AI agents for compliance teams in payments in India

Indian payment firms' compliance teams can use AI agents to test that failed transactions are reversed and compensated within RBI turnaround times, review merchant due diligence for payment aggregators, check that payment data stays in India and draft fraud complaint files. RBI holds the firm accountable for each of these, so reversals, merchant terminations and regulatory reports stay with people.

What do payments compliance teams in India spend their time on?

India's digital payments run at enormous volume, through the national real-time retail payment system, cards, wallets and payment aggregators. RBI authorises and supervises payment system operators and participants, and its rules are detailed and frequently updated.

Failed transactions. RBI sets turnaround times for resolving failed transactions, such as a debit with no credit to the beneficiary, and requires compensation to the customer if the deadline is missed. At Indian volumes, even a small rate of failures means a large number of cases to track.

Merchant due diligence. Payment aggregators must carry out due diligence on the merchants they onboard and monitor them afterwards. Weak merchant checks are a route for fraud and money laundering.

Data location. RBI requires payment system data to be stored only in India, with limited exceptions for processing abroad. Every system, including an AI agent's processing, must respect this.

Unauthorised transactions. Customers' liability for unauthorised electronic transactions is limited if they report promptly. Firms must investigate claims and credit customers within set periods.

Personal data. The Digital Personal Data Protection Act 2023 governs digital personal data, which covers almost everything a payment firm holds.

Where can agents help?

Depth caps what each agent may do: 1 reads, 2 drafts for a person, 3 executes routine work within bounds.

1. Turnaround time testing (depth 1). The agent reads failed transaction records and checks each against the applicable turnaround time and compensation rule, listing cases that were late or where compensation was not paid. This is the most India-specific use, because of the volume and the precision of the rules.
2. Merchant due diligence review (depth 1). The agent checks onboarding files against the firm's merchant due diligence standard and flags missing documents, mismatched business details or activity inconsistent with the declared business.
3. Data location checks (depth 1). The agent reads the system and supplier inventory and flags any arrangement where payment data may be stored outside India.
4. Unauthorised transaction files (depth 2). For each customer claim, the agent assembles the transaction trail, device and authentication records and drafts a chronology for the investigator.
5. Monitoring plan tests (depth 2). The agent runs scheduled compliance tests and drafts results. For the concept, see what is compliance monitoring.

Firms that also offer credit through their payment apps face rules on collection conduct; whether an agent should take part in collections is covered in can an AI agent collect overdue loan payments.

What stays with people?

Reversals and compensation. The agent finds late cases. Crediting a customer or paying compensation moves money and stays with operations under a person's approval.

Merchant termination. Ending a merchant relationship cuts off its ability to take payments. It must rest on evidence a person has weighed.

Customer liability decisions. Whether a customer bears any loss on an unauthorised transaction depends on facts the investigator must establish.

Suspicious transaction reports to the national financial intelligence unit are decided by the principal officer.

Reporting to RBI. Breaches, incidents and regulatory returns are submitted by responsible officers.

Which rules apply in India?

India has no AI-specific law in force. Agents are governed by sector regulation and data protection law. The broader picture is in how AI agents are regulated in India.

RBI authorises and supervises payment system operators, payment aggregators and banks. Its directions cover turnaround times and compensation, customer liability, merchant due diligence, payment security, outsourcing and the storage of payment system data in India. An agent supporting any of these processes is part of the firm's responsibility, and its processing must meet the data location rule.

Digital Personal Data Protection Act 2023. Notice and consent or another permitted ground, purpose limitation, security safeguards, breach notification and individuals' rights. See DPDP Act and AI agents in India.

AML law, consistent with FATF standards, requires customer due diligence, record-keeping and reporting to the national financial intelligence unit.

SEBI and IRDAI regulate securities and insurance, and touch payment firms only where they distribute those products.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

How do you start in the first 90 days?

Month one. Confirm where the agent's processing takes place. If any part would touch payment system data outside India, redesign before going further. Then start with turnaround time testing.

Month two. Replay the agent against three months of failed transactions. Compare its list of late cases with your own reconciliation, and resolve every difference.

Month three. Run it daily, with operations correcting each late case and compliance reviewing the trend. Begin merchant due diligence review for new onboardings. Indian insurers work under IRDAI with different risks; see compliance agents in Indian insurance.

Where Pryme fits

In Pryme, the turnaround agent reads and reports at depth 1; crediting a customer is a depth 4 action outside its role scope, so it is refused and the verdict names the bound. Attest certifies each agent on your own transaction records before use. Every verdict is filed, so you can show RBI how each late case was found. The guide to AI compliance agents explains the model.