Payment Gateway for Unregistered Business India: 2026 KYC Fix

Payment Gateway for Unregistered Business India: 2026 KYC Fix

If you have been collecting money online without a GST number, you have probably received an email in the last few weeks with a subject line like "Action required: complete your KYC before 15 September." Maybe your dashboard has already flashed a warning. Maybe someone in a WhatsApp group told you that settlements are about to stop and that you now need GST registration to keep your account.

Take a breath. We read the actual regulation, and most of what is circulating is wrong.

Getting a payment gateway for unregistered business india searches is not a loophole and never was. The Reserve Bank of India's Payment Aggregator Directions do not require a GSTIN anywhere in their merchant due-diligence clause. What changed in September 2025 is that RBI tightened how aggregators must verify merchants, and gave them a one-year window to clean up their existing merchant book. That window closes on 15 September 2026 — which is why your inbox suddenly looks like this.

This post explains exactly what the Direction says, who the deadline actually binds, what documents an unregistered proprietor or freelancer can submit today, and what to do this week if your settlements are already on hold.

Can I use a payment gateway without a GST number in India?

Yes. GST registration is not a regulatory condition for accepting online payments in India, and it never appears in RBI's merchant onboarding requirements for payment aggregators.

Here is the plain evidence. RBI's Master Direction on the Regulation of Payment Aggregators (RBI/DPSS/2025-26/141, dated 15 September 2025) sets out merchant due diligence in clause 13. Clause 13(b) reads, verbatim:

"If the merchant's annual turnover does not exceed ₹40 lakh, or its annual export turnover does not exceed ₹5 lakh, the following process could also be adopted as an alternative: 1. Obtain a copy of the PAN / Form 60 of the merchant and verify the PAN from issuing authority. 2. Conduct CPV of the merchant. 3. Obtain a certified copy of one officially valid document (OVD) of the proprietor or of the person holding power of attorney to operate the account, as applicable."

PAN. A contact point verification. One officially valid document of the proprietor. No GSTIN anywhere in it.

The confusion comes from the gateways' own onboarding forms, which historically asked for a GST certificate because it was the fastest business proof to auto-verify. That is a product decision, not a legal one. Razorpay's own published checklist for proprietorships asks for any two of Udyam/MSME certificate, GST certificate, Shop & Establishment licence, IEC, or a postpaid mobile bill — GST is one of five options, not a gate.

So the real question is not whether you are allowed to collect payments. It is whether the specific aggregator you signed up with will run you through the lighter route. If you are still deciding which payment gateway to pick for a small business, that willingness is now a bigger selection criterion than transaction fees.

Does the 15 September 2026 deadline apply to me or to my gateway?

This is the single most important distinction in this post, and almost every article circulating gets it backwards.

The deadline binds the payment aggregator. Not you.

Clause 13(j) of the Direction reads, verbatim:

"A PA, including an existing PA whose application is pending with Reserve Bank of India for authorisation, shall ensure that merchants onboarded till December 31, 2025, comply with the above due diligence requirements within one year from the date of this MD. From January 1, 2026, merchants should be onboarded in accordance with due diligence requirements prescribed in this MD."

Read the subject of that sentence: "A PA … shall ensure." The obligation sits on Razorpay, PayU, Cashfree, PhonePe and the other authorised aggregators. As a merchant, you have no statutory RBI deadline. What you have is a contractual deadline that your gateway has set for you, because it needs your documents in order to meet its own obligation.

Two practical consequences follow:

• You are not breaking any law on 16 September. You may, however, be in breach of your gateway's terms of service, and they can suspend settlements on that basis. The pressure is real; the legal framing is not what the emails imply.
• You can negotiate with your gateway, because it needs you to comply more than you might think. A support ticket that cites the clause number politely gets a very different response from one that says "my account stopped working."

Also note the second sentence of 13(j): the date is not printed in the Direction. "Within one year from the date of this MD" plus a Master Direction dated 15 September 2025 gives you 15 September 2026. Everyone quoting the date is doing that arithmetic, us included. Worth knowing if a support agent tells you a different date — ask them which clause they are computing it from.

