FFMC Licence & Fintech Regulatory Advisory

A Full Fledged Money Changer (FFMC) is a company authorised by the Reserve Bank of India under Section 10(1) of FEMA, 1999 to purchase and sell foreign currency notes, coins, and travellers' cheques from and to the public, and — where separately permitted — to issue and reload prepaid forex cards. You need this authorisation if your business model involves buying or selling physical foreign currency or travellers' cheques directly with retail customers, such as a forex bureau, a currency exchange counter at an airport or hotel, or a travel company offering forex services alongside its core business.

Category I (full-fledged) permits both purchase and sale of foreign exchange and is the only category that allows a standalone business built entirely around money changing. Category II, called a Restricted Money Changer (RMC), permits purchase of foreign currency only — no sale — and is typically granted to established travel agents and hotels as a facilitation measure alongside their core business. Category III is not a direct RBI authorisation at all; it is a franchisee arrangement in which an existing Category I FFMC or an Authorised Dealer bank appoints a franchisee to conduct restricted money-changing business under the principal's own registration and supervision.

RBI's Master Direction on Money Changing Activities prescribes a minimum Net Owned Fund (NOF) for Category I FFMC applicants, computed as paid-up capital plus free reserves, less accumulated losses and specified deductions such as intangible assets. The exact figure is set out in the current Master Direction and has been revised by RBI over time, so PNPC always confirms the applicable threshold at the time of your specific application rather than quoting a fixed number that may be outdated.

Only a company registered under the Companies Act 2013 is eligible to apply for FFMC authorisation. Partnership firms, proprietorships, LLPs, and trusts are not eligible applicants under RBI's Master Direction. The company's Memorandum of Association should reflect money-changing as an authorised object.

RBI reviews each promoter and director for a clean financial and legal track record — no default with any bank, financial institution, or NBFC; no conviction for an offence involving moral turpitude or an economic offence; no adverse regulatory action by RBI, SEBI, IRDAI, or any other financial regulator; and, generally, relevant business or financial-sector experience or a credible operational plan supported by qualified management.

There is no statutorily fixed timeline. RBI processing depends on the completeness of the application, the complexity of the promoter and business profile, and the workload of the relevant Regional Office. A realistic range for a well-prepared application from filing to Certificate of Authorisation is several months. Applications with incomplete documentation, weak business plans, or unresolved fit-and-proper questions can take considerably longer due to repeated query cycles.

Yes, subject to FDI policy for the relevant sector and RBI's fit-and-proper review of the foreign promoter. Any equity investment from a non-resident constitutes FDI under FEMA and must be reported via Form FC-GPR on the RBI FIRMS portal within the prescribed timeline, in addition to the FFMC authorisation process itself. UAE-based exchange houses and forex businesses evaluating an India entry commonly go through this dual-track process — FDI structuring and FFMC licensing in parallel.

FFMCs must maintain a Board-approved KYC/AML policy compliant with RBI's Master Direction on KYC and the Prevention of Money Laundering Act, 2002. This includes tiered customer due diligence based on transaction value, mandatory identity verification for currency exchange above prescribed thresholds, Suspicious Transaction Report (STR) and Cash Transaction Report (CTR) filings with the Financial Intelligence Unit-India (FIU-IND), a designated Principal Officer registered with FIU-IND, and prescribed record retention periods.

RBI conducts periodic on-site and off-site supervision of FFMCs, reviewing transaction records, KYC documentation, STR/CTR filing discipline, NOF maintenance, and adherence to the conditions attached to the Certificate of Authorisation. Adverse findings can range from an observation requiring a written response, to a monetary penalty, to — in serious or repeated cases — restrictions on business or cancellation of the authorisation.

A Payment Aggregator (PA) is an entity that facilitates e-commerce sites and merchants to accept payment instruments from customers for completion of their payment obligations, without itself being a merchant. Under RBI's Guidelines on Regulation of Payment Aggregators and Payment Gateways, non-bank PAs handling payment collection and settlement on behalf of merchants require RBI authorisation once they cross prescribed processing thresholds and criteria set out in the Guidelines. A platform that merely integrates a licensed PA's API and never itself holds customer or merchant funds is generally not a PA requiring separate authorisation — but the precise dividing line depends on your actual fund flow, not your marketing description of the product.

