Resources Categories

Back

INDUSTRY FACT FILE · PAYMENTS & TRANSACTION PROCESSING

Main Products and Services in Payments and Transaction Processing

What corporate and enterprise companies in the sector sell, the systems that deliver each offering, and where those systems create cybersecurity and compliance exposure.

In this document

1. How the sector earns its money

2. Products and services by player type

3. Payment products in detail

4. Lending, data and embedded-finance services

5. The systems behind the products

6. Product trends that change the attack surface

7. Mapping products to Codec Networks engagements

1. How the sector earns its money

Payments and fintech companies monetise speed, reach and convenience. Their revenue comes from a mix of transaction fees, merchant services, software subscriptions and—through regulated lending partners—credit products. Understanding the revenue model matters for security: whatever generates revenue is also what an attacker, a regulator or a partner bank will look at first.

Revenue stream	How it works	Security relevance
Merchant discount and platform fees	Fees charged to merchants for collecting card, net-banking, wallet and other payments; value-added platform fees	Checkout, payment-page and API integrity directly protect this revenue
Interchange and issuer income	Card and PPI issuers earn a share of transaction fees	Account takeover and fraud losses erode issuer margins
Software and SaaS fees	Subscription billing, payouts, reconciliation, invoicing and risk tools sold to businesses	Multi-tenant platforms concentrate many clients' data and credentials
Lending economics (through regulated lenders)	Interest, processing fees and service fees on loans originated through LSPs and DLAs	Borrower data, KYC documents and bank statements are high-value targets
Float and settlement services	Escrow-based settlement, payouts and cash-management services	Settlement-file and escrow integrity are critical controls

Zero-MDR products

Merchant discount rate (MDR) on RuPay debit cards and BHIM-UPI transactions has been set at zero since January 2020. Because UPI carries most retail transaction volume but earns little direct fee income, companies tend to fund security from adjacent revenue lines—which makes efficient, well-prioritised security spending especially important.

2. Products and services by player type

Player type	Main products	Main services
Payment aggregators (PA-O / PA-P / PA-CB)	Online checkout, payment links, payment pages, QR and soundbox acceptance, POS and SoftPOS acceptance, cross-border collections	Merchant onboarding and KYC, settlement through escrow, payouts, refunds and dispute handling, reconciliation, risk and fraud tools
Payment gateways	Gateway APIs and SDKs, hosted payment pages, routing engines	Transaction routing, tokenised card handling for merchants, integration support
PPI issuers and wallets	Full-KYC and small PPIs, wallets, prepaid and gift cards, transit (NCMC) cards	Loading, P2P and P2M transfers, merchant payments, UPI interoperability for full-KYC PPIs, customer grievance handling
UPI apps (TPAPs) and PSP banks	Consumer and merchant UPI apps, UPI Lite, UPI AutoPay mandates, UPI 123PAY for feature phones, UPI Circle	P2P and P2M payments, mandate management, credit lines and RuPay credit cards on UPI, dispute resolution
Payment system operators	UPI, IMPS, RuPay, NACH, AePS, NETC FASTag, BBPS, card networks, ATM networks, TReDS	Switching, clearing and settlement, dispute frameworks, fraud-risk services, certification of participants
Processors and switch providers	Card issuing and acquiring processing, UPI switches, tokenisation and HSM services	Processing as a service, BIN sponsorship programmes with banks, reconciliation and settlement processing
Digital lending platforms	Personal, consumer-durable, MSME and merchant loans; credit lines; multi-lender marketplaces	Lead generation, underwriting support, KYC, collections support and servicing as LSPs for banks and NBFCs
Account Aggregators	Consent manager platform for financial information sharing	Consent collection and data-flow orchestration between FIPs and FIUs
Cross-border and remittance players	Inward and outward collections, export payments, inward remittances	FX conversion through AD banks, compliance screening, settlement
Fintech infrastructure providers	KYC, V-CIP, e-sign, bank-statement analysis, fraud and identity APIs, banking-as-a-service platforms	API access, managed onboarding, data enrichment and risk scoring

3. Payment products in detail

3.1 UPI and real-time payments

UPI is the backbone of Indian retail payments, processing 24.51 billion transactions worth ₹29.82 lakh crore in August 2026 according to NPCI data. Products built on UPI include person-to-person and person-to-merchant payments, QR-code acceptance, UPI Lite for small-value payments, AutoPay mandates for recurring payments, UPI 123PAY for feature phones, credit lines and RuPay credit cards linked to UPI, and UPI Circle for delegated payments. IMPS remains important for instant account-to-account transfers.

3.2 Card products

Debit, credit and prepaid cards run on domestic and international card networks. Since 1 October 2022, online merchants and aggregators may not store customers' actual card data; card-on-file tokenisation replaces stored card numbers with tokens. RBI's 2025 PA Master Direction reinforces that card credentials must not be stored in any database or server accessible to the merchant, and that merchant infrastructure must comply with PCI DSS and PCI SSF where applicable.

3.3 Prepaid payment instruments

PPIs include wallets, prepaid cards and gift instruments issued by banks and authorised non-banks. Full-KYC PPIs can interoperate through UPI and card networks. The 2021 PPI Master Directions (as updated) remain in force; RBI released a draft replacement Master Direction on 22 April 2026 for consultation, which proposes simplified categories and tighter controls. Issuers should track the final text closely.

3.4 Bills, mandates and transit

Bharat Bill Payment System (BBPS) operating units collect utility, education, insurance and loan repayments. NACH and e-mandates support recurring collections. NETC FASTag and NCMC-based cards serve tolls and transit. These products depend on high availability and reliable reconciliation, so outages and settlement errors quickly become customer-facing incidents.