The timeline everyone is getting wrong: 31 December 2025 was never your deadline

You will see it repeated across blogs and reseller sites that existing merchants had to complete KYC by 31 December 2025. That is a misreading of clause 13(j), and it has caused a lot of unnecessary panic. Here is the correct sequence:

Date	What it actually means
15 September 2025	Master Direction issued. The one-year clock for legacy merchants starts here.
31 December 2025	A cut-off, not a deadline. It defines which merchants get the transition window: anyone onboarded on or before this date.
1 January 2026	All new merchant onboardings must meet the new due-diligence standard from day one.
15 September 2026	The end of the one-year window. By this date the aggregator's existing merchant book must be compliant.

If you opened your gateway account in, say, March 2024, you are a legacy merchant and 15 September 2026 is your gateway's date for you. If you opened it in February 2026, you were already onboarded under the new standard and there is usually nothing to redo.

We are flagging this because correcting it changes what you do next. If you believed you missed a December 2025 deadline, you may think you are already in violation. You are not.

What is RBI's simplified due diligence for merchants under ₹40 lakh?

Clause 13 gives aggregators two routes.

The default route — clause 13(a): "While onboarding, the PA shall, with the merchant's consent, retrieve the merchant's KYC record from CKYCR." This one uses "shall". Every merchant goes through the Central KYC Registry first. If you have ever completed full KYC with a bank, a mutual fund or an insurer, there is a good chance your record is already sitting in CKYCR and your gateway can pull it with your consent. Many merchants who dread this process are done in ten minutes because of this clause.

The fallback route — clause 13(b): the small-merchant simplified due diligence quoted above, for merchants under ₹40 lakh annual turnover (or ₹5 lakh annual export turnover). PAN, CPV, and one OVD.

Now the part nobody else will tell you: 13(b) says "could", not "shall". It is an option available to the aggregator, not a right you can demand. Your gateway is entitled to run full due diligence on every merchant if its internal risk policy says so, and some do — especially in higher-risk categories like travel, gaming, education abroad, crypto-adjacent services or anything with heavy chargebacks.

So the correct move is to ask for it by clause number, not to insist on it:

"My annual turnover is below ₹40 lakh. Can my account be processed under the alternative process in clause 13(b) of the Payment Aggregator Directions 2025 — PAN, CPV, and one OVD of the proprietor? I can provide all three today."

That sentence does three things: it shows you know the framework, it tells the risk team you are a small merchant, and it gives them a documented basis for the lighter route. In our experience helping MSME clients through this, it is the difference between a two-week ticket loop and a same-week resolution.

One more thing, because the coincidence trips people up constantly: RBI's ₹40 lakh has nothing to do with the ₹40 lakh GST registration threshold. The two numbers are unrelated, and RBI draws no link between them. Crossing ₹40 lakh in turnover does not automatically drag you into GST via your payment gateway, and being GST-registered does not disqualify you from anything here. (RBI reuses the same ₹40 lakh / ₹5 lakh pair elsewhere in the Direction — in Table 1, on permitted third-party debits from the escrow account. It is an internal convention, not a tax cross-reference.)

What documents does an unregistered proprietor actually need?

Here is the checklist you can act on today. Keep everything as clear PDFs or high-resolution scans, named sensibly, in one folder.

1. Identity and PAN
- PAN card of the proprietor (or Form 60 if you have no PAN — the Direction explicitly allows this).
- One Officially Valid Document (OVD): Aadhaar, passport, voter ID, driving licence, or NREGA job card. Aadhaar via DigiLocker is usually the fastest path.

2. Business proof — this is where the GST myth lives

RBI's KYC Master Direction (updated 14 August 2025) governs what counts as business proof for a proprietary firm. Para 28 requires "any two of the following documents or the equivalent e-documents thereof as a proof of business/activity in the name of the proprietary firm" — and the first item listed is "Registration certificate including Udyam Registration Certificate (URC) issued by the Government." The GST certificate is one of eight options, sitting in the same list as everything else.

