Merchants using PayU in India may receive an email, dashboard notification, or communication from their account manager informing them that additional KYC (Know Your Customer) verification is pending.

In one such communication sent to merchants, PayU has asked affected merchants to log in to their PayU Dashboard, check the KYC updation section, and submit the additional documents requested there. The communication specifies September 1, 2026 as the completion deadline for the merchant concerned.

This should not simply be treated as an ordinary promotional email. A merchant whose dashboard actually shows pending KYC requirements should review and complete them promptly.

At the same time, merchants should follow good cybersecurity practices and should preferably access the PayU Dashboard independently rather than blindly following links contained in an email.

1. Why Is PayU Asking Merchants for Additional KYC?

Payment gateways and payment aggregators operate in a regulated financial environment in India.

RBI's regulatory framework for Payment Aggregators includes requirements concerning merchant onboarding, KYC/AML controls, due diligence, fraud prevention, security and monitoring. Payment Aggregators are expected to conduct checks on merchants rather than treating merchant onboarding as merely a self-declaration exercise.

RBI has also continued updating its broader KYC framework. For example, the Reserve Bank of India issued amendments to its KYC Directions in June 2025.

Therefore, a payment aggregator may need to obtain updated or additional information from existing merchants as part of compliance, risk management, periodic verification or changes in its merchant due-diligence processes.

An additional KYC request does not necessarily mean that something is wrong with the merchant's account. It can simply mean that additional information or updated documentation is required.

2. What Does "Additional KYC Pending" Mean?

Additional KYC generally means that the merchant's earlier verification is no longer sufficient for the current verification requirement, or that PayU requires additional information to complete or refresh its records.

For example, the payment provider may need to reconfirm:

• identity of the merchant or proprietor;
• legal name of the business;
• constitution of the business;
• registered or operating address;
• PAN details;
• GST details, where applicable;
• bank account ownership;
• authorised signatory;
• directors or partners;
• beneficial ownership;
• nature of business;
• merchant website or application;
• products and services being sold;
• business activity; or
• other risk and compliance information.

The exact requirement can differ from one merchant to another.

Do not assume that another PayU merchant will be asked for exactly the same documents.

3. Why Does RBI Compliance Matter to Payment Aggregators?

Payment aggregators sit between customers, merchants and the banking/payment ecosystem.

RBI's regulatory framework places significant emphasis on merchant due diligence. The framework requires Payment Aggregators to conduct merchant background and antecedent checks and to ensure compliance with applicable KYC/AML requirements during merchant onboarding.

RBI has also specifically proposed strengthening Payment Aggregator regulation in areas including KYC and merchant due diligence as India's digital payment ecosystem has expanded.

The objective is broader than simply collecting PAN or bank details.

The compliance ecosystem is intended to help reduce risks such as:

• fraudulent merchants;
• identity misuse;
• fake businesses;
• prohibited products or services;
• money laundering;
• misuse of payment infrastructure;
• unauthorised collection of customer payments;
• incorrect settlement accounts; and
• other financial and operational risks.

4. Merchant Due Diligence Is More Than Basic KYC

This is an important distinction.

KYC generally focuses on identifying and verifying the person or entity.

Merchant Due Diligence can go considerably further.

A payment aggregator may evaluate the merchant's:

• business identity;
• ownership structure;
• website;
• products/services;
• contact information;
• refund policy;
• privacy policy;
• terms and conditions;
• business model;
• transaction pattern;
• digital footprint; and
• overall risk profile.

RBI's Payment Aggregator framework specifically discusses merchant background checks and website authenticity/security checks.

Therefore, having submitted KYC documents when the account was originally opened does not necessarily mean that the merchant will never be asked for additional information.

5. What Should You Do After Receiving a PayU Additional KYC Email?

The safest approach is to independently verify the requirement.

Step 1 – Do Not Immediately Click an Email Link

Even when an email looks genuine, avoid making a habit of entering financial-service credentials through links received by email.

Instead:

1. Open your web browser.
2. Manually visit the official PayU website/dashboard.
3. Log in using your normal credentials.
4. Check the KYC, Profile, Account, Compliance or verification section.

If the same additional KYC requirement appears inside the authenticated dashboard, that provides much stronger confirmation that action is required.

6. Check Exactly What PayU Is Requesting

After logging in, inspect the pending KYC requirement carefully.

The dashboard may indicate:

Pending

A document or verification step has not yet been submitted.

Under Review

The information has been submitted and is being reviewed.

Rejected

A submitted document did not satisfy the verification requirement.