3.5 Merchant acceptance and value-added services

Aggregators and gateways compete on acceptance breadth and merchant tooling: payment links, subscription billing, payouts, smart routing, dynamic QR, soundboxes, POS terminals, SoftPOS on smartphones, reconciliation dashboards, chargeback management and risk scoring. Each tool adds an interface—and an attack surface—to the merchant relationship.

4. Lending, data and embedded-finance services

Fintech lending in India is delivered through regulated entities (banks and NBFCs) working with lending service providers and digital lending apps. The RBI (Digital Lending) Directions, 2025, effective 8 May 2025, consolidate the rules: lenders must report the DLAs they use on RBI's CIMS portal (from 15 June 2025), and LSPs operating multi-lender platforms must display all matching offers transparently (from 1 November 2025).

Digital loans: personal, consumer-durable, education, MSME and merchant working-capital loans originated through apps and partner platforms.
Credit lines and embedded credit: pre-approved credit lines, pay-later-style offerings by regulated lenders and credit on UPI.
Account Aggregator-based underwriting: consented access to bank statements and financial records for faster credit decisions.
Embedded finance and banking-as-a-service: APIs that let non-financial platforms offer payments, accounts, cards or loans with a regulated partner.
Supply-chain finance: invoice discounting for MSMEs on TReDS platforms and partner-lender programmes.

5. The systems behind the products

Every product rests on a stack of systems. Mapping products to systems is the first step in scoping any security assessment, because it shows which applications, interfaces and suppliers carry the most business risk.

Title: Figure 2: The digital payment lifecycle — systems involved at each stage and the attacks that typically target them. - Description: Figure 2: The digital payment lifecycle — systems involved at each stage and the attacks that typically target them.

Figure 2: The digital payment lifecycle — systems involved at each stage and the attacks that typically target them.

Product / service	Systems that deliver it	Key cyber and compliance touchpoints
Online checkout and payment links	Hosted payment pages, merchant plug-ins, gateway APIs, tokenisation vault, risk engine	PCI DSS (incl. payment-page script controls), PA baseline technology recommendations, VAPT
UPI app	Mobile app, device-binding service, PSP bank integration, NPCI interfaces, fraud engine	Mobile app security, authentication rules, RBI 2024 mobile-security controls, NPCI guidelines
Wallet / PPI	Wallet ledger, KYC and V-CIP stack, load and transfer services, card issuing processor	PPI directions, cooling periods after loading, fraud monitoring, data localisation
POS / SoftPOS acceptance	Terminals, terminal management system, acquiring host, key management	PCI-PTS and PCI-P2PE validated terminals (RBI 2024 directions), PCI DSS
Settlement and payouts	Escrow management, settlement engine, bank APIs, reconciliation system	Escrow rules under the PA Master Direction, privileged-access control, file integrity
Digital lending app	DLA, LSP platform, lender LOS/LMS integrations, AA connector, KFS generator	Digital Lending Directions, DPDP Act, API security, data minimisation
Account Aggregator flows	Consent manager, FIP and FIU gateways, encryption and key services	Consent integrity, encryption, API security, audit trails
Cross-border collections	PA-CB platform, FX and AD-bank integrations, screening tools	PA-CB requirements, PMLA/FIU-IND reporting, third-party risk

6. Product trends that change the attack surface

Trend	What is changing	Security implication
New authentication factors	RBI's Authentication Directions, 2025 (effective 1 April 2026) require two factors with at least one dynamic factor, and allow alternatives to SMS OTP such as biometrics and device-bound tokens	Authentication flows must be re-tested; device-binding and biometric integrity become critical controls
Tokenisation everywhere	Card-on-file, device and in-app tokens replace stored card numbers	Token vaults, HSMs and token-provisioning APIs become high-value targets
Credit on UPI and embedded credit	Credit lines and RuPay credit cards linked to UPI; lending embedded in commerce apps	Account takeover now exposes credit limits, not just balances
SoftPOS and app-based acceptance	Smartphones replace dedicated terminals for small merchants	Mobile device security and app attestation replace hardware tamper resistance
AI in onboarding, credit and fraud	AI-driven KYC checks, underwriting and fraud scoring	Model manipulation, deepfake-assisted V-CIP and data-leakage risks need specialist testing
Cloud-native platforms and open APIs	Microservices, Kubernetes and partner APIs at every layer	Misconfiguration, secrets exposure and broken authorisation dominate real-world findings

7. Mapping products to Codec Networks engagements

If the company offers…	Recommended starting engagement
Online checkout, payment pages or SDKs	Payment-page security and PCI DSS readiness, web and API VAPT, e-skimming monitoring
A UPI or wallet app	Mobile application security testing, authentication and device-binding review, fraud-scenario testing
Merchant acquiring (online or physical)	Merchant onboarding controls review, settlement and escrow process audit, CERT-In empanelled cyber audit
Network, switch or processing services	Resilience and DR assessment, SOC maturity review, privileged-access audit, red teaming
Digital lending or AA-based services	API security testing, DPDP privacy programme, data-flow mapping, rogue-app and brand monitoring
Cross-border payments	Third-party and partner assessments, logging and monitoring assurance, transaction-monitoring controls review
Fintech infrastructure or SaaS	Secure SDLC and DevSecOps review, SOC 2 / ISO 27001 readiness, tenant-isolation testing

Talk to Codec Networks

Contact

Codec Networks Pvt. Ltd.

New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001

Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana

Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124

Email: mktg@codecnetworks.com Web: www.codecnetworks.com

Note: Product descriptions are general and based on public information available as of October 2026. Product availability, limits and features are governed by RBI directions and NPCI rules, which change frequently. Confirm current requirements against official circulars.