Acceptable business proofs typically include:

Document	Cost	How fast
Udyam Registration Certificate	Free	Same day, online
Shop & Establishment licence	State fee	Days to weeks
Professional tax registration	State fee	Varies
Utility bill in the firm's name	—	Immediate if you have it
Latest ITR acknowledgement	—	Immediate if filed
Bank account statement of the firm	—	Immediate
Importer-Exporter Code (IEC)	₹500	1–2 days
GST certificate	Free	If you need it anyway

And para 29 matters just as much: where two documents cannot be furnished, regulated entities "may, at their discretion, accept only one", provided they conduct contact point verification. Single-document onboarding is explicitly contemplated by the regulator.

3. Bank account

The settlement account must be in your name — clause 13(g) requires that "necessary validation mechanisms shall be put in place by a PA to ensure that funds due to a merchant are credited in the merchant's bank account only." The Direction says nothing about current versus savings accounts; that rule, where it exists, comes from your gateway and your bank, not RBI. Ask them directly rather than assuming.

4. Website or app details

Most aggregators will check that your site has visible contact details, a pricing page, and refund/shipping/privacy policies. This is a common silent rejection reason for freelancers and D2C sellers using a single-page site or a link-in-bio page. If your online presence is thin, fixing that is usually a one-day job and it improves conversion anyway.

Is the Udyam certificate accepted, and how do I get it safely?

Yes — and for an unregistered business it is the single highest-leverage document on this list, because it is free, instant, and named first in RBI's own list of business proofs.

Udyam registration is available only at https://udyamregistration.gov.in/. It costs nothing. You need your Aadhaar and PAN, and the certificate is generated online.

A warning we make a point of repeating: search results for "Udyam registration" are dominated by paid lookalike sites that charge around ₹999 for a free government service, often with near-identical branding. Type the URL yourself. Do not click an ad.

There is a second benefit worth knowing. That same Udyam certificate, plus a bank account that actually shows your revenue, is the foundation of the paperwork trail lenders look for — the same trail that helps you make your MSME loan-ready with a digital footprint when you eventually want working capital. Registration density is no longer niche: 7.83 crore Udyam and Udyam Assist registrations existed as on 28 February 2026, supporting 34.50 crore in reported employment, per a Lok Sabha reply published by PIB in March 2026. For comparison, there were roughly 1.68 crore GST-registered taxpayers as on 31 July 2026. Far more Indian businesses are Udyam-registered than GST-registered — which is exactly why a GST-only onboarding form was always the wrong design.

How do I prove turnover is under ₹40 lakh with no GSTIN?

Here is a genuine finding that we have not seen stated anywhere else: the Direction is silent on how sub-₹40-lakh turnover should be evidenced. Clause 13(b) sets the threshold and then simply lists PAN, CPV and one OVD. It prescribes no turnover proof at all.

That silence means each aggregator decides for itself. In practice, you should be ready to offer one of the following. Treat this as our practical suggestion, not a regulatory requirement:

• A written self-declaration on your letterhead stating annual turnover is below ₹40 lakh, signed and dated. Cheapest and most commonly accepted.
• Latest ITR acknowledgement, which carries gross receipts and is independently verifiable.
• Six to twelve months of bank statements for the account where your business income lands.
• Your own invoice records — a clean, sequential set of invoices with totals. If your billing lives in a WhatsApp thread and a notebook, this is the moment to move to proper billing software for a small business, because the export takes thirty seconds and it answers the question permanently.
• Platform settlement reports from the gateway itself, if you have been transacting on it for a year.

Lead with the declaration. Offer the ITR or bank statement if asked. Do not send twelve months of bank statements unprompted into a support ticket — it slows the review down and spreads your financial data further than it needs to go.

Does a plain UPI QR shopkeeper need payment aggregator KYC? P2PM vs P2M

Not necessarily — and this is where the audience genuinely splits.

As reported in February 2026 (Business Standard, 26 February 2026), RBI clarified that small-merchant UPI transactions in the P2PM category fall outside the scope of the Payment Aggregator Directions, with due diligence sitting with the acquiring bank or payee PSP rather than requiring a PA partner. We could not locate an RBI notification number for this clarification, so we are reporting it as reported — confirm your own position with your acquiring bank before relying on it.

