XcellCloud|Fintech in India
822 million UPI payments a day. Every one of them runs on infrastructure a regulator can inspect.
India's payment, lending, wealth and insurance fintechs now work under detailed RBI, SEBI, IRDAI, CERT-In and DPDP rules. This guide maps the market, the rules and their dates — and the India-hosted cloud, keys, WAAP, SOC and DR stack XcellHost runs from Mumbai.
The world's busiest real-time payment rail, and the rulebook that came with it.
India's fintech story starts with public rails — Aadhaar for identity, UPI for payments, the account-aggregator network for consented data — and private companies building on top. UPI alone moved 25.47 billion payments worth ₹31.53 lakh crore in October 2026, about 822 million a day, according to NPCI data reported on 2 November 2026. PIB puts UPI at nearly half of the world's real-time digital payment volume, live in 11 countries.
Money is following, more selectively. Tracxn counts $2.2 billion raised by Indian fintechs in January–September 2026, up 14% on a year earlier, but across 153 rounds — 41% fewer. Digital lending and payments lead. Fewer, larger cheques go to companies that can show licences, controls and audit trails, which is why infrastructure has become a board-level topic for fintech founders.
- Mumbai — home of RBI, SEBI and NPCI, and of XcellHost's Tier IV data centre.
- Bengaluru & Delhi NCR — the largest pools of fintech engineering and founders.
- GIFT City, Gandhinagar — IFSCA's international financial services centre, with its own FinTech sandbox (2026).
Monthly transactions, billions
Sources: NPCI data as reported by PIB (July, August 2026; factsheet of 8 Sep 2026) and by IANS/Free Press Journal (September, October 2026; 2 Nov 2026). August value was not in the sources we checked, so it is not drawn.
Ten kinds of fintech, ten different rulebooks.
Filter by regulator, then open a tile to see the key rule and what it means for your infrastructure.
What each regulator expects of the systems you run.
Status as checked on official sites on 10 November 2026. Each card says what the rule means for hosting, keys, logs and recovery — not the whole rule.
RBI re-organised its rulebook on 28 November 2025, withdrawing or subsuming 9,446 circulars into entity-wise Master Directions, and on 31 July 2026 issued entity-wise cybersecurity and technology-risk directions. Older titles below are kept where they are still the name the market uses; check the version for your entity type.
Eight years of rules, and the dates still ahead.
Drag or scroll sideways. The orange marker is today, 10 November 2026.
Ten infrastructure jobs every regulated fintech ends up doing.
Each one links to the XcellHost service that does it. We help you meet these requirements; your entity stays responsible for its own compliance and audits.
A segmented, India-only environment for the cardholder-data zone, with the evidence a QSA asks for.
BFSI Cloud → Data localisationPayment and lending data on servers in India, DR in India, sub-processors named.
BFSI Cloud → HSM & key managementKeys for tokens, PINs, signing and encryption held in hardware you control, with dual-control ceremonies.
Cloud HSM → TokenisationCard and identity numbers swapped for tokens, so your apps never store the real value.
HSM → DR & uptimeReplication, runbooks and half-yearly drills with RTO and RPO measured and signed.
Cloud DR → SOC & fraud monitoring24×7 watch on logs and alerts, with the six-hour report to RBI and CERT-In drafted for you.
Security Operations → API security & WAFWAAP in front of payment APIs and apps: bot control, rate limits, DDoS absorption.
Cloudflare WAAP → Audit-ready logs180 days of logs in India for CERT-In, longer where your regulator asks, searchable for audits.
NG-SIEM → DMARC & brand protectionStop fraudsters sending "from" your domain — the first step of most payment scams.
DMARC → AI fraud & risk modelsModel hosting, RAG for policy and KYC teams, and GPU capacity on quote — with RBI's FREE-AI principles in mind.
RAG & AI →VAPT and system audits under RBI's Payment Aggregator Directions must be done by CERT-In empanelled auditors. XcellHost does not claim CERT-In empanelment; we prepare evidence and fix findings, and your empanelled auditor tests.
Set your recovery targets. See the architecture tier — and what an hour down costs.
RTO is how long you can be down; RPO is how much data you can lose. Tighter targets need a more expensive design. Revenue figures use your own inputs.
Tier 3 · Hot standby DC-DR
—
Tiers are an XcellHost design rule of thumb, not a regulatory classification. RBI's non-bank PSO directions and 2026 bank cyber directions ask for DR drills at least half-yearly; SEBI's CSCRF FAQs describe RTO 2 hours and RPO 15 minutes for critical systems of qualified entities.
Segment and stage in. A layered XcellHost stack out.
Each layer links to the page that explains it. Send the result to the configurator to price it.
Three bundles, priced from our own service pages.
Every line is a service with its own page and price; a bundle is the sum. No discount is assumed. INR per month, excluding 18% GST.
Prices are the same as on the linked XcellHost pages, where most are marked indicative; confirm before ordering. * The ₹39,999 compliance-mapping workshop is a new placeholder for this page — confirm with XcellHost.
Bundle, quantities, term. Total in rupees, GST shown.
Monthly run-rate ₹0 excl. GST
Indicative · excl. 18% GST until the total line. Prices as on the linked XcellHost pages; * placeholder.Yes, for payment system operators and their partners. RBI's circular on storage of payment system data (6 April 2018) requires the full end-to-end transaction data to be stored only in India; data processed abroad has to come back. RBI's Payment Aggregator Directions, 2025 apply the same storage rule to aggregators.
