Cross-Border Wallet with Indian Users
PayNimbus is a fintech entity authorised by IFSCA in GIFT City to provide payment services. It plans a multi-currency stored-value wallet for Indian residents and NRIs. Indian residents would fund wallets from their Indian bank accounts, hold balances in USD, EUR and SGD, and use them to pay overseas merchants and transfer to other wallet holders. PayNimbus would hold client funds in a pooled account with an IFSC bank, invest 30% of the float in a money-market fund, and use a Singapore card processor. It expects 200,000 Indian resident users in year one. The product head says IFSCA authorisation is enough because the entity is in GIFT City and all balances are in foreign currency. The compliance officer is concerned about RBI rules, safeguarding, AML and data localisation.
1. Is IFSCA authorisation alone sufficient for the proposed wallet? Identify the regulatory gaps.
Read the worked answer
No. IFSCA authorisation covers the IFSC entity, but it does not displace RBI and FEMA rules for Indian residents, rupee funding or payment systems. A wallet funded from Indian bank accounts and used for cross-border merchant payments and person-to-person transfers engages RBI payment-system and prepaid-instrument rules, FEMA, LRS and AML. The pooled account, investment of float and card-processor outsourcing need regulatory analysis. The claim that foreign-currency balances make it purely offshore is weak because the users and funding source are Indian. PayNimbus needs a legal mapping and likely RBI authorisation or a regulated partner; it cannot rely on IFSCA alone.
2. What safeguarding and liquidity rules should apply to client balances?
Read the worked answer
Client balances must be safeguarded in a segregated trust or safeguard account with an IFSC bank, reconciled daily, and not commingled with corporate funds. Do not lend the float. Investment of 30% in a money-market fund should be limited to high-quality, liquid, principal-protected assets, with maturity and concentration limits and a wind-down plan. Set minimum liquidity and capital buffers; disclose safeguarding and insolvency remoteness. A independent trustee or custodian should oversee the account, and the firm should have a recovery plan if the bank or fund manager fails.
3. What AML and data issues arise?
Read the worked answer
AML. KYC for residents and NRIs, sanctions screening, PEP checks, transaction monitoring and STRs to the FIU; the card processor and wallet holders need due diligence. Cross-border transfers and wallet-to-wallet payments are higher-risk and need velocity and counterparty controls.
Data. Comply with Indian data-localisation and DPDP requirements; cross-border transfer of KYC and payment data needs a lawful basis; outsourcing cannot transfer regulatory responsibility. The Singapore processor must be under a written agreement with audit, access and termination rights. The firm should complete a data-protection impact assessment before launch.