india-fintech git:20260920.2cbc56dA

Immutable. This exact content is served forever at /api/v1/blob/ee172df93cacf88c.

---
name: india-fintech
description: "Playbook for product decisions in Indian fintech — UPI rails, RBI regulatory frame, DPDP Act 2023, NPCI conventions, customer-money handling, Tier-1 vs Tier-2 vs Tier-3 KYC limits."
---

## Codex host binding

- Treat references to Claude slash workflows as the equivalently named Codex skill.
- Before delegating to any specialist, read the `great-pm-runtime` skill and the selected packaged role file.
- Treat "invoke", "assign", "delegate", "spawn", and source Agent-tool instructions as a required Codex `spawn_agent` call with that role and a bounded assignment.
- For the spawn tool's `task_name` or `agent_name` identifier, replace canonical role-name hyphens with underscores (`query-refiner-pm` → `query_refiner_pm`). Keep canonical names unchanged in prompts, filenames, verdict logs, and user-facing output; this is an internal identifier mapping, not a role rename.
- Store every returned agent identifier. Never call a wait tool until a spawn has returned an identifier, and wait only on identifiers returned by successful spawns.
- If `spawn_agent` is unavailable or a spawn fails, report BLOCKED; do not impersonate the specialist or wait on an empty agent set.
- Resolve bundled paths from the installed GreatPM plugin root.
- Ignore Claude-only model aliases, colors, turn limits, and tool allowlists.
- Preserve GreatPM human gates, governance, state, and reporting contracts.


# India Fintech — playbook

India fintech is a high-volume, low-margin, regulated environment. UPI
moves ~10 billion transactions/month. The same product fails for entirely
different reasons here vs the US/EU — different rails, different KYC
tiers, different consent law (DPDP, not GDPR), different fraud patterns,
different language coverage.

## 1. The rails — pick deliberately

| Rail | Use case | Reality |
|---|---|---|
| UPI (NPCI) | P2P, P2M, recurring (UPI Autopay) | Free for users; revenue-thin for builders |
| IMPS / NEFT / RTGS | Larger transfers, B2B | Slower, fee-bearing |
| Bharat Bill Payment (BBPS) | Bill payments | NPCI's centralized layer |
| Cards (NPCI RuPay + Visa/MC) | E-commerce, retail | Card tokenization mandatory (2022) |
| AEPS (Aadhaar Enabled) | Last-mile rural | KYC via Aadhaar |
| ONDC | Open commerce protocol | Newer; lighter regulatory frame |

Default for most consumer fintech: **UPI as the primary rail.** Plan
revenue around features other than transaction fees (UPI is free).

## 2. RBI regulatory frame — know your category

| Category | What it does | License needed |
|---|---|---|
| Bank | Full banking | Bank license (rare for new entrants) |
| NBFC | Lending, financing | NBFC registration |
| Payment Aggregator (PA) | Collect payments on behalf of merchants | RBI PA license (since 2020) |
| Payment Gateway (PG) | Tech provider, no merchant funds | Lighter, no PA license required |
| PSO (Payment System Operator) | Operate a payment system | PSO license |
| Account Aggregator (AA) | Consent-based data flow | AA framework (NBFC-AA license) |
| TReDS / NeSL / CIC | Specialized infra | Specific licenses |

**The line:** if you touch customer funds at any point (custody, even
T+0 transit), PA license likely applies. If you're tech-only and money
flows directly bank-to-bank, PG framework is lighter.

## 3. DPDP Act 2023 — India's consent law

Different from GDPR. Key differences PMs must internalize:

- **Notice + consent are pillar.** Notice must be in 22 scheduled
  languages on demand (not just English/Hindi).
- **Verifiable parental consent for under-18** (vs GDPR-K's 13-16 range).
- **Significant Data Fiduciary (SDF) designation** triggers stricter
  obligations — your platform may get designated if you process
  significant volume.
- **Data Principal rights**: access, correction, erasure, grievance.
- **Cross-border transfer**: government can restrict to specific
  countries. Don't assume EU-style freedom.
- **Penalties**: up to ₹250 crore per breach.

**PM rule of thumb**: design the consent UX once for DPDP; it'll satisfy
most other regimes.

## 4. KYC tiers — design product flow around them

| Tier | Limit | What's required | UX implication |
|---|---|---|---|
| Min-KYC | ₹10K/mo wallet, ₹1L/year | Aadhaar OTP + PAN | Fast onboarding (minutes) |
| Full KYC | Higher limits | Video KYC OR in-person | Slow (hours to days) |
| Re-KYC | Periodic | Per RBI re-KYC schedule | Friction; design re-engagement |

**PM rule**: front-load Min-KYC, save Full-KYC for the moment user
needs the higher limit. Don't gate first value on Full-KYC.

## 5. India-specific patterns to design for

- **Vernacular (22 languages)**: not just translation; transliteration
  affects search, merchant matching, classification. Hindi-Latin mixed
  is the norm.
- **Low-data, intermittent connectivity**: design for it. Heavy first-load
  + offline-capable thereafter beats always-online.
- **Cash-out is a feature**: most consumers want to extract value as cash
  somewhere. Pure-digital is harder than it looks.
- **Festival cycles**: October-November (Diwali) drives 30%+ of consumer
  spending. Plan launches around it, not against it.
- **Tier-2 / Tier-3 cities**: 70% of population, different UX (number-pad
  preferred, voice-first growing).
- **Fraud patterns**: UPI phishing, SIM-swap, social engineering
  ("KYC update required"). RBI mandates 2FA + transaction limits.

## 6. The Account Aggregator (AA) framework

If your product needs financial data from other banks (for credit,
budgeting, etc.):

- **Consent-based data flow** via licensed AA (Finvu, Onemoney, Cookiejar,
  etc.).
- **Time-bound consent** (max 1 year, user-revocable).
- **Specific data types** (bank txn, mutual fund, insurance, GST).
- **No data resale** — strict.

For products like Acme that ingest bank data: **AA is the right path
long-term**, even if you start with Gmail-OCR + CSV.

## 7. Operational realities to plan for

- **Settlement cycles**: T+0 for UPI, T+1 for cards. Reconcile daily.
- **Chargebacks**: card chargeback risk; UPI mostly final.
- **Customer support load**: WhatsApp + IVR are the channels users use.
  Email is not a real channel for the mass market.
- **Founder visibility**: RBI ombudsman can summon founders; have
  governance and grievance officer in place.

## 8. When great-pm agents consume this skill

| Agent | What it pulls from here |
|---|---|
| fintech-pm-reviewer | The whole frame — jurisdictional scope + KYC tiers + DPDP |
| ai-product-strategist | Data moat re Indian fintech; AA framework; vernacular |
| data-strategist | DPDP scope; AA framework; cross-border restriction |
| spec-writer | Consent UX; DPDP-compliant flows; KYC tier design |
| ai-launch-strategist | Festival cycle planning; vernacular launch copy |

## 9. References (verify currency before relying)

- RBI Master Directions on PA/PG (current version on rbi.org.in)
- DPDP Act 2023 + Rules (when notified)
- NPCI guidelines (npci.org.in)
- RBI tokenization mandate (Sep 2022)
- Account Aggregator: sahamati.org.in (industry org)

## 10. The honesty filter

If a product strategy assumes "we'll be like Stripe" or "we'll be like
PhonePe", ask: which specific Indian regulatory pivot did they survive?
The answer reveals whether the strategy actually grappled with India's
specifics.