It depends on precisely what your app does. If you are a Lending Service Provider (LSP) that only sources, evaluates, and services loans on behalf of a regulated lender — with the loan disbursed directly between the borrower's account and the regulated lender's account, and with the regulated lender's identity clearly disclosed to the borrower as required by RBI's Digital Lending Guidelines — you may operate without your own NBFC licence, structured as a technology/servicing arrangement. If your app takes on any credit risk, disburses funds through its own account, or is not transparent about the ultimate lender, RBI's guidelines and enforcement posture treat that as requiring the entity itself to be a regulated lender.

An Account Aggregator (AA) is an NBFC category — NBFC-AA — that RBI licenses specifically to enable consent-based sharing of a customer's financial data across institutions (banks, NBFCs, insurers, and other Financial Information Providers) without the AA itself storing or reading the underlying financial data. If your app needs to pull a customer's bank or financial data from another regulated institution with the customer's consent, you generally need to either become an NBFC-AA yourself or route your data access through an already-licensed AA — you cannot build a parallel data-pulling mechanism outside the AA framework for regulated financial data.

A Peer-to-Peer (P2P) lending platform is a distinct NBFC category — NBFC-P2P — regulated under RBI's Master Direction for NBFC-P2P Lending Platforms. It operates purely as a marketplace connecting individual lenders to individual borrowers, is prohibited from raising deposits, from lending on its own account, from providing any credit guarantee, and is subject to a cap on the aggregate exposure of a single lender across all P2P platforms. A standard lending NBFC, by contrast, lends from its own balance sheet and takes credit risk directly.

RBI has not created a dedicated BNPL licence category; BNPL arrangements are regulated depending on how they are structured. Where BNPL is extended as a form of credit by a bank or NBFC, it falls under existing lending regulation, including the Digital Lending Guidelines where the arrangement is app/platform-mediated. RBI has also clarified that non-bank PPI issuers cannot load PPIs using credit lines — a clarification that specifically affected several PPI-linked BNPL and co-branded card models and forced restructuring of those products.

A Prepaid Payment Instrument is a payment instrument — a wallet, a prepaid card, or similar — that stores value and facilitates purchase of goods and services against that stored value, regulated under the PSS Act, 2007 and RBI's Master Direction on PPIs. Issuing PPIs to the public — a consumer wallet, a reloadable prepaid card — requires RBI authorisation as a PPI issuer, subject to prescribed net worth and other eligibility criteria. A single-purpose, closed-system gift card usable only for goods/services from the issuer itself (with no cash-out and no interoperability) is generally exempt from PPI licensing, but semi-closed or open-system instruments usable across multiple merchants or for cash withdrawal require authorisation.

No. RBI treats money-changing authorisation (under the Money Changing Master Direction) and payment-systems authorisation (under the PSS Act and related Guidelines) as entirely separate regulatory frameworks, even if both activities are delivered through the same customer-facing app. An FFMC wanting to add app-based forex ordering can typically do so as an extension of its money-changing activity, but adding a general-purpose payment aggregation or wallet feature requires a separate authorisation under the relevant framework.

RBI's Regulatory Sandbox is a framework that allows fintech entities to test innovative products, services, or business models with real customers within a limited, RBI-defined environment, before seeking full-scale authorisation (or confirming that no authorisation is required). It is theme-based, with RBI announcing specific cohorts (for example, cross-border payments, MSME lending, or fraud prevention themes) and inviting applications within defined windows. It is not a general-purpose fast-track licensing route — entry is selective and cohort-specific.

Conducting money-changing business without RBI authorisation is a contravention of Section 10(1) of FEMA, 1999, exposing the entity and its officers to adjudication proceedings that can result in a penalty up to three times the sum involved (or up to ₹2 lakh where the amount is not quantifiable), plus further penalty for continuing contravention. Operating a payment system without RBI authorisation is an offence under the Payment and Settlement Systems Act, 2007, which separately provides for penalties and, in serious cases, imprisonment for contravention of its provisions.

We start with a structured business-model classification call — mapping the actual flow of funds, data, and credit risk in your proposed product against the current RBI frameworks for payment aggregation, digital lending, PPIs, Account Aggregation, and P2P lending. We then issue a written classification memo identifying which framework (if any) applies, what authorisation (if any) is required, and what structural choices — such as routing settlement through a licensed partner rather than your own account — could keep you outside a licensing requirement if that is commercially preferable at your stage.

It can, in both directions. Sophisticated fintech investors specifically diligence regulatory classification and licensing status before investing, and an unresolved question of whether your model requires an RBI authorisation you do not hold is a common deal-delaying or deal-killing finding. Conversely, holding the correct authorisation (or a well-documented basis for not needing one) is itself a credibility signal to investors evaluating a regulated-adjacent business.