The mechanics behind P2PM come from NPCI (circular NPCI/UPI/OC-192/2023-24 dated 28 March 2024, compliance by 30 April 2024). P2PM is the small-merchant category with inward caps of:

• ₹10,000 per transaction
• ₹25,000 per 24 hours
• ₹1,00,000 per 30 days

A merchant consistently receiving above ₹1,00,000 per month for three consecutive months must be acquired under P2M with a merchant category code — which is the full merchant rail, with the due diligence that comes with it.

So, roughly:

• A kirana in Kanpur with a plain UPI QR sticker, taking a few thousand rupees a day is probably in P2PM and probably outside the PA Directions entirely. The re-KYC emails likely are not aimed at you.
• Anyone collecting through payment links, cards, net banking, a checkout page, subscriptions or a marketplace is squarely in scope. If money reaches you via an aggregator's settlement cycle rather than straight into your account from the payer, you are a PA merchant.

Also ignore the widely-shared claim that there is a "₹50,000 per month regulatory limit" for unregistered merchants. There is no such rule. The NPCI caps above are the real numbers.

What happens if I miss re-KYC — will settlements stop?

Yes, they can — but the mechanism is contractual and gateway-specific, not an RBI switch being flipped.

Razorpay's published re-KYC policy is the clearest example, and worth understanding because others follow similar patterns. Per Razorpay's own documentation: settlements go on hold 30 days before the deadline, and the account moves to "Live Disabled" at 30 and 60 days after. Note what that means in practice — the money does not vanish. It sits held until you complete KYC, and settlements resume once you do.

Industry expectations for how many businesses will be caught out are significant. Payment industry executives quoted by the Free Press Journal on 1 September 2026 estimated that 30–35% of small offline QR merchants and around 1 million small online businesses may miss the deadline. That is an industry estimate reported by a newspaper, not an RBI or government figure — but it tells you support queues will be long in the second week of September. Do not be the person filing a ticket on the 14th.

The exposure is real because digital is now the default rail. PayNearby's MSME Digital Index 2026, a survey of 10,000 retailers, found 80% of MSMEs reporting increased digital payment usage, with UPI the top mode at 48% and UPI plus AePS together accounting for 61% of transactions at semi-urban and rural MSME stores. When collections stop, everything stops — and unlike a customer who is slow to pay, you cannot even send a reminder. If cash flow is already tight, the same discipline that helps you recover delayed payments from customers applies here: get ahead of the problem while you still have options, rather than after the account locks.

Are "no-KYC" payment gateways legal in India?

Be very careful here. The pages ranking for "payment gateway without KYC" are mostly affiliate sites earning a commission on your sign-up, and several of them are promoting exactly what this Direction was written to tighten.

The facts:

• Only 69 authorised online payment aggregators (PA-O) existed as on 31 August 2026, per RBI's Certificates of Authorisation list. That list includes Razorpay, PayU, Cashfree, PhonePe and Google India Digital Services. If the service you are being pitched is not on RBI's list, it is either operating under someone else's licence as a reseller, or it should not be handling your money.
• Clause 6 sets the entry bar: minimum net worth of ₹15 crore at application and ₹25 crore by the end of the third financial year after authorisation. This is not a business a WhatsApp reseller can be in.
• Any legitimate aggregator must do merchant due diligence. "No KYC" therefore means one of two things: your KYC is being done by an entity you have no contract with, or it is not being done — which is precisely the risk RBI is closing.

The practical danger is not a fine. It is that your funds sit with an unregulated intermediary with no escrow protection and no regulatory recourse when settlements stop. We have seen small sellers lose weeks of collections this way. A free Udyam certificate and a PAN is a much better trade than that.

What to do this week — a 12-day plan

The deadline is 15 September 2026. Here is the sequence we would follow.

Today (30 minutes)
1. Log in to your gateway dashboard and find the KYC/account status page. Note the exact status and any deadline shown.
2. Check whether you were onboarded before or after 1 January 2026. That determines which rule applies.
3. Create a folder with: PAN, Aadhaar (or another OVD), a cancelled cheque or bank statement, and any business proof you already hold.

Tomorrow (1 hour)
4. If you do not have a Udyam certificate, register free at https://udyamregistration.gov.in/. Same day, no charge.
5. Draft a one-paragraph turnover declaration on your letterhead if you are under ₹40 lakh.

