AEPS (Aadhaar Enabled Payment System, written "AePS" by RBI and NPCI) lets a customer withdraw cash or check their balance at your shop using their Aadhaar number and fingerprint. The AEPS operator KYC rules for 2026 come from one RBI document: Aadhaar Enabled Payment System – Due Diligence of AePS Touchpoint Operators, reference RBI/2025-26/63, dated 27 June 2025. It has applied since 1 January 2026.
In short, the bank that onboards you must do full KYC on you, repeat it if you stop transacting for three months, keep its AEPS systems locked to AEPS use, and watch every operator's activity by risk. This guide explains each rule in plain words and ends with a checklist.
RBI's PDF sometimes opens behind a CAPTCHA. The definitions and duties described here match the published summaries of the directions by Khaitan & Co and Mondaq. Read the RBI text itself before you rely on exact wording.
What RBI changed, and why
RBI first said it would streamline how AePS touchpoint operators are onboarded in its Statement on Developmental and Regulatory Policies of 8 February 2024. It published draft directions on 31 July 2024 and took comments until 31 August 2024. The RBI press release on the draft gave the reason: frauds involving "identity theft or compromise of customer credentials".
The final directions followed on 27 June 2025. Banks then had six months, until 1 January 2026, to bring their onboarding and monitoring in line.
Who the rules are written for
The directions are addressed to banks, and two terms matter:
- Acquiring bank: the bank that onboards AePS touchpoint operators and acquires the transactions they make.
- AePS touchpoint operator: the individual that bank has onboarded to run an AEPS touchpoint, at a fixed shop or on the move.
If you serve AEPS customers at your counter, you are the operator. You may deal with a platform such as Payonclick rather than with a bank directly. The bank still carries the duty to check you, and the platform's onboarding has to support that check.
What acquiring banks must do under RBI's new AEPS rules
1. KYC on every operator before onboarding
Banks must carry out due diligence on every operator before onboarding them, to the customer due diligence standard for individuals in RBI's Master Direction on KYC, 2016. This covers sub-agents too, not only operators the bank signs directly. If the bank already did this due diligence when it appointed you as a Business Correspondent or sub-agent, it may reuse that check.
2. Fresh KYC after three months of inactivity
If an operator has not transacted for three consecutive months, the bank must carry out KYC again before the operator can transact. A dormant ID is easier for someone else to misuse, so it has to be checked again before it works.
3. AEPS systems used only for AEPS
Banks must put system-level controls in place so that technology links such as APIs are used only for AEPS transactions. An AEPS connection cannot be repurposed for a different product.
4. Ongoing, risk-based monitoring
Banks must monitor operators through their transaction monitoring systems and set operational parameters based on each operator's risk profile. The factors include the operator's location, and the volume and velocity of their transactions. Banks must also review these parameters as fraud patterns change. The directions do not publish thresholds; each bank sets its own.
What the rules mean for you as a retailer
Your KYC has to be complete and genuine
Expect a full identity check before your AEPS service goes live. In the Payonclick app, AEPS merchant onboarding asks for:
- your name, mobile number and a 4 to 6 digit merchant PIN
- PAN and Aadhaar
- shop name and shop address
- bank account number, IFSC and account holder name (GSTIN is optional)
You then complete Aadhaar eKYC (OTP plus biometric) and bank eKYC. The Payonclick app enforces bank eKYC for every new merchant because of these RBI rules. The same onboarding also unlocks Micro ATM and UPI cash withdrawal in the app.
A three-month break means KYC again
If your AEPS ID has no transactions for three consecutive months, the bank must redo your KYC before you can transact again. Seasonal shops, and retailers who pause the service, should plan for this. Keep your documents, registered mobile number and bank details ready so you can complete the check without delay.
Unusual activity may be flagged
Banks now watch location, volume and velocity, so patterns that don't fit your normal business may be flagged. Examples include transactions far from your registered shop, a sudden jump in daily withdrawals, or repeated attempts on the same Aadhaar number within minutes. Serve customers from your registered address, and tell our team before you move shop.
The Payonclick app adds its own check. Once a day, before AEPS transactions, you authenticate your own Aadhaar biometrically (fingerprint, iris or face), and the app needs location (GPS) permission.
Your ID is for AEPS, and it is yours
The rules treat the operator as the individual the bank onboarded. Don't let a helper, relative or another shop use your login, your device or your daily authentication. Use your AEPS access only for AEPS services. If someone else at your shop needs to serve customers, speak to our team about onboarding them properly.
A practical checklist for AEPS retailers
- Finish every onboarding step. PAN, Aadhaar, shop details, bank details, Aadhaar eKYC and bank eKYC. Bank eKYC is required for new merchants in the Payonclick app.
- Keep your details current. If your mobile number, bank account or shop address changes, tell our team before you transact on the new details.
- Plan for breaks. Three months in a row without a transaction means KYC again before your next one.
- Work from your shop. Keep location permission switched on and serve customers at your registered address.
- Do the daily authentication yourself. Nobody else should give their fingerprint, iris or face for your daily check.
- Use a certified RD device. The app supports L1 fingerprint devices such as Mantra MFS110, Morpho/IDEMIA MSO 1300 series and Startek FM220, and the Mantra MIS100 iris scanner.
- Let the customer authenticate. The customer places their own finger on the device. For cash withdrawals above ₹5,000, the app also sends an OTP to the customer's Aadhaar-linked mobile number.
- Hand over cash only after success. Wait until the app shows the withdrawal as successful.
- Protect your credentials. Payonclick staff never ask for your OTP, TPIN, password or a remote fingerprint scan. Anyone who does is not from Payonclick.
Other AEPS rules that sit alongside KYC
KYC is one layer. Three other rules affect what happens at your counter:
- Monthly cap. NPCI circular NPCI/2023-24/AePS/087 recommends that banks cap AePS cash withdrawals, together with BHIM Aadhaar Pay, at ₹50,000 per customer over a rolling 30 days. A withdrawal over the cap is declined with response code 61.
- App limits. In the Payonclick app, one AEPS cash withdrawal can be ₹100 to ₹10,000, in multiples of ₹50. The customer's bank can apply its own limits.
- Failed withdrawals. Under RBI's turnaround time circular of 20 September 2019, if a customer's account is debited but the AEPS transaction is not confirmed, the acquiring bank must start a credit adjustment within five days of the transaction date (T+5). After that, the customer is owed ₹100 for each day of delay, credited without having to claim it.
Every limit, with its source, is listed on our rules and limits page.
Where Payonclick fits
Payonclick India is a technology and service provider, not a bank. AEPS transactions run on regulated banks and NPCI's network, and under these directions the acquiring bank remains responsible for operator due diligence. Our part is to collect your onboarding details, run the Aadhaar eKYC and bank eKYC steps in the app, and help you when a check needs more information.
Joining takes four steps before AEPS onboarding: register on payonclick.in or in the Payonclick Android app, complete KYC by DigiLocker or the KYC form, sign the retailer agreement by eSign, and activate the services you want. Service activation charges are shared by our team on request.
If you are new to AEPS, read our Hindi guide on how to get an AEPS ID. To see everything included, from cash withdrawal to balance enquiry and mini statement, visit our page on getting an AEPS retailer ID for your shop.