The Reserve Bank of India (RBI) has imposed a ₹9 lakh monetary penalty on One MobiKwik Systems Limited for non-compliance with regulatory requirements governing Prepaid Payment Instruments (PPIs) and payment fraud reporting.
Announced on 13 November 2026, the enforcement action highlights two important areas of regulatory compliance for fintech companies and payment service providers: beneficiary transfer controls and timely reporting of payment frauds.
According to RBI, the company permitted certain PPI holders to transfer funds to beneficiaries who had not been pre-registered beyond the prescribed regulatory limit. It also failed to report certain frauds within the stipulated timeline.
Although the penalty amount is relatively modest, the supervisory findings raise important questions about the effectiveness of transaction controls, automated regulatory reporting, compliance monitoring and independent audit assurance.
For banks, fintechs and payment institutions, the central lesson is that regulatory compliance must be embedded in payment systems and daily operations, not managed solely through policies and periodic reporting.
1. What Happened in the MobiKwik RBI Penalty Case?
On 13 November 2026, RBI announced that it had imposed a ₹9 lakh penalty on One MobiKwik Systems Limited through an order dated 6 November 2026.
The action followed a statutory inspection covering the company’s operations from June 2025 to March 2026.
RBI identified two regulatory contraventions and issued a show-cause notice. After considering the company’s written response, additional submissions and representations during a personal hearing, RBI concluded that both charges were sustained.
Regulatory Enforcement Snapshot
| Particulars | Details |
| Regulated entity | One MobiKwik Systems Limited |
| Regulator | Reserve Bank of India |
| Penalty | ₹9 lakh |
| Order date | 6 November 2026 |
| Public announcement | 13 November 2026 |
| Inspection reference period | June 2025–March 2026 |
| Violation 1 | Fund transfers to non-pre-registered beneficiaries beyond the permitted limit |
| Violation 2 | Delayed reporting of certain payment frauds |
| Governing legislation | Payment and Settlement Systems Act, 2007 |
| Company’s disclosed financial impact | ₹9 lakh |
The penalty was imposed under Section 30(1), read with Section 26(6), of the Payment and Settlement Systems Act, 2007.
RBI clarified that its action concerned regulatory compliance deficiencies and did not constitute a determination regarding the validity of individual customer transactions or agreements.
What Has Not Been Publicly Established?
The available regulatory announcement does not specify:
- The number of transfers that exceeded the applicable limit.
- The total value of the affected transfers.
- The number of delayed fraud reports.
- The precise delay associated with each report.
- Whether the underlying payment transactions resulted in customer financial losses.
- The detailed technical or operational causes of the contraventions.
Accordingly, the case should be analysed as a confirmed regulatory non-compliance matter, not as evidence of a specific cyberattack, fraudulent scheme or established customer loss.
2. What Are RBI’s PPI Beneficiary Transfer Rules?
A Prepaid Payment Instrument is a payment instrument that enables holders to purchase goods and services, undertake permitted financial transactions and transfer funds against stored value.
Examples include eligible digital wallets and other RBI-regulated prepaid payment products.
RBI’s Master Directions on Prepaid Payment Instruments, 2021, updated as of 30 September 2026, establish requirements covering issuance, customer identification, wallet limits, fund transfers, security and customer protection.
What Is a Pre-Registered Beneficiary?
A pre-registered beneficiary is a recipient registered by the PPI holder through the issuer’s approved process.
For eligible full-KYC PPIs, RBI prescribes different fund-transfer limits depending on whether the beneficiary is pre-registered.
| Transfer category | RBI limit |
| Pre-registered beneficiary | Up to ₹2,00,000 per month per beneficiary |
| Other permitted fund transfers | ₹10,000 per month |
| Maximum outstanding balance in a full-KYC PPI | ₹2,00,000 at any point |
Issuers must also consider customers’ risk profiles and operational risks when determining limits within the prescribed regulatory ceilings.
These figures relate to the relevant full-KYC PPI provisions. They should not be assumed to apply identically to every payment product, transaction type or wallet arrangement.
Why Is Beneficiary Registration Important?
Beneficiary registration is an important payment risk control because it allows a financial institution to apply differentiated controls to transfers involving identified recipients.
An effective process should:
- Identify and register the intended beneficiary.
- Authenticate the customer’s beneficiary-registration request.
- Record relevant beneficiary details.
- Apply the appropriate transaction and cumulative transfer limits.
- Monitor changes and unusual payment behaviour.
- Retain records demonstrating compliance.
The purpose is not simply to create a beneficiary database.
It is to ensure that payment permissions, transfer limits and beneficiary status are consistently enforced throughout the transaction process.
