I. The Emerging Regulatory Architecture - 2025/2026

1. India's Big Consolidation:
On November 28, 2025, RBI withdrew 9,445 legacy circulars and issued 244 unified Master Directions segregated by entity type - Banks, NBFCs, Payment Systems. This is the single reference now for fintechs partnering with REs.

2. Digital Lending Directions, 2025 (May 8, 2025):
Replaces 2022 guidelines + DLG Directions 2023. Key mandates:

• Direct fund flow: loan must go Lender Bank Account -> Borrower Bank Account. No pass-through by LSP.
• 1-day cooling-off / look-up period for loans < 7 days
• All fees, APR, Key Fact Statement to be shown upfront in app
• FLDG cap: LSP can provide First Loss Default Guarantee only up to 5% of portfolio
• Enhanced credit reporting and grievance redressal officer of RE must handle LSP-sourced loans

3. Payment Aggregator / Payment Gateway Master Direction - Sept 2025:

• Escrow mechanism: funds held max T+1
• Net worth: Rs 15 crore at application, Rs 25 crore by 3rd year
• Physical presence and background checks for merchants. No more non-compliant onboarding.
• PA-CB (cross-border) license now separate.

4. SRO-FT Framework - May 30, 2024:
RBI's Framework for Self-Regulatory Organisation for FinTech Sector to enable industry self-governance on code of conduct, consumer protection.

5. Digital Personal Data Protection Act, 2023 + Draft Rules 2025:
Fintechs are Data Fiduciaries. Consent manager, purpose limitation, data retention (loan data cannot be kept beyond necessity). Breach reporting to Data Protection Board within 72 hrs.

6. CBDC and UPI 2.0:
E-Rupee retail pilot widened, UPI limits raised to Rs 5 lakh for health/education, new auth modes (Face ID). Proposal for 1-hour cooling for UPI/IMPS > Rs 10,000 for fraud control.

Global Parallel:

• EU: PSD2 mandating Open Banking + SCA, now evolving to PSD3/PSR. MiCA Regulation (EU) 2023/1114 - stablecoin titles applicable from 30 June 2024, full CASP licensing from 30 Dec 2024. One license = passport across EU.
• US: No single charter. Patchwork: Bank Secrecy Act / FinCEN for KYC/SAR, State Money Transmitter Licenses, SEC Howey Test for tokens, CFPB Section 1033 for open banking.
• UK: FCA Authorised Payment Institution, E-Money license + Consumer Duty 2023.

II. Landmark Case Laws You Must Know

A. INDIA

1. Internet and Mobile Association of India v. Reserve Bank of India (2020) 10 SCC 274
Facts: RBI circular dated 6 April 2018 - "Prohibition on dealing in Virtual Currencies" directed all REs to not provide services to crypto exchanges.
Issue: Whether circular violates Art 19(1)(g) - freedom to carry on trade, and is ultra vires Sections 35A, 45JA of Banking Regulation Act.
Judgment 4 March 2020 by Justice V. Ramasubramanian: Supreme Court quashed circular.
Ratio:

• RBI has power to regulate VCs, but must show proportionality. RBI could not show any actual harm caused to REs from VCs.
• Doctrine of Proportionality: restriction must be least intrusive. Complete ban = disproportionate.
• This case is foundation of crypto legality in India today and opened banking access for WazirX, CoinDCX】 etc. Later government tried to regulate via 30% tax, not ban.

2. Razorpay Software Pvt Ltd v. Union of India - Karnataka HC 2024, affirmed by Supreme Court 26 Feb 2026
Facts: ED alleged Razorpay facilitated illegal Chinese loan apps and charged under PMLA Sec 3,4,70 for money laundering.
Judgment: Karnataka High Court quashed proceedings on 5 March 2024, holding no evidence of intent. Supreme Court dismissed ED's SLP on 26 Feb 2026 - "not inclined to interfere".
Ratio Emerging:

• Payment Gateway is intermediary, not beneficiary. PMLA requires knowledge and intent to launder, not mere negligence in merchant onboarding.
• Sets higher bar for fintech PMLA cases. Very important for IPO-bound Razorpay, Cashfree.

3. Paytm Payments Bank Ltd - Regulatory Enforcement Action 2022-2026
Not a court case but the most cited enforcement precedent.
Timeline: 2022 - bar on new onboarding. Jan 2024 - RBI orders stop on fresh deposits, top-ups due to persistent KYC/AML, related party, tech infra failures. April 24, 2026 - Licence cancelled under Section 22(4) Banking Regulation Act, 1949, affairs "detrimental to depositors". July 2026 - removed from Second Schedule of scheduled banks.
Legal Principle: RBI can invoke "fit and proper" and governance standards for Payments Bank licence even without financial insolvency. Shows shift from financial to tech-governance compliance.

4. Google Pay / PhonePe - PPI vs TPAP classification
In 2020 RBI affidavit to Delhi HC, Google Pay clarified it is not a Payment System Operator but a Third Party Application Provider (TPAP) in UPI ecosystem, operating via sponsor banks. Establishes that tech layer needs NPCI approval, not RBI PA license.

B. GLOBAL

5. SEC v. Ripple Labs Inc., SDNY 2023
On XRP: Court held programmatic sales of XRP on exchanges are NOT securities transactions, but institutional sales ARE. First major judicial test for Howey in crypto fintech.

6. Wirecard AG collapse (Germany 2020)
Munich prosecutors - failure of audit + BaFin regulatory failure led to EU overhaul: creation of Anti-Money Laundering Authority (AMLA) and stricter supervision of fintechs under MiCA and DORA (Digital Operational Resilience Act).

7. PSD2 SCA Cases - EU Court of Justice
Multiple CJEU referrals have tightened Strong Customer Authentication exemptions. E.g., failure to provide SCA for contactless > EUR 50 = liability shifts to Payment Service Provider.

III. What this means for you as fintech builder/lawyer in 2026

• If you lend, you are regulated as NBFC partner - your LSP contract must reflect Digital Lending Directions.
• If you aggregate payments, get PA authorization before scaling.
• PMLA risk is now intent-based, but DPDP + FLDG compliance is strict liability.
• For exams/viva: Always cite proportionality test from IAMAI case and mens rea requirement from Razorpay SC order - examiners expect those two.