Additional Information Required

The compliance team requires further documentation or clarification.

Verified/Completed

The relevant verification has been accepted.

The wording can change as PayU updates its interface.

7. Documents That May Be Requested

The actual documents depend on the legal constitution and risk profile of the merchant.

Possible examples include:

For a Sole Proprietorship

PayU may potentially request documents such as:

• PAN of proprietor;
• Aadhaar or another accepted identity/address document, where applicable;
• GST registration;
• business registration proof;
• cancelled cheque;
• bank statement;
• business address proof;
• shop/establishment registration;
• Udyam registration;
• business licence; or
• other evidence establishing business activity.

RBI's regulatory handbook notes that CDD for a sole proprietary firm includes CDD of the proprietor and business/activity documentation.

For a Partnership Firm

Possible requirements can include:

• PAN of firm;
• partnership deed;
• registration certificate, where applicable;
• partners' KYC;
• authorised signatory details;
• GST certificate;
• bank proof; and
• business address proof.

For an LLP

Possible documents may include:

• LLP incorporation certificate;
• LLP agreement;
• PAN;
• GST registration;
• designated partner information;
• beneficial ownership information;
• authorised signatory documentation; and
• bank account proof.

For a Private/Public Limited Company

Requirements may potentially include:

• Certificate of Incorporation;
• company PAN;
• GST certificate;
• registered office proof;
• directors' information;
• authorised signatory information;
• beneficial ownership information;
• bank account proof;
• constitutional documents; and
• board resolution/authorisation where required.

These are examples only. Upload the documents actually requested in your PayU Dashboard rather than uploading unnecessary documents.

8. Beneficial Ownership Can Be Important

For legal entities, KYC is not necessarily limited to verifying the company name.

Financial compliance processes can require identification of the individuals who ultimately own or control an entity.

This is commonly known as Beneficial Owner or Ultimate Beneficial Owner (UBO) identification.

Accordingly, a company, LLP, partnership or other entity may be asked for information concerning:

• shareholders;
• partners;
• directors;
• designated partners;
• authorised signatories; or
• ultimate beneficial owners.

The requirement will depend on the entity and applicable compliance rules.

9. Check Whether Your Business Details Match

One of the most important precautions before uploading documents is to check consistency.

For example:

Business Name

The business name entered in PayU should correspond appropriately with the supporting registration records.

PAN

Make sure the PAN belongs to the correct person/entity based on the constitution of the business.

Bank Account

Settlement account details should belong to the appropriate merchant/entity as required by PayU.

GST

If GST registration is provided, check the GSTIN and legal/trade name.

Address

Ensure that the address entered in the PayU account can be supported by the documents being submitted.

Website

Your website should accurately represent the business for which the payment gateway is being used.

Significant inconsistencies can trigger additional verification.

10. Your Website Can Also Be Part of Merchant Verification

Many merchants assume that KYC is purely document-based.

That is not always the case.

RBI's Payment Aggregator framework discusses merchant website checks for authenticity and security and indicates that merchant websites should appropriately disclose service terms and timelines relating to returns/refunds.

Accordingly, merchants operating an e-commerce or service website should consider maintaining clearly visible pages such as:

• About Us;
• Contact Us;
• Privacy Policy;
• Terms & Conditions;
• Cancellation Policy;
• Refund Policy;
• Shipping/Delivery Policy, where applicable;
• product/service descriptions;
• pricing information where appropriate; and
• business contact information.

The exact pages needed depend on the business model and PayU's current onboarding/compliance requirements.

11. What If the Website Has Changed Since PayU Was Activated?

If your business website, domain, products, services or business model has materially changed since the payment gateway account was originally approved, review your PayU merchant profile.

For example, if the gateway was approved for:

ABC Software Services

but the website now primarily sells unrelated products, the payment provider may require additional verification.

Similarly, if you changed:

• domain;
• legal entity;
• bank account;
• GSTIN;
• registered address;
• business category;
• products/services;
• directors/partners; or
• ownership,

the KYC profile may need updating.

12. What If PayU Rejects a Document?

Do not repeatedly upload the same document without checking the rejection reason.

Common practical causes can include:

• blurred scan;
• cropped document;
• unreadable PAN;
• expired document;
• incorrect business name;
• incorrect entity document;
• bank account mismatch;
• missing page;
• password-protected PDF;
• unsupported file format;
• oversized file;
• incomplete partnership deed;
• incomplete incorporation documentation;
• address mismatch; or
• details entered in the dashboard not matching the uploaded document.