Day 3–4
6. Submit through the dashboard, not email, so the case is tracked.
7. If the form demands a GSTIN with no alternative, raise a ticket asking whether your account can be processed under the alternative process in clause 13(b), and list the three documents you can provide.

Day 5 onward
8. Make yourself available for CPV — keep your registered phone reachable and your address details accurate.
9. Follow up every 48 hours in the same ticket thread. Do not open new tickets; it resets the queue position.
10. If your gateway refuses the simplified route outright, that is its right — start a parallel application with another authorised PA-O rather than waiting.

One structural note: if a single gateway is the only rail you collect on, that is a concentration risk regardless of this deadline. Many MSMEs we work with keep a second authorised gateway account dormant but verified, and route recurring payment collections through a separate mandate setup, so one compliance hold never freezes the whole business.

FAQs

Can my gateway refuse the simplified route?

Yes. Clause 13(b) uses the word "could", which makes the alternative process an option available to the payment aggregator, not a right you can demand. Aggregators set their own risk policies, and merchants in higher-risk categories are routinely put through full due diligence regardless of turnover. Ask for the simplified route by clause number and make it easy to say yes — but if the answer is no, apply to another authorised aggregator rather than escalating.

What is CPV and what if I work from home?

CPV is contact point verification: the aggregator or its agent confirms you exist at the contact details you gave, usually by phone call, a verification link, a video check, or occasionally a physical visit. Working from home is completely normal for freelancers and small online sellers and is not a disqualification. Give the address you actually operate from, keep the registered mobile number reachable, and answer the call. Most rejections at this stage are because nobody picked up, not because of the address.

Can settlements go into a savings account?

The Direction requires only that funds due to a merchant are credited to the merchant's own bank account — clause 13(g) — and says nothing about the account type. Whether a savings account is accepted is decided by your payment aggregator and your bank, and policies differ between them. Ask your gateway's support team directly for their rule rather than assuming either way, and keep the account name matched exactly to the name on your PAN.

Do I need to do anything if I only use a plain UPI QR code?

Possibly not. As reported in February 2026, small-merchant P2PM UPI transactions fall outside the Payment Aggregator Directions, with due diligence handled by the acquiring bank or payee PSP. The NPCI caps for P2PM are ₹10,000 per transaction, ₹25,000 per 24 hours and ₹1,00,000 per 30 days, and a merchant consistently exceeding ₹1,00,000 a month for three consecutive months must move to P2M. Confirm your own classification with your acquiring bank.

Do I need GST registration to accept online payments in India?

No. RBI's merchant due-diligence requirements for payment aggregators do not mention GSTIN at all, and the KYC Master Direction lists the GST certificate as one of eight acceptable business proofs, with the Udyam Registration Certificate named first. GST registration is a tax question governed by your turnover and the nature of your supplies — decide it with your accountant, not because a payment gateway's onboarding form asked for it.

Need a hand getting this sorted?

Cybiqon AI Solutions is a small Indian team that builds websites, apps and AI automations for MSMEs — shopkeepers, manufacturers, service providers, D2C brands and small exporters. We are not a compliance consultancy and we will not charge you for a Udyam certificate that the government gives away free.

What we do help with is the part that usually blocks these applications: a website that actually passes an aggregator's review — visible contact details, working pricing, refund, shipping and privacy pages — a clean checkout that plugs into an authorised gateway, and automations that keep your invoices and settlement records in one place instead of across five WhatsApp threads.

If you are stuck on onboarding or you want your payment stack set up properly the first time, have a look at cybiqon.in, call us on +91 9250711473, or write to [email protected]. A short conversation is free, and we will tell you honestly if you do not need us.

Conclusion

Getting a payment gateway for unregistered business india is not the problem the internet is telling you it is. RBI's Payment Aggregator Directions never asked for a GSTIN; they asked aggregators to verify their merchants properly, and gave them until 15 September 2026 to finish the job on their legacy book. The deadline binds your gateway, not you. PAN, one officially valid document, a free Udyam certificate and a contact point verification will carry most small merchants through. Get your folder ready this week, ask for clause 13(b) by name, and keep collecting. If you want the website and payment setup done cleanly alongside it, Cybiqon is a call away.