FFMCs are required to submit periodic returns to their jurisdictional RBI Regional Office covering money-changing turnover, branch-wise transaction data, and other formats prescribed under the Master Direction on Money Changing Activities, in addition to responding to any ad hoc information requests raised during supervisory review. The specific return formats and periodicity are set out in the current Master Direction and its updates.

No. An NBFC Certificate of Registration authorises the specific category of NBFC activity registered (such as investment and credit, or a specific sub-category like NBFC-P2P or NBFC-AA). Money-changing authorisation under the FFMC framework and payment-systems authorisation under the PSS Act are entirely separate regulatory approvals. An NBFC wanting to add either activity must apply for the relevant separate authorisation; it cannot simply expand its existing Certificate of Registration to cover it.

A nodal account is a dedicated bank account, opened with a scheduled commercial bank, through which a payment aggregator routes customer payments before settling funds to the merchant, structured so that funds do not commingle with the PA's own operating funds and settlement occurs within RBI-prescribed timelines. RBI's PA-PG Guidelines mandate this account structure specifically to protect merchant and customer funds from the PA's own business risk.

PNPC operates from Chennai, Bangalore, Hyderabad, and Dubai. For fintech and remittance businesses with an India-UAE dimension — a UAE exchange house entering India, an India-based remittance fintech routing flows through UAE corridors, or a group with entities regulated by both RBI and the UAE Central Bank — we coordinate the Indian RBI licensing and compliance work with the UAE regulatory and corporate advisory from a single engagement team, rather than requiring you to brief two disconnected firms across two jurisdictions.

PNPC charges a fixed, scoped professional fee agreed in writing before work begins, based on the specific engagement — a full FFMC licence application, a fintech classification memo, an ongoing compliance retainer, or a combination. Given the fact-specific nature of regulatory classification and the variability in RBI processing timelines, we scope each engagement individually after the initial business-model classification call rather than quoting a standard package fee upfront.

FFMC and RBI fintech licensing are specialist regulatory practice areas, not standard company registration. A generalist portal or firm can file your SPICe+ incorporation but has no basis to assess whether your business model requires an RBI authorisation, what your defensible Net Owned Fund position is, or how RBI's Digital Lending Guidelines apply to your specific fund-flow architecture. PNPC's FEMA & RBI practice has advised on cross-border and regulated-financial-services matters since 1986, and we stay current on RBI's frequently updated Master Directions and Guidelines as a core part of the practice, not as an occasional add-on service.

Yes. We regularly onboard existing FFMC and fintech-licensed clients for ongoing compliance management — reviewing your current KYC/AML policy, periodic return filing history, NOF maintenance position, and any outstanding RBI observations, then building forward from a clean, current compliance calendar rather than assuming the prior advisor's work was complete.

Yes, subject to the applicable FDI policy for the specific activity and RBI's licensing requirements for the entity itself. Certain fintech-adjacent activities carry sector-specific FDI conditions or government-route requirements depending on the activity and the investor's country of origin — this must be checked at the structuring stage, before incorporation, alongside the RBI licensing pathway for the underlying regulated activity.

Authorised Dealer Category-I banks are separately licensed by RBI under FEMA to deal in foreign exchange as part of their broader banking business, including money-changing, and operate under a different (though related) authorisation framework than a standalone FFMC. A non-bank company cannot become an AD bank; it can only pursue FFMC (or RMC, or franchisee) authorisation for money-changing activity specifically.

Cryptocurrency and virtual digital asset (VDA) exchanges are not regulated under the FFMC, PA-PG, or standard NBFC frameworks described here — RBI has historically expressed caution regarding banking-channel access for VDA-related businesses, and the sector is separately subject to the Prevention of Money Laundering Act reporting-entity obligations (VDA service providers are notified as reporting entities under PMLA) and a dedicated VDA taxation regime under the current Income Tax Act (the specific taxing provision has been renumbered with the transition from the Income-tax Act, 1961 to the Income Tax Act, 2025 — PNPC confirms the applicable section reference at the time of advice rather than quoting a number that may already be superseded). If your business involves VDA trading, custody, or exchange services rather than fiat money-changing or the fintech categories described above, PNPC advises on this as a distinct, separately scoped engagement given the fast-evolving and still-developing regulatory posture in this specific area.