3. MobiKwik’s First Compliance Violation: Transfer Limits
RBI found that certain PPI holders had been permitted to transfer funds to non-pre-registered beneficiaries beyond the prescribed limit.
MobiKwik’s stock-exchange disclosure separately described the issue as not providing the pre-registered-beneficiary facility in accordance with the PPI Master Directions.
These descriptions concern the same general control area but should not be treated as evidence of any particular technical defect.
What Are the Possible Control Risks?
For any PPI issuer, inappropriate beneficiary-limit enforcement can arise from weaknesses in areas such as:
Transaction Rule Configuration
The system may not consistently apply the correct regulatory limit to a particular transfer category.
Cumulative Limit Monitoring
Monitoring individual transactions without aggregating monthly transfers can leave cumulative limit breaches undetected.
Beneficiary Classification
Inaccurate beneficiary status may result in the wrong transfer-limit rules being applied.
Application and API Controls
Where multiple channels or APIs initiate transfers, regulatory restrictions must be enforced consistently across all applicable processing routes.
Change Management
Updates to product rules, payment applications or transaction-processing systems can affect compliance if they are not adequately tested.
These are potential industry risk scenarios, not proven explanations for MobiKwik’s specific violation.
Key Control Question
Can the institution demonstrate that every fund transfer was processed under the correct regulatory limit, with beneficiary status and cumulative activity verified before execution?
4. MobiKwik’s Second Violation: Delayed CPFIR Fraud Reporting
The second regulatory contravention related to the delayed reporting of certain payment frauds.
MobiKwik’s exchange disclosure specifically referred to delays in submitting reports to RBI’s Central Payments Fraud Information Registry (CPFIR).
What Is CPFIR?
CPFIR is RBI’s central registry for collecting information about payment-related fraud incidents.
The system helps support regulatory oversight and payment fraud monitoring.
RBI’s circular dated 26 December 2022 provided for the migration of CPFIR reporting to DAKSH, RBI’s Advanced Supervisory Monitoring System.
The circular specifies that eligible reporting entities must submit payment fraud information within the applicable timeline.
What Is the RBI Reporting Timeline?
Under the 26 December 2022 circular, the stated timeline was:
Within 7 calendar days from the date the customer reports the fraud or the entity detects it.
The circular also requires reporting institutions to validate the authenticity and completeness of the reported fraud information before submission.
This is particularly relevant to:
- Issuer banks.
- Non-bank PPI issuers.
- Credit-card-issuing NBFCs.
The responsibility depends on the payment instrument and applicable reporting framework.
Why Reporting Delays Matter
Late reporting can weaken the reliability and timeliness of regulatory fraud intelligence.
Operational causes that institutions should assess include:
- Delayed identification of reportable cases.
- Incomplete information from customer-service or fraud investigation teams.
- Manual preparation of regulatory returns.
- Unclear ownership of reporting responsibilities.
- Missing escalation for cases approaching reporting deadlines.
- Inadequate reconciliation between internal fraud records and submitted returns.
Once again, these are potential control risks for the sector. RBI’s public announcement does not identify which specific process caused the MobiKwik reporting delays.
5. What Does This Case Reveal About Fintech Compliance Risk?
The case demonstrates why payment-system compliance requires controls operating at several levels.
A. Regulatory Compliance Must Be Embedded in Technology
A policy stating the permissible transfer limit is not sufficient.
The payment platform must enforce the limit through relevant application controls, system configurations and transaction-processing rules.
B. Transaction-Level Compliance Requires Continuous Monitoring
Periodic compliance reviews may identify exceptions after they occur.
Preventive application controls and timely exception monitoring provide stronger protection against repeated breaches.
C. Regulatory Reporting Needs Clear Accountability
Reporting obligations are time-sensitive.
Compliance teams require visibility into fraud detection dates, reporting deadlines, pending submissions and evidence of successful submission.
D. First-Line and Second-Line Responsibilities Must Be Clear
Payment Operations and Technology teams typically operate the transaction-processing controls.
Compliance and Risk functions should independently monitor adherence, challenge exceptions and coordinate escalation.
E. Internal Audit Must Evaluate Operating Effectiveness
The presence of a system rule or regulatory reporting procedure is not sufficient evidence that the control is working.
Audit testing must establish whether controls operated effectively during the review period.
6. Early Warning Indicators for PPI Compliance and Fraud Reporting
Payment institutions can monitor several indicators to identify emerging weaknesses.
| Early warning indicator | Potential concern |
| Transfers to unregistered beneficiaries approaching prescribed limits | Risk of excessive transfers |
| Monthly cumulative transfers exceeding permissible thresholds | Ineffective limit enforcement |
| Beneficiary status inconsistencies across systems | Data integrity or classification problems |
| Frequent manual overrides of payment rules | Weak control governance |
| Regulatory fraud reports approaching submission deadlines | Reporting delay risk |
| Fraud cases without assigned reporting owners | Accountability gap |
| Differences between fraud case records and CPFIR submissions | Incomplete regulatory reporting |
| Repeated reporting validation errors | Data-quality or process weaknesses |
| Unresolved high-risk audit findings | Continued compliance exposure |
These indicators should feed into a documented exception-management process.
