An escrow account in payments is the ring-fenced bank account where a payment aggregator parks customer money before it reaches the merchant, and the Reserve Bank of India controls exactly what may enter and leave it.
The short answer
An escrow account holds funds that belong to someone else. In Indian payments, every non-bank payment aggregator must keep collected merchant funds in an escrow account with a scheduled commercial bank, separate from its own corporate money. Only the credits and debits the RBI lists are permitted. The account cannot be used for cash on delivery, and no interest is paid on the balance except on a defined core portion. The escrow account is what stops merchant money from becoming working capital for the aggregator.
It is a financial control with a technical dependency. The bank enforces the boundary, but the instructions that move money across it come from software the aggregator built.
On this page
What an escrow account is in payments
A generic escrow account holds money for a third party until an agreed condition is met. The payments version is narrower. When a customer pays a merchant through an aggregator, the money lands with the aggregator first. That float can be substantial, and it does not belong to the aggregator.
Before 2020, intermediaries ran this float through nodal accounts under a 2009 RBI circular. The 2020 payment aggregator guidelines replaced nodal accounts with escrow, and the Reserve Bank of India (Regulation of Payment Aggregators) Directions, 2025 carried the escrow architecture forward and tightened it.
What may go in and what may come out
The permitted list is closed. Anything not named is not allowed, and the escrow bank is expected to police it.
| Direction | What the Directions allow |
|---|---|
| Credits in | Payments collected from customers, pre-funding placed by merchants, refunds against failed or cancelled or returned transactions, and transfers received from other authorised aggregators in the same flow. |
| Debits out | Settlement to merchants, refunds to the paying customer, commission due to the aggregator, payments to other authorised aggregators in the flow, and payments made on the merchant’s own instruction. |
| Blocked | Cash on delivery collections, the aggregator’s operating costs, and any use outside the authorised aggregation business. |
Aggregators may hold one additional escrow account at a different scheduled commercial bank. Cross-border flows are further separated into inward and outward collection accounts held only with authorised dealer Category-I banks.
Settlement timing and the core portion
Settlement timelines
The 2020 rules pegged settlement to shipment, delivery or refund expiry dates. Under the 2025 Directions the aggregator and merchant set the timeline contractually, within the outer limits prescribed.
The core portion
No interest is payable on the escrow account balance. The exception is a defined core portion of the domestic balance, calculated from the lowest daily balances across preceding fortnights.
Auditor certification
A statutory auditor certificate on escrow compliance goes to the RBI quarterly, alongside a certificate from the bank holding the account.
Where else escrow accounts appear
Payment aggregation is the most visible case, not the only one. Non-bank prepaid instrument issuers hold outstanding customer balances in an escrow account with a scheduled commercial bank on the same principle: money that belongs to users must not sit on the issuer’s balance sheet. Cross-border aggregators run separate inward and outward accounts. In each case the structure answers the same question, which is what happens to customer money if the company fails.
What an escrow account does not protect against
This is the gap most teams miss. An escrow account is a legal and banking control. It ring-fences merchant funds from the aggregator’s creditors and its own spending. It does nothing about the integrity of the systems that generate settlement instructions.
| Risk the escrow account does not cover | What actually closes it |
|---|---|
| A compromised settlement or payout system issuing valid-looking debits | Multi-factor authentication on privileged access, segregation of duties, and maker-checker on payout runs |
| Altered merchant bank details, whether by an attacker or an insider | Change control with independent verification, plus data loss prevention and monitoring on merchant master records |
| An exposed or undocumented settlement API endpoint | Full API discovery and authorisation, with testing that reaches business logic |
| Reconciliation breaks discovered weeks late | Correlated logging with alerting, and an audit trail nobody can quietly edit |
| Findings surfacing first in the annual audit | Scheduled VAPT with retests, run before the auditor arrives |
The audit reaches the escrow controls
The annual system and cyber security audit that a payment aggregator files with the RBI is performed by a CERT-In empanelled auditor, and escrow operations sit squarely inside its scope. Access to the settlement system, approval workflow, logging and reconciliation all get examined. Weaknesses there become regulatory findings, not just internal ones.
How Osto gets you audit-ready
Whether you hold the escrow account or build software for someone who does, the technical controls are the same set. Osto covers them by default rather than as separate purchases. Expert-led VAPT and continuous scanning test the settlement path before an auditor does, API discovery and cloud posture management close the exposure gaps that dominate findings, and correlated logging gives you the trail an information systems auditor asks to walk.
The evidence layer is purpose-built for this. One control set answers the RBI reviewer, a payment aggregator customer’s vendor questionnaire, SOC 2 and ISO 27001 together. Osto prepares your evidence and gets you through the review. The mandated audit is performed by the empanelled auditor.
Free security assessment
Protect the systems that move the money
Osto finds and fixes what an empanelled auditor would flag in your settlement path, then holds the evidence. VAPT, cloud posture, code security, logging and compliance in one platform.
Get a free security assessment Book a platform walkthroughAudit-ready in days · RBI, SEBI and DPDP mapped · One platform, everything
Frequently asked questions
What is an escrow account in payments?
A bank account that holds customer money collected on behalf of merchants, kept separate from the collecting company’s own funds. In India, every non-bank payment aggregator must maintain one with a scheduled commercial bank, and only the credits and debits set out in the RBI Directions are permitted.
Why is an escrow account mandatory for payment aggregators?
Because the aggregator holds money that belongs to merchants and customers. Ring-fencing it in an escrow account keeps that float off the aggregator’s balance sheet, out of reach of its creditors, and unavailable as working capital. It is a consumer and merchant protection measure.
What is the difference between a nodal account and an escrow account?
Nodal accounts were the earlier arrangement under a 2009 RBI circular for payment intermediaries. The 2020 payment aggregator guidelines replaced them with escrow accounts, which carry a defined list of permitted credits and debits, bank-level oversight and periodic auditor certification. The 2025 Directions repealed the nodal account circular for most entities.
Does a payment escrow account earn interest?
Generally no. The Directions state that no interest is payable on the escrow account balance. The exception is the core portion of a domestic escrow balance, a stable minimum derived from the lowest daily balances across preceding fortnights, which the bank may move to a separate interest-bearing account. Cross-border balances do not earn interest.
Can an escrow account be used for cash on delivery?
No. The Directions explicitly bar the escrow account from being operated for cash on delivery transactions. Businesses that previously pooled cash collections through the same account have had to redesign those flows.