Read the exact error shown by PayU before taking corrective action.

13. Take Screenshots of Errors

The PayU communication specifically advises merchants experiencing an issue or error during KYC to provide an error screenshot or screen recording to support.

This is useful because the support team can see:

• the exact error message;
• the page on which it occurred;
• which verification stage failed; and
• potentially whether the issue is technical or document-related.

When recording or capturing screenshots, avoid unnecessarily exposing passwords, OTPs, full card details or other highly sensitive information.

14. Security Warning – Beware of Fake PayU KYC Emails

KYC deadlines are attractive themes for phishing attacks because they create urgency.

An attacker may send messages such as:

"Your PayU KYC will expire today."

"Your settlement has been blocked."

"Complete KYC immediately."

"Merchant account will be terminated."

The victim may then be directed to a fake login page designed to steal credentials.

Safer Method

Instead of following an unexpected link:

Open the PayU website/dashboard yourself and verify the notification after signing in.

Never provide:

• PayU password;
• banking password;
• debit/credit card PIN;
• CVV;
• UPI PIN;
• OTP;
• remote-access permission; or
• unnecessary financial credentials

to someone merely because they claim to be from payment-gateway support.

15. Verify Support Communication Carefully

The supplied merchant communication lists care@payu.in as a contact point and provides PayU personnel addresses using the @payu.in domain.

However, the sender's display name alone is not proof that an email is genuine. Email sender names can be spoofed.

When in doubt, use contact/support information available through the authenticated PayU Dashboard or official PayU channels rather than relying solely on details contained in an unexpected email.

16. Why Should Merchants Not Wait Until the Deadline?

The communication advises merchants not to wait until the deadline.

That is sensible operational advice.

Suppose you submit the KYC on the last day and PayU rejects one document because:

• it is unclear;
• the address does not match;
• a document is incomplete;
• additional UBO information is required; or
• the dashboard encounters a technical problem.

You may have little time left to resolve the issue.

Therefore, if your authenticated PayU Dashboard confirms that additional KYC is pending, completing it well before the stated deadline is advisable.

17. What Happens If Additional KYC Is Not Completed?

The exact consequences depend on PayU's applicable terms, the merchant's account status and regulatory/compliance requirements.

Potential restrictions in payment systems can include limitations relating to:

• payment acceptance;
• settlements;
• account functionality;
• transaction processing;
• merchant services; or
• continued use of the payment gateway.

Do not assume that a specific restriction will automatically occur on a particular date unless PayU explicitly confirms it for your merchant account.

If your KYC cannot be completed before the stated deadline, contact PayU support and obtain clarification regarding your account.

18. Does Existing KYC Mean You Can Ignore Additional KYC?

No.

If PayU previously verified your account but your authenticated dashboard now requests additional information, the earlier KYC should not be treated as automatically satisfying the new requirement.

Compliance information can require updating due to:

• regulatory changes;
• periodic review;
• changes in merchant details;
• enhanced due diligence;
• risk-profile changes;
• updated documentation standards; or
• internal compliance reviews.

19. Is This the Same as Customer KYC at a Bank?

Not exactly.

A merchant payment-gateway account involves business and merchant due diligence in addition to identification.

A payment aggregator may need to understand:

Who are you?

What business do you operate?

Who owns or controls the business?

Where are payments being collected?

What products or services are being sold?

Where are settlements being made?

Does the merchant's online presence correspond with the declared business?

This makes merchant verification broader than simply uploading an identity document.

20. RBI and Payment Aggregator Regulation

RBI's regulatory approach toward Payment Aggregators has evolved significantly.

The regulatory framework covers areas including:

• authorisation;
• governance;
• merchant onboarding;
• KYC/AML/CFT safeguards;
• settlement;
• escrow accounts;
• grievance redressal;
• fraud prevention;
• information security; and
• merchant due diligence.

RBI has also brought Payment Aggregator–Cross Border entities into a dedicated regulatory framework for cross-border import/export payment transactions.

This illustrates the increasingly regulated nature of India's payment aggregation ecosystem.

21. KYC, AML and CFT – What Do These Terms Mean?

KYC – Know Your Customer

Processes used to establish and verify identity and relevant customer/entity information.

AML – Anti-Money Laundering

Controls intended to prevent financial infrastructure from being used for laundering illegally obtained funds.

CFT – Combating Financing of Terrorism

Controls intended to prevent financial systems from being used for terrorist financing.

RBI's Payment Aggregator framework links Payment Aggregator safeguards with applicable KYC/AML/CFT requirements and the Prevention of Money Laundering framework.