RBI's Payment Aggregator Directions of 15 September 2025 bring online, physical (point-of-sale) and cross-border aggregators under one framework, with ₹15 crore net worth at application and ₹25 crore by the end of the third year. They require PCI DSS compliance, an annual system and cyber audit by CERT-In empanelled auditors, half-yearly VAPT and escrow controls. Physical-only aggregators had to apply by 31 December 2025.
RBI's Digital Lending Directions of 8 May 2025 require data to be stored on servers in India; data processed outside India must be deleted there and brought back within 24 hours. Since November 2025 these provisions sit in RBI's entity-wise Master Directions, so check the version for your bank or NBFC partner.
RBI's Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank PSOs (30 July 2024) apply to large PSOs from 1 April 2025, medium PSOs from 1 April 2026 and small PSOs from 1 April 2028. They include six-hour incident reporting to RBI, annual VA/PT and half-yearly DR drills.
CERT-In's directions of 28 April 2022 require reporting within 6 hours of noticing specified incidents, and ICT logs kept for a rolling 180 days within India. RBI's PSO and 2026 bank directions also set a six-hour report to RBI. Our SOC keeps the clock and drafts both reports.
Yes. PCI DSS v4.0.1 is the current version, and the requirements that were "future-dated" became mandatory on 31 March 2025 — including payment-page script controls, authenticated internal scans and MFA for all access to the cardholder data environment. XcellHost hosts PCI-scoped workloads; your QSA assesses your compliance.
RBI's directions on authentication mechanisms for digital payments (25 September 2025) apply from 1 April 2026. They keep two-factor authentication for most transactions but allow factors other than SMS OTP, ask for at least one dynamic factor for card-not-present payments, and allow risk-based checks. Card issuers had to apply risk-based authentication to overseas card-not-present transactions by 1 October 2026.
RBI's framework for self-regulatory organisations in fintech (May 2024) led to FACE being recognised in August 2024 and the Unified Fintech Forum in September 2026. Membership is voluntary under the framework, but partners and investors increasingly ask about it.
The DPDP Rules were notified on 13 November 2025. Consent-manager provisions start on 13 November 2026, and the core duties — notice, consent, security safeguards, breach intimation and rights — on 13 May 2027. See our DPDP compliance platform.
We do not claim either. XcellHost holds ISO 9001, 27001, 27017, 27018 and 20000-1, SOC 2 Type I and II, and is MeitY empanelled, with a Tier IV data centre in Mumbai. Your PCI assessment is done by a QSA and your RBI system audit by a CERT-In empanelled auditor; we provide the evidence and fix findings.
Where every number and date on this page comes from.
Checked on 10 November 2026. Official sources first; press reports are used where the official page was not reachable.
- NPCI data via IANS / Free Press Journal — UPI 25.47 bn transactions, ₹31.53 lakh crore, October 2026 · 2 Nov 2026
- PIB — 7th Global Fintech Fest 2026: UPI, financial inclusion index, Aadhaar e-KYC, Jan Dhan figures · 8 Sep 2026
- Tracxn India FinTech 9M 2026 report, via CXOToday — $2.2 bn, 153 rounds, 3 IPOs · 13 Oct 2026
- RBI — Reserve Bank of India (Regulation of Payment Aggregators) Directions, 2025 (RBI/DPSS/2025-26/141) · 15 Sep 2025
- RBI — Reserve Bank of India (Digital Lending) Directions, 2025 (RBI/2025-26/36) · 8 May 2025
- RBI — Reserve Bank of India (Non-Banking Financial Companies – Credit Facilities) Directions, 2025 (RBI/DOR/2025-26/347) · 28 Nov 2025
- All India Radio News — RBI consolidates 9,446 circulars into entity-wise Master Directions · 28 Nov 2025
- RBI — Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank PSOs (RBI/DPSS/2024-25/123) · 30 Jul 2024
- RBI — (Commercial Banks) Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 (RBI/DoS/2026-27/410) · 31 Jul 2026
- RBI — Storage of Payment System Data · 6 Apr 2018
- Khaitan & Co summary of RBI Authentication Mechanisms for Digital Payment Transactions Directions, 2025 · issued 25 Sep 2025
- RBI press release — FACE recognised as SRO-FT · 28 Aug 2024 · Unified Fintech Forum recognised · 10 Sep 2026
- RBI press release — FREE-AI framework report · 13 Aug 2025
- CERT-In — Directions under section 70B(6) of the IT Act (6-hour reporting, 180-day logs) · 28 Apr 2022
- SEBI — Cybersecurity and Cyber Resilience Framework (CSCRF) · 20 Aug 2024; timelines extended 28 Mar 2025; FAQs 11 Jun 2025
- IRDAI — Information and Cyber Security Guidelines, 2023 · Apr 2023
- IFSCA FinTech Sandbox Framework, 2026 (summary) · circular of 16 Mar 2026 · IFSCA FinTech
- MeitY — Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 · Rules notified 13 Nov 2025; PIB releases 14 Nov and 3 Dec 2025
- PCI Security Standards Council — PCI DSS v4.0.1 document library · v4.0.1 Jun 2024; future-dated requirements effective 31 Mar 2025
- FIU-IND — reporting entities including VDA service providers under PMLA · notification of 7 Mar 2023
Not legal, regulatory or investment advice. This page summarises public sources as of 10 November 2026 for general information. Rules change and apply differently to each licence and partnership; confirm with your compliance team, counsel and regulator. Market figures are third-party estimates or regulator statistics as cited. Map and scenes are illustrations. XcellHost helps you meet requirements; it does not certify your compliance.