RBI Payment Aggregator and Payment Gateway (PA-PG) Audit
Annual system audit including cybersecurity audit by CERT-In empanelled auditors, mandated under the RBI 2025 PA Master Direction. Security Brigade delivers regulator-ready PA-PG compliance with technical depth that goes beyond checkbox audits.
Trusted by India's leading enterprises
Assess
We map your payment aggregator or gateway operations against every RBI PA Master Direction requirement. This includes merchant onboarding controls, escrow and settlement flows, payment data handling, technology baseline, and cybersecurity posture. You receive a detailed gap assessment with risk ratings.
Remediate
Our team provides practical, implementation-ready remediation guidance for every identified gap. We work directly with your CTO, DevOps, compliance, and product teams to close findings. Lemon tracks every remediation item with owners, deadlines, evidence requirements, and closure status.
Certify
Once all gaps are closed and validated, we deliver the final PA-PG System Audit Report in the format required by RBI. This includes the cybersecurity audit report, control matrix, data-flow annexures, and board-ready summary. The report is ready for regulatory submission.
What Is the RBI PA-PG Audit?
The RBI PA-PG audit is an annual system audit mandated under the RBI 2025 PA Master Direction for all authorized Payment Aggregators in India. It must be conducted by a CERT-In empanelled auditor and covers merchant onboarding, escrow controls, payment data handling, cybersecurity posture, and technology baseline controls.
Who Needs an RBI PA-PG Audit?
Applicability, key requirements, and control areas covered under the PA Master Direction
Authorized Payment Aggregators
Entities holding RBI authorization to facilitate payment transactions between merchants and customers through pooling and settlement.
PA Applicants Seeking RBI Authorization
Organizations applying for PA license who must demonstrate compliance readiness as part of the authorization process.
Payment Gateway Providers
Technology infrastructure providers supporting payment aggregation flows, including merchant integration, transaction routing, and settlement systems.
Merchant Onboarding and KYC Controls
Review of merchant due diligence, KYC verification, risk categorization, ongoing monitoring, and de-boarding processes.
Escrow and Settlement Flow Controls
Validation of escrow account management, settlement timelines, fund segregation, reconciliation, and compliance with RBI settlement directions.
Payment Data Handling and Localization
Verification that all payment data including customer data, payment credentials, and transaction data is stored exclusively in India per RBI requirements.
Cybersecurity Audit Requirements
Dedicated cybersecurity audit covering vulnerability assessment, penetration testing, security configuration, incident response, and alignment with RBI cyber framework.
Baseline Technology Controls
Access control, encryption, key management, logging, monitoring, change management, backup, disaster recovery, and vendor management controls.
Governance and Board Reporting
Board and IT committee oversight, security audit reporting cadence, incident escalation, and management accountability for compliance posture.
Methodology
6 steps. Zero guesswork.
Every engagement follows this process through Lemon, our proprietary audit management platform.
Scoping and Regulatory Mapping
We begin by mapping your PA or PG operations against every requirement in the RBI PA Master Direction. This includes identifying systems in scope such as applications, APIs, infrastructure, databases, cloud environments, third-party integrations, payment flows, and data stores. Scope is documented and agreed before fieldwork begins.
Architecture and Data-Flow Review
We document your complete payment data flow from merchant integration through transaction processing, escrow management, settlement, refund, and dispute handling. This includes data localization verification ensuring payment data resides exclusively in India across production, backups, DR, logs, analytics, and third-party processors.
Control Assessment and Evidence Review
We validate each control area against the PA Master Direction requirements: merchant onboarding KYC, escrow controls, settlement flows, card and payment data handling, PCI-DSS/PA-DSS relevance, baseline technology controls, access management, encryption, key management, change management, backup, DR, and vendor controls. Evidence is collected and mapped in Lemon.
Cybersecurity Audit and VAPT
The dedicated cybersecurity audit component covers vulnerability assessment, penetration testing of payment applications and APIs, security configuration review, network segmentation validation, incident response readiness, and alignment with the RBI cyber security framework. Testing is executed through our B-52 audit engine for consistent coverage.
Gap Assessment and Remediation Support
Every non-compliance and control gap is documented with risk rating, evidence expectation, and practical remediation guidance. We work with your CTO, engineering, security, and compliance teams to close gaps. Lemon tracks each item through to closure with validation evidence.
Report Delivery and Regulatory Submission
We deliver the final PA-PG System Audit Report including the cybersecurity audit report, control matrix, data-flow annexures, technical findings, and board-ready executive summary. The report is structured for RBI submission and includes the closure validation pack confirming all identified gaps have been addressed.
