High-risk business in India: rules, licences and payment models

The decision before launch

In this article, high-risk is a working description of businesses with greater regulatory or payment complexity. It is not the name of a permission. For India, separate three questions: may the product be offered, is the proposed movement of money permissible, and will a particular bank or PSP accept the model?

The central gaming finding is that the published federal framework prohibits online money gaming rather than creating a universal licence for it. The final Rules 2026 specify 1 May 2026 as their commencement date; they are no longer the 2025 draft. A review of historical state licences therefore does not provide enough information for a launch decision. [2] [4]

The practical sequence is product classification and legal eligibility first, then funds flow and counterparty acceptance, followed by pricing, integration and access to funds. A technically successful test payment does not itself answer the first two questions.

A map of the verticals

Gambling, betting and RMG: assess the mechanics

Labels such as casino, fantasy, poker, skill game or betting do not replace an assessment of the mechanics. Section 2 PROG links an online money game to a fee, deposit or other stake paid in expectation of monetary or other enrichment; predominance of skill does not remove that classification. Purchased money-equivalent items, including virtual tokens and credits, also count. [1]

The product team should document the entire cycle: what users pay for, what they can win, whether assets can be transferred or redeemed, and how prizes are funded. Related external marketplaces also matter. Rule 9 expressly considers the revenue model and external monetisation of game assets. [3]

The Act separately prohibits offering or facilitating money gaming, direct or indirect advertising, and facilitation of associated payments or fund authorisation. The issue therefore affects the operator, advertising partners and the payment chain. [1]

Editorial conclusion: for the prohibited model described here, the task cannot be reduced to finding a more tolerant acquirer. It requires a legal eligibility decision or a change to the underlying product followed by reassessment. Changing the payment instrument does not change the economic substance of a stake.

Gaming models worth assessing

1. A genuine subscription or one-off access purchase

A social game may charge for access when the payment is not a stake and the model meets the statutory definition. This provides a basis for assessing entertainment or educational products, not automatic approval of any app using a subscription. [1]

Prepare access terms and an explanation of in-game purchases, refunds, balances, asset transfers and the absence of monetary winnings in return for a stake. Renaming a deposit a “subscription” proves nothing. Documentation should match the actual interface and product behaviour.

2. E-sports meeting the complete definition

The e-sport definition permits fees for participation or administrative costs and performance-based prizes, but requires the prescribed recognition and registration and excludes bets by any person. Calling a money tournament an e-sport is insufficient. [1]

The assessment file should explain competition rules, the purpose of the fee, prize funding and the absence of participant or spectator wagering. Counsel should check every element of the definition; the payment partner should agree the specific transactions, including payouts.

3. A product without money-gaming mechanics

A practical model to consider is a game, content or learning service purchased for its utility rather than a chance of monetary gain. This is a product suggestion, not a legal opinion. A monetisation change requires reassessment, not merely a new terms page.

Registration and the limits of historical licences

The Rules 2026 provide for determination and registration through the Online Gaming Authority of India. E-sports require registration; social games are subject to the cases and notified categories provided by the Rules. It would be inaccurate to say every social game automatically needs an identical licence. Determination attaches to a particular game and provider. [3]

A certificate is only part of the assessment: user protection, age-related measures, complaints and compliance with regulatory directions also matter. A certificate lasting up to ten years is not unconditional permission for every future mechanic. [4]

Nagaland’s official page describes the historical games-of-skill regime under its 2016 legislation; it does not establish nationwide clearance after PROG. Sikkim’s departmental description concerns intranet terminals within the state, not an unrestricted India-wide internet service. [5] [6]

An overseas licence creates no independent exception either: the federal Act expressly covers services offered into India from abroad. [1] Tax obligations and permission to operate are separate assessments; tax registration should not be presented as evidence of gaming clearance. Rates and liabilities for past periods require a separate tax review.

The merchant, payment aggregator and technology gateway

A payment intermediary’s authorisation is not its customer’s operating licence. RBI distinguishes a PA, which collects and settles merchant funds, from a PG providing technology without handling funds. A non-bank PA requires RBI authorisation; a technology-only PG without fund handling is outside the PA Directions, not outside every law. [7]

This matters for technology platforms too: not holding money does not itself remove the prohibition on facilitating money-gaming payments. OGAI rules address directions on payment verification and restriction. Absence from a blocking list is not an independent permission. [1] [3]

For a permissible product, assess the real legal entity, activity, merchant category, bank account and actual funds flow. General PSP authorisation does not establish acceptance of your vertical; check the scope and obtain separate counterparty confirmation. RBI updated its general payment-system authorisation framework on 15 June 2026. [7] [8]

A model to discuss is customer → agreed bank/PA → the actual merchant’s account. The technology layer transmits and monitors transactions within its agreed role. Do not apply this model to regulated payouts, investments or lending without reviewing their own requirements.

An overseas company and cross-border payments

PA-CB exists for permissible cross-border e-commerce. Its scope is current-account transactions allowed under FEMA, not arbitrary investments, stakes or capital transfers. Transaction type, legal parties and the settlement route require assessment. [7]

FEMA restrictions do not disappear when customers use international cards. RBI’s Other Remittance Facilities, updated 1 October 2026, includes restrictions on lottery-related remittances and purchases of lottery tickets, football pools and sweepstakes. This is an additional purpose-of-payment assessment; technical card acceptance cannot replace it. [9]

The practical question for an overseas merchant is: “What specific permissible obligation is the Indian customer paying, and on what basis does the bank process that transfer?” An overseas company and licence alone are insufficient. Misrepresenting the recipient, merchant category or purpose is not a lawful onboarding model.

