Payment Service Providers must maintain systems and controls to ensure that Relevant Persons meet fit and proper requirements and must assess them at appointment and at reasonable intervals thereafter. Eligibility depends on competence, integrity, honesty, reputation, and sound financial standing, without specified disqualifications such as relevant convictions, pending regulatory recovery proceedings, insolvency, wilful default, regulatory restraint orders, or fugitive economic-offender status. The prescribed evaluation requires disclosures concerning regulatory history, defaults, investigations, associated entities, and other financial or legal matters.

Payment services include account issuance, e-money issuance, escrow, cross-border money transfer and merchant acquisition, subject to specified exclusions. Significant Payment Service Provider designation applies where a Regular Payment Service Provider exceeds annualised transaction-value thresholds for non-e-money-account services, or prescribed average daily e-money thresholds for e-money account issuance or e-money issuance.

Payment Service Providers must preserve designated financial, compliance, client and capital-market records in a format suitable for electronic retrieval for a minimum ten-year period commencing from the date operations begin. Required records include periodic financial statements, auditors' reports, quarterly net-worth statements, anti-money-laundering and know-your-customer compliance material, client account-opening documents, powers of attorney, signature-authority forms, and any further records specified from time to time.

GST refund reapplication may be made where a registered person inadvertently filed a NIL claim in FORM GST RFD-01A/RFD-01 for a particular period and category despite having a genuine refund entitlement. Eligible persons must file the renewed claim under the "Any Other" category for the same period and provide required supporting documents. For specified unutilized input tax credit refund categories, no subsequent-period claim under the same category may have been filed. The proper officer must scrutinise eligibility, determine the admissible amount, and may require debit from the electronic credit ledger before issuing refund and payment orders.

Payment Service Providers must furnish audited financial statements, including the balance sheet, profit and loss statement, cash or fund flow statement, and auditor's report, within three months after finalisation. Auditor remarks or observations on business conduct or accounts must be accompanied by a suitable explanation. The filing period may be extended by up to one month on application.

Every Payment Service Provider must submit requisite documents and information in the format and manner specified by the Authority. This mandatory reporting obligation establishes an Authority-directed framework for collecting returns, documentation and other information from Payment Service Providers.

Payment Service Providers must maintain their place of business and registered office in an IFSC. Activities relating to payment services from a business location outside the IFSC require prior approval from the Authority. An IFSC-based business presence and registered office are mandatory, subject to approved externally located activities.

Regulation 30 establishes an enforcement mechanism for defaults by Payment Service Providers. Where a provider contravenes applicable regulatory provisions, or any direction or order issued under the payment services framework, the Authority may initiate appropriate enforcement action. The provision links non-compliance with regulatory requirements, directions, and orders to potential enforcement proceedings.

Payment Service Providers in IFSC must maintain adequate staff to address Payment Service User queries, complaints and grievances within thirty days of receipt. Users must have one or more accessible channels for raising queries and lodging complaints. Disputes unresolved through internal grievance redressal must be addressed through online conciliation and/or online arbitration as specified by the Authority. Providers must retain records of queries, complaints, grievances and their redressal.

Payment Service Providers must secure information technology systems and other infrastructure used for payment services against unauthorised access and manipulation. They must prepare and maintain written security policies and procedures. The Authority may issue directions on security procedures and may require certificates from independent professionals confirming compliance with system-security obligations, documentation requirements, and applicable directions.

Payment Service Providers must protect Payment Service Users by communicating relevant information clearly and fairly so as to minimise the possibility of users being misled. They must also comply with the disclosure requirements prescribed in Schedule VII, alongside their obligation to safeguard user interests through clear, fair communication of relevant information.

Payment Service Providers must deal openly and co-operatively with the Authority, report significant events, and communicate proposed major changes to payment-service features, processes, structure or operations with complete details. Prior approval is required for specified mergers, reorganisations, arrangements, compromises, amalgamations and reconstructions. Payment Service Providers and Third-Party Service Providers must assist the Authority with audits and inspections.

Payment Service Providers must comply with all applicable Indian laws and with applicable laws of every foreign jurisdiction in which they provide services or where Payment Service Users are based. The obligation attaches to both the location of service provision and the jurisdictional location of users in relation to cross-border operations.

Payment Service Providers must comply with AML, CTF and KYC requirements and applicable anti-money laundering law. Providers using authorised agents must maintain updated agent lists, incorporate agents into AML/CTF programmes, and monitor compliance. Providers remain responsible and accountable for agents' transactions and actions. Transaction logs must be retained for at least ten years and made available for regulatory scrutiny when required.

Payment Service Providers must safeguard Applicable Funds, including through compliance with directions specified in Schedule VI. Applicable Funds must be kept segregated at all times from every other type of fund held by the provider. The duty requires continuous separation of Applicable Funds from all other funds throughout payment-service operations.

Payment Service Providers must maintain complete and up-to-date records of each Third-Party Service Relationship identified under the risk-management process in sub-regulation (1) of regulation 18. The record-keeping duty applies to all identified relationships on an ongoing basis, requiring relationship records to remain complete and current after identification. This obligation covers Third-Party Service Relationships identified through the prescribed risk-management process under regulation 18.

Payment Service Providers must ensure that Third-party Service Providers maintain clearly defined incident-management processes covering identification, investigation, remediation and timely notification. Notification must be given to the Payment Service Provider when an incident affects the Third-party Service Provider's ability to deliver agreed-upon services. Responsibility rests with the Payment Service Provider to secure these operational and reporting arrangements within third-party service relationships.

Payment Service Providers must identify, document and, where practically feasible, test exit strategies for Third-party Service Relationships involving critical services. Exit planning must address planned service migration and adverse events, including legal or contractual breaches, deteriorating service quality, provider governance, financial, resilience or risk-management weaknesses affecting critical services, and extended disruptions that cannot be managed through other business-continuity measures.

Payment Service Providers must conduct proportionate planning and due diligence before engaging Third-party Service Providers for critical services. The assessment covers operational capability, financial soundness, risk controls, ICT and cyber-security risks, supply-chain dependencies, conflicts, regulatory-compliance capability and substitutability. Critical services require legally binding arrangements, including information-sharing obligations with the Authority, and ongoing monitoring of the provider's contractual performance.

Payment Service Providers must use a risk-based framework to identify critical services received or planned to be received from Third-party Service Providers. Assessment is required at the commencement of operations and at regular intervals. Criticality must consider the service's financial, operational and strategic importance, acceptable disruption tolerance for dependent critical operations, the nature of shared data or information, and the ease or lack of substitutability of the service.