"Security Brigade's structured approach through Lemon gave us complete visibility into the testing process. The three-layer review caught issues that our previous vendor missed entirely. Their reports were the first our developers could actually act on without a follow-up call."
The Platform
Powered by Lemon
Most firms rely on individual tester skill. We built a platform that makes quality structural — informed by 6,700+ previous assessments.
Lemon: Audit Workflow and Evidence Management
Every PA-PG audit control, evidence artifact, remediation ticket, and closure validation is managed through Lemon. Your compliance and engineering teams get a single dashboard showing audit progress, open items, ownership, and deadlines. No spreadsheets, no email threads, no evidence gaps.
B-52: AI-Powered Cybersecurity Testing
The cybersecurity audit component runs through B-52, our AI-powered audit engine. B-52 tests payment applications, APIs, merchant portals, admin interfaces, and infrastructure with 90-95 percent vulnerability coverage. Every finding is verified as exploitable before reporting, eliminating false positives.
ShadowMap: Continuous Attack Surface Monitoring
Post-audit, ShadowMap provides continuous monitoring of your payment infrastructure, exposed services, domains, leaked credentials, dark web exposure, and third-party risks. The audit gives you a point-in-time snapshot. ShadowMap ensures you stay compliant between annual audits.
Compliance-Ready
Audit-ready reporting for every framework
As a CERT-In empanelled firm, our reports are accepted by all major Indian and global regulators.
Industries
700+ clients across verticals
Every type of application architecture and business logic pattern — tested.
Deliverables
What you get
Reports for two audiences — executives who need the risk picture, and developers who need to fix the issues. With code-level guidance, not vague advice.
Annual PA-PG System Audit Report
The primary regulator-submission document structured per RBI 2025 PA Master Direction format, covering scope, systems reviewed, audit period, methodology, observations, compliance status, and auditor conclusion.
Cybersecurity Audit Report
Dedicated cybersecurity audit report covering VAPT findings, security configuration review, incident response assessment, and alignment with RBI cybersecurity framework requirements.
Control Matrix with Evidence Mapping
Detailed control matrix mapping each RBI PA-PG requirement to evidence collected, compliance status, auditor observations, and management comments.
Data-Flow and Data-Localization Annexure
Complete documentation of payment data flows, storage locations, third-party processing, backup and DR data residency, and India-only storage verification evidence.
Gap Assessment with Risk-Ranked Remediation Tracker
Every identified non-compliance documented with risk rating, evidence expectation, remediation guidance, owner assignment, target closure date, and validation status tracked in Lemon.
VAPT and Application Security Testing Reports
Technical annexures covering vulnerability assessment, penetration testing, API security testing, and application security findings with proof-of-concept evidence and CVSS scores.
Closure Validation Report
Post-remediation validation report confirming all identified gaps have been closed with evidence. This is the clean compliance version ready for RBI submission with no open findings.
Board and IT Committee Summary Deck
Executive presentation summarizing audit findings, compliance posture, risk areas, remediation progress, and recommended governance actions for board and IT committee reporting.
Continuous Compliance with ShadowMap
The audit gives you a snapshot. ShadowMap gives you the always-on view.
An annual audit proves your posture at a single point in time. Between audits, attack surfaces drift, credentials leak, sub-domains get added, vendors get breached. ShadowMap watches the boundary continuously so the next audit isn't a surprise.
Attack Surface Area
Continuous discovery of internet-facing assets — sub-domains, APIs, cloud resources, open ports, SSL certificates, technology stack.
Audits are point-in-time. ShadowMap watches your boundary daily.
Explore on ShadowMapDark Web Intelligence
9.7B+ breach records indexed; monitors Telegram, paste sites, criminal forums, and ransomware leak sites for credentials, leaked data, and threat actor mentions.
Find leaked data before regulators do.
Explore on ShadowMapWhat is the RBI PA-PG audit and who needs it?
Is a CERT-In empanelled auditor mandatory for PA-PG audits?
How is the PA-PG audit different from the RBI cybersecurity framework audit?
How often must the PA-PG audit be conducted?
What happens if a Payment Aggregator fails the PA-PG audit?
Does the PA-PG audit cover data localization requirements?
How long does a PA-PG audit take from start to report delivery?
Is PCI-DSS compliance required as part of the PA-PG audit?
Can Security Brigade help with remediation or only the audit?
What if we are a Payment Gateway and not a Payment Aggregator?
Ready to Get PA-PG Compliant?
Talk to our compliance team about your annual PA-PG system audit requirements
Typically responds within 1 business day · No commitment required