Three other verticals: distinct permissions and funds flows

Forex / CFDs

It is inaccurate to treat all forex as prohibited. For an Indian resident under FEMA, the permitted instrument and purpose, authorised person and permitted platform matter. Covered electronic platforms must be assessed against the ETP Directions 2025, which replaced the 2018 framework. Absence from the Alert List does not establish authorisation. [10] [11]

LRS is a scheme for resident individuals; it does not allow margin or margin-call remittances to overseas exchanges or counterparties. A broker’s foreign licence alone does not resolve this. Each CFD needs assessment of its underlying asset, structure, customer residence and permissions; this review does not conclude that all derivatives are prohibited. [12]

VDA / crypto

Covered VDA services are subject to the AML/CFT framework and reporting-entity registration with FIU-IND. The parliamentary answer of 30 March 2026 expressly distinguishes that registration from government licensing, approval or endorsement. It should not be marketed as an “RBI-licensed crypto exchange”. [13]

The payment implication is an editorial inference: separately establish banking relationships, permissible INR and cross-border flows, AML duties and other model-specific requirements. FIU registration does not establish UPI or card-acquiring availability. This research contains no verified list of available counterparties.

Digital lending

In the assessed NBFC model, distinguish the lender from its lending service provider, or LSP. Chapter III of the current NBFC Credit Facilities Directions requires, subject to specified exceptions, disbursement to the borrower’s bank account and repayment directly to the NBFC, without an LSP pass-through or pool account. RBI’s DLA listing does not authorise the app itself. [14]

Lend-tech therefore cannot automatically be onboarded as an ordinary seller using one wallet for all funds. First establish the lender, contracts and permitted flow. The detailed model reviewed here is NBFC lending; a particular bank’s rules and other lawful lending regimes need separate assessment.

Cost and access to money: what to establish

Public legal instruments do not confirm your processing price, conversion or settlement time. This article offers no “average Indian high-risk rate” or onboarding promise. Historical offers in the earlier India review do not establish eligibility for gambling, crypto or forex.

After establishing eligibility, request comparable commercial terms from each counterparty:

• Collections and payouts separately: percentage, fixed component, currency, minimum charges and the cost of failed transactions.
• When funds become available: the starting event, cut-off, weekends, limits and reasons for withholding.
• Reserves, security and release conditions, including after contract termination.
• FX, refunds, disputes and chargeback costs, and which party bears them.
• Documents required for transaction reviews and events that suspend service.

This is a proposed negotiation checklist, not a claim that every PSP applies every charge. Compare total cost and access to funds for the same business scenario. Before written terms are obtained, any calculation remains hypothetical.

A working sequence before integration

1. Document the product. User journey, fees, prizes, assets, refunds, geography and legal entities. For games, version the rules and monetisation model.
2. Obtain a model-specific opinion. Cover federal law, relevant states, current court orders and required permissions.
3. Check documents and roles. Establish the holder, scope and conditions of permissions, and who acts as seller, lender, PA or technology supplier.
4. Map the money. Trace payer to final beneficiary, including payouts and refunds, currencies, accounts and cross-border legs.
5. Obtain bank/PSP confirmation. It should cover the actual model and legal entity, followed by pricing, settlement and disputed transactions.
6. Test the agreed flow. Verify statuses, refunds, reports and reconciliation. A change to the product or money flow reopens the relevant assessment.

This is an editorial working sequence, not an additional regulatory rulebook. Its purpose is to avoid committing integration budget before resolving eligibility.

PayStar’s role

PayStar Discovery helps collect and compare information about payment partners’ requirements. Direct Connect provides an agreed API for connecting selected PSPs. Core supports routing, monitoring and reconciliation across connected payment operations.

PayStar is not a bank or PSP, does not arrange acceptance or settlement in its own name, and does not receive or hold customer or merchant funds. The merchant chooses and contracts directly with the PSP, which performs processing and settlement. Discovery and technical integration do not replace legal advice, a licence or a bank’s acceptance decision.

Next step: prepare a description of a permissible product and request information on requirements, methods, cost and settlement. Free information does not imply free integration or processing. The existing India overview provides broader payment context; its historical sample is not a list of approved high-risk connections.

Research limits and the check before release

Legal sources were checked on 15 October 2026. The research date does not mean every instrument was amended that day. This review does not replace an Indian lawyer’s assessment of a particular model.

A material open issue: current orders in the constitutional challenge to the central PROG Act, including any applicable judicial stay, have not been confirmed as of the research date. The official order read, dated 11 December 2025, merely scheduled a hearing. It cannot establish either final judicial validation of the Act or the absence of a stay in October 2026. [15]

Before relying on this analysis for a launch decision, verify current court orders and subsequent applicable OGAI instruments, as well as the particular operator’s certificates and PSP terms. Land-based casinos, betting premises, lotteries, advertising outside the assessed online framework, tax and personal-data rules are not covered exhaustively. This text grants no clearance on those matters.