Alerts need appropriate ownership, investigation, closure evidence and escalation.
7. Internal Audit Lessons: What Should Payment System Auditors Test?
The MobiKwik enforcement action is particularly relevant for internal auditors, IT auditors, compliance assurance teams and payment operations auditors.
A. Beneficiary Registration Controls
Auditors should verify whether the beneficiary-registration process complies with applicable RBI requirements.
Testing may include:
- Registration and authentication procedures.
- Beneficiary status changes.
- System records supporting registration.
- Payment approvals and transaction logs.
- Controls preventing unauthorised beneficiary modifications.
B. Transfer Limit Controls
Audit teams should independently calculate cumulative transfers across relevant transaction categories.
Testing should cover boundary values, month-end periods, changes in beneficiary status and multiple payment channels.
C. Fraud Reporting Timeliness
Auditors should compare the customer complaint or institutional detection date with the final CPFIR submission date.
They should also review unsuccessful submissions, pending cases, corrections and acknowledgement records.
D. Regulatory Change Management
Where RBI changes payment requirements, institutions should demonstrate that regulatory updates have been translated into approved system requirements, testing and production controls.
Practical Audit Testing Matrix
| Audit area | Suggested test | Evidence required |
| Beneficiary registration | Verify appropriate registration and authentication | Beneficiary records, verification logs |
| Transfer limits | Recalculate monthly cumulative transfers | Transaction data, rule configurations |
| Application controls | Test enforcement across transaction-processing channels | Application logs, test evidence |
| Rule changes | Examine changes to limits and beneficiary controls | Change approvals, release records |
| Fraud identification | Review reportable fraud-case identification | Fraud registers, case-management records |
| CPFIR timeliness | Compare detection dates with submission dates | Incident timestamps, DAKSH acknowledgements |
| Reporting completeness | Reconcile internal fraud cases with regulatory submissions | Fraud case records, submitted returns |
| Exception management | Verify investigation and closure of breaches | Exception logs, escalation records |
Auditors should use risk-based sampling and consider full-population data analysis for transfer-limit breaches and reporting timeliness, particularly where the required data is available electronically.
8. Regulatory Framework Relevant to the MobiKwik Case
Three regulatory references are particularly important.
RBI Master Directions on Prepaid Payment Instruments
Issued: 27 August 2021
Updated: 30 September 2026
These Directions establish requirements for PPI issuers and system participants, including permitted fund transfers, beneficiary arrangements, applicable limits and related safeguards.
Practical implication: Institutions should map regulatory restrictions directly to transaction-processing controls and maintain evidence that the rules operate consistently.
RBI Central Payments Fraud Information Registry Circular
Issued: 26 December 2022
The circular established the migration of CPFIR reporting to DAKSH and specified the reporting timeline of seven calendar days from customer reporting or institutional detection.
Practical implication: Reporting entities should maintain reliable fraud-event timestamps, validation arrangements, submission controls and regulatory acknowledgements.
Payment and Settlement Systems Act, 2007
RBI imposed the penalty under Section 30(1), read with Section 26(6), of this legislation.
Practical implication: Non-compliance with payment-system directions can result in regulatory enforcement even where the public order does not establish a corresponding customer loss.
9. Illustrative Case: How a Digital Wallet Can Breach a Cumulative Transfer Limit
Consider a hypothetical full-KYC wallet customer transferring funds to a non-pre-registered beneficiary.
Assume the applicable monthly ceiling is ₹10,000.
| Transaction | Amount | Cumulative monthly transfer |
| Transfer 1 | ₹4,000 | ₹4,000 |
| Transfer 2 | ₹3,500 | ₹7,500 |
| Proposed Transfer 3 | ₹4,000 | ₹11,500 |
Although the third transfer is individually only ₹4,000, processing it would cause the cumulative amount to exceed ₹10,000.
An effective application control should evaluate cumulative monthly activity and prevent a transaction that breaches the applicable rule.
The system should also preserve sufficient information to demonstrate why a transaction was approved or rejected.
This example is hypothetical and does not describe the actual MobiKwik transactions.
10. Practical Compliance Checklist for Banks, Fintechs and PPI Issuers
A compliance review should address the following questions.
Payment and Beneficiary Controls
- Are regulatory transfer limits mapped to all relevant products and payment channels?
