负责遵守印度储备银行不时发布的指示。
• 获授权实体应向印度储备银行支付与结算系统部（DPSS）各自的区域办事处提交由审计师签署的证书，证明该实体一直按照这些指示维持托管账户中的余额。若维持多个托管账户，则应考虑所有托管账户中的余额。
• 支付聚合商（PA）应向其维持托管账户的银行提交其所获取的商户名单，并应不时更新该名单。
• 银行应确保仅向符合条件的商户付款。

G. 将“核心部分”转入独立账户

• 银行不对托管账户中维持的余额支付利息。但是，根据与支付聚合商（PA）签订的协议，银行可以将金额的“核心部分”转入一个可计息的独立账户。
• 如果托管账户出现缺口，则可动用计息账户中持有的金额。
• 此项便利适用于已开展业务满 26 个双周且其账目已针对完整会计年度进行正式审计的实体。为此，26 个双周的期限应从账户实际开展业务之日起计算。
• 此类存款不得用于贷款。银行不得签发任何存款收据，也不得对此类存款形式持有的金额设置任何留置权。

3. 客户申诉处理与争议管理框架

• 支付聚合商（PA）应实施客户申诉处理与争议管理框架，并指定一名节点官员负责处理客户投诉和升级流程。
• 如果网站/移动端提供投诉功能，则应确保其清晰且易于访问。
• 支付聚合商（PA）应建立对所有参与方具有约束力的争议解决机制，其中应包含交易生命周期、争议类型的详细说明、处理流程、合规性、各方责任、文档记录、原因代码、申诉处理程序、各阶段周转时间等。

4. 安全、防欺诈与风险管理框架

• 支付聚合商（PA）应建立充足的信息和数据安全基础设施及系统，用于预防和检测欺诈。
• 支付聚合商（PA）应建立经董事会批准的信息安全政策，以保障其运营的支付系统的安全，并根据该政策实施安全措施以降低已识别的风险。支付聚合商（PA）可采用的技术基准建议见附件 2。
• 支付聚合商（PA）应建立网络安全事件和违规行为的监控、处理及后续跟进机制。相关情况应立即报告至印度储备银行（RBI）孟买中央办公室支付与结算系统部（DPSS）以及印度计算机应急响应小组（CERT-In）。
• 支付聚合商（PA）不得在其数据库或商户访问的服务器中存储客户卡凭证。
• 支付聚合商（PA）应在财政年度结束后的两个月内，向印度储备银行（RBI）支付与结算系统部（DPSS）各自的区域办事处提交系统审计报告，包括由印度计算机应急响应小组（CERT-In）入围审计师进行网络安全审计的报告。

5. 一般性指示

• 支付聚合商（PA）应确保遵守有关商户折扣率（MDR）的现行指示。若收取便利费、手续费等其他费用，支付聚合商（PA）也应提前公示。
• 支付聚合商（PA）不得对特定支付方式的交易金额设置限制。此项工作可由发卡银行/实体完成，例如，发卡银行应负责根据客户的信用度、消费性质、个人资料等，对其发行的银行卡设置金额限制。
• 支付聚合商（PA）不得提供 ATM 密码作为非持卡交易的身份验证因素。
• 除非客户明确同意存入其他方式，否则所有退款均应退回至原始支付方式。

结论

为确保客户和商户的资金安全，印度储备银行（RBI）发布了关于支付聚合商（PA）资金处理、必须实施的安全措施以及客户申诉处理框架的详细准则。支付聚合商（PA）必须遵守印度储备银行（RBI）发布的每一项准则，以维持其授权资格。