Payment Service Providers must establish effective systems and controls to ensure that Relevant Persons meet fit and proper requirements. Assessments must be conducted in the prescribed format at appointment and at reasonably regular intervals. Fit and proper status requires fairness, integrity, financial integrity, good reputation, character and honesty, together with the absence of disqualifications such as specified convictions, pending recovery proceedings, insolvency, financial unsoundness, wilful-defaulter status, regulatory restraints and fugitive-economic-offender status.

Payment Services include account issuance, e-money issuance, escrow, cross-border money transfer, and merchant acquisition, subject to specified exclusions. Exclusions cover authorised-agent transactions, paper payment instruments, settlement-system transactions, securities asset servicing, own-account and intra-group transfers, currency transportation, technical services without possession of funds, and qualifying limited-use instruments. Significant Payment Service Provider designation conditions depend on transaction-value thresholds for non-e-money-account services and average daily e-money values for e-money account issuance or e-money issuance.

Payment Service Providers must preserve designated financial, compliance, client and capital-market records in a format suitable for electronic retrieval for a minimum ten-year period commencing from the date operations begin. Required records include periodic financial statements, auditors' reports, quarterly net-worth statements, anti-money-laundering and know-your-customer compliance material, client account-opening documents, powers of attorney, signature-authority forms, and any further records specified from time to time.

GST refund reapplication may be made where a registered person inadvertently filed a NIL claim in FORM GST RFD-01A/RFD-01 for a particular period and category despite having a genuine refund entitlement. Eligible persons must file the renewed claim under the "Any Other" category for the same period and provide required supporting documents. For specified unutilized input tax credit refund categories, no subsequent-period claim under the same category may have been filed. The proper officer must scrutinise eligibility, determine the admissible amount, and may require debit from the electronic credit ledger before issuing refund and payment orders.

Payment Service Providers must furnish audited financial statements, including the balance sheet, profit and loss statement, cash or fund flow statement, and auditor's report, within three months after finalisation. Auditor remarks or observations on business conduct or accounts must be accompanied by a suitable explanation. The filing period may be extended by up to one month on application.

Every Payment Service Provider must submit requisite documents and information in the format and manner specified by the Authority. This mandatory reporting obligation establishes an Authority-directed framework for collecting returns, documentation and other information from Payment Service Providers.

Payment Service Providers must maintain their place of business and registered office in an IFSC. Activities relating to payment services from a business location outside the IFSC require prior approval from the Authority. An IFSC-based business presence and registered office are mandatory, subject to approved externally located activities.

Regulation 30 establishes an enforcement mechanism for defaults by Payment Service Providers. Where a provider contravenes applicable regulatory provisions, or any direction or order issued under the payment services framework, the Authority may initiate appropriate enforcement action. The provision links non-compliance with regulatory requirements, directions, and orders to potential enforcement proceedings.

Payment Service Providers in IFSC must maintain adequate staff to address Payment Service User queries, complaints and grievances within thirty days of receipt. Users must have one or more accessible channels for raising queries and lodging complaints. Disputes unresolved through internal grievance redressal must be addressed through online conciliation and/or online arbitration as specified by the Authority. Providers must retain records of queries, complaints, grievances and their redressal.

Payment Service Providers must secure information technology systems and other infrastructure used for payment services against unauthorised access and manipulation. They must prepare and maintain written security policies and procedures. The Authority may issue directions on security procedures and may require certificates from independent professionals confirming compliance with system-security obligations, documentation requirements, and applicable directions.

Payment Service Providers must protect the interests of Payment Service Users by communicating relevant information clearly and fairly, so as to minimise the possibility of users being misled. They must also comply with the disclosure requirements prescribed in Schedule VII.

Payment Service Providers must deal openly and co-operatively with the Authority, report significant events, and communicate proposed major changes to payment-service features, processes, structure or operations with complete details. Prior approval is required for specified mergers, reorganisations, arrangements, compromises, amalgamations and reconstructions. Payment Service Providers and Third-Party Service Providers must assist the Authority with audits and inspections.

Payment Service Providers must comply with all applicable Indian laws and with applicable laws of every foreign jurisdiction in which they provide services or where Payment Service Users are based. The obligation attaches to both the location of service provision and the jurisdictional location of users in relation to cross-border operations.

Payment Service Providers must comply with the AML, CTF & KYC Guidelines, the Prevention of Money Laundering Act, 2002, and related Rules. Providers using agents must maintain updated agent lists, include agents in AML/CTF programmes, and monitor compliance. They remain responsible for authorised agents' transactions and actions, must retain transaction logs for at least ten years, and must make the data available for scrutiny as directed.

Payment Service Providers must safeguard Applicable Funds, including by complying with the directions in Schedule VI. They must keep Applicable Funds segregated at all times from every other type of fund they hold, ensuring their separate treatment and continuing protection throughout the period of holding.

Payment Service Providers must maintain complete and up-to-date records of every Third-Party Service Relationship identified under the risk-management identification requirement in sub-regulation (1) of regulation 18. Record maintenance is linked to relationships identified through the prescribed third-party service relationship risk-management framework.

Payment Service Providers must ensure that Third-party Service Providers maintain clearly defined incident-management processes covering identification, investigation, remediation and timely notification. Notification must be given to the Payment Service Provider when an incident affects the Third-party Service Provider's ability to deliver agreed-upon services. Responsibility rests with the Payment Service Provider to secure these operational and reporting arrangements within third-party service relationships.

Payment Service Providers must identify, document and, where practically feasible, test exit strategies for Third-party Service Relationships involving critical services. Exit planning must address planned service migration and adverse events, including legal or contractual breaches, deteriorating service quality, provider governance, financial, resilience or risk-management weaknesses affecting critical services, and extended disruptions that cannot be managed through other business-continuity measures.

Payment Service Providers must conduct proportionate planning and due diligence before engaging Third-party Service Providers for critical services. The assessment covers operational capability, financial soundness, risk controls, ICT and cyber-security risks, supply-chain dependencies, conflicts, regulatory-compliance capability and substitutability. Critical services require legally binding arrangements, including information-sharing obligations with the Authority, and ongoing monitoring of the provider's contractual performance.

Payment Service Providers must use a risk-based framework to identify critical services received or planned to be received from Third-party Service Providers. Assessment is required at the commencement of operations and at regular intervals. Criticality must consider the service's financial, operational and strategic importance, acceptable disruption tolerance for dependent critical operations, the nature of shared data or information, and the ease or lack of substitutability of the service.