- Are beneficiary-registration requirements implemented and verified?
- Are cumulative transfer limits calculated correctly?
- Are payment control exceptions identified and investigated?
Fraud Reporting
- Are reportable fraud incidents identified consistently?
- Is the date of customer reporting or institutional detection reliably recorded?
- Are CPFIR submission deadlines monitored?
- Are successful submissions supported by acknowledgement records?
- Are overdue or rejected submissions escalated?
Technology and Governance
- Are payment-rule changes independently approved and tested?
- Are relevant application controls independently assessed?
- Are compliance responsibilities clearly allocated?
- Are recurring exceptions reported to senior management?
- Are high-risk audit observations remediated within approved timelines?
11. A 90-Day Compliance Improvement Roadmap
Institutions seeking to strengthen payment compliance can adopt a structured review.
| Period | Recommended activities | Responsible functions |
| Days 1–30 | Review applicable PPI rules, transaction limits, beneficiary-registration processes and CPFIR reporting obligations | Compliance, Payment Operations |
| Days 31–60 | Test system controls, reconcile fraud records with regulatory submissions and review reporting timeliness | Technology, Fraud Risk, Compliance |
| Days 61–90 | Complete independent testing, correct material deficiencies and report residual risks to management | Internal Audit, Operational Risk, Senior Management |
These are recommended internal implementation milestones, not RBI-prescribed deadlines.
12. Questions for CROs, Compliance Heads and Audit Committees
The MobiKwik penalty provides a useful opportunity for management to assess payment compliance arrangements.
Payment Control Effectiveness
Can management demonstrate that applicable transfer limits are enforced automatically and consistently?
Regulatory Reporting Reliability
How many reportable fraud cases were submitted after the prescribed deadline during the previous 12 months?
Exception Visibility
Does senior management receive regular information about significant payment-control and regulatory reporting exceptions?
Regulatory Change Readiness
How does the institution translate amended RBI requirements into production-system controls?
Independent Assurance
Has Internal Audit independently tested beneficiary registration, cumulative transaction limits and fraud-reporting timelines?
Remediation Effectiveness
Are repeated compliance failures analysed for their underlying causes and corrective actions?
These questions are relevant to payment institutions seeking to strengthen governance and avoid regulatory findings.
13. Professional Capability Building: Payments Compliance, Fraud Risk and RegTech
The MobiKwik enforcement action illustrates the increasing importance of professionals who understand the relationship between payment systems, regulatory requirements, technology controls and fraud reporting.
Relevant competencies include:
- RBI payment-system compliance.
- PPI transaction and beneficiary controls.
- Payment fraud monitoring and reporting.
- Regulatory reporting workflows.
- Operational risk and internal control evaluation.
- IT audit and application controls.
- Compliance automation and RegTech solutions.
Professionals responsible for payment operations, fintech compliance, fraud risk, internal audit and technology governance increasingly need to understand both regulatory obligations and the systems used to implement them.
A structured RegTech or compliance training programme can support this capability by explaining how regulatory requirements are translated into automated monitoring, exception management and reporting controls.
14. Conclusion: The Penalty Is About More Than ₹9 Lakh
RBI’s penalty on One MobiKwik Systems Limited highlights two essential elements of payment-system compliance: enforcing transaction limits and reporting fraud information within prescribed timelines.
The regulatory findings do not establish a cyberattack or determine the validity of individual customer transactions.
Nevertheless, the case reinforces the importance of automated controls, regulatory change management, timely reporting and independent assurance.
For financial institutions, the lesson is clear:
Regulatory compliance is effective only when the underlying systems, processes and controls consistently deliver the outcomes required by regulation.
The key question for compliance and risk professionals is therefore not simply whether the institution has a documented regulatory compliance policy.
It is whether the institution can demonstrate, through reliable data and independent testing, that its payment controls and reporting mechanisms operate effectively every day.
Official Sources and Regulatory References
- Reserve Bank of India, 13 November 2026: RBI Imposes Monetary Penalty on One MobiKwik Systems Limited
- One MobiKwik Systems Limited, 13 November 2026: Stock Exchange Disclosure of RBI Penalty
- RBI: Master Directions on Prepaid Payment Instruments, updated 30 September 2026
- RBI, 26 December 2022: Central Payments Fraud Information Registry — Migration of Reporting to DAKSH
- Business Standard, 13 November 2026: RBI Fines MobiKwik ₹9 Lakh Over PPI Transfer and Fraud Reporting Lapses
Editorial note: This article is based on regulatory disclosures and publicly available information as of 14 November 2026. The control scenarios, audit procedures and recommendations are professional risk-management analysis and should not be interpreted as additional findings against MobiKwik.