22. Merchant KYC Checklist

Before starting the additional KYC process, keep the following information ready as applicable:

• PayU merchant login access

• PAN

• GST registration certificate

• business registration documents

• proprietor/partner/director information

• authorised signatory documents

• bank account proof

• cancelled cheque

• recent bank statement if requested

• registered/operating address proof

• incorporation certificate where applicable

• partnership deed where applicable

• LLP agreement where applicable

• beneficial owner information where applicable

• functional business website

• privacy policy

• terms and conditions

• refund/cancellation policy

• contact information

• clear scanned copies of requested documents

Do not submit every item merely because it appears on this checklist. Follow the document list shown for your particular PayU merchant account.

Frequently Asked Questions (FAQ)

Q1. I have already completed PayU KYC. Why am I being asked again?

Existing merchants can be asked for updated or additional information due to compliance reviews, changed documentation requirements, merchant-profile changes or enhanced due diligence.

Q2. Is additional PayU KYC mandatory?

If your authenticated PayU Dashboard identifies additional KYC as required for your merchant account, you should treat it as a compliance requirement and complete the requested steps or obtain clarification directly from PayU.

Q3. What is the deadline mentioned in this PayU communication?

The supplied communication asks the affected merchant to complete KYC by September 1, 2026.

This deadline should be verified against the notification shown in your own PayU Dashboard because account-specific requirements may differ.

Q4. Is September 1, 2026 an RBI deadline for every merchant in India?

Do not automatically interpret an email's stated merchant deadline as a universal RBI deadline applying identically to every payment-gateway merchant.

RBI establishes regulatory obligations, while payment aggregators may implement their own merchant-level compliance timelines to meet those obligations.

The September 1 date discussed here comes from the supplied PayU merchant communication.

Q5. Should I click the KYC link in the email?

A safer approach is to independently open PayU's official website/dashboard and log in normally.

Q6. Can PayU ask for KYC even when my payment gateway is working?

Yes. Current account functionality does not necessarily mean that no compliance update is pending.

Q7. Can PayU ask for PAN again?

Potentially yes, particularly if verification, updated information or additional due diligence is required.

Q8. Can PayU request bank proof?

Yes, settlement-account ownership and merchant/entity verification can be relevant to payment-gateway compliance.

Q9. Can PayU ask for GST documents?

Depending on the merchant and applicable requirements, GST documentation may be requested.

Q10. What if my business is not registered under GST?

Do not upload an unrelated or incorrect GST document. Follow the PayU dashboard instructions for your business type and contact PayU if the workflow incorrectly assumes that GST registration is mandatory for your case.

Q11. My document was rejected. What should I do?

Read the rejection reason carefully, correct the problem and resubmit the appropriate document. If the reason is unclear, capture the error and contact PayU support.

Q12. Should I send PAN, Aadhaar or bank documents over ordinary email?

Where possible, sensitive KYC documents should be submitted through the authenticated KYC/document-upload facility specified by the payment provider. If support specifically asks for documents by another method, verify the request through an official channel first.

Q13. Can a fake email use a real PayU employee's name?

Yes. Display names and even apparent sender information can be manipulated. Verify important requests through the authenticated PayU Dashboard.

Q14. What if there is no pending KYC shown after I log in?

Do not upload documents through an unverified external link. Contact PayU through its official support channel and ask them to confirm whether additional KYC is actually required for your Merchant ID.

Q15. Should I wait until August 31 to complete it?

No. If the requirement is confirmed, early completion gives you time to correct rejected documents or technical errors.

Q16. Does KYC guarantee that my PayU account will never be reviewed again?

No. Financial-service providers can perform ongoing and periodic due diligence.

Q17. Can my website be checked during merchant verification?

Yes. Merchant website authenticity, security and business information can form part of payment-aggregator due diligence.

Q18. Why does PayU need to know what I sell?

Payment aggregators need to assess the nature and risk of merchant activity and help prevent payment infrastructure from being used for prohibited, fraudulent or misrepresented businesses.

Q19. Can ownership details be requested?

Yes. Depending on the entity and applicable requirements, beneficial-owner, partner, director or authorised-person information may be relevant.

Q20. What should I do if the PayU KYC portal shows a technical error?

Take a screenshot or screen recording showing the error, note the approximate date/time and the step at which it occurred, and contact PayU support through a verified official channel.

Important Security Recommendation

Whenever you receive a KYC, banking, payment gateway, GST, income-tax or financial-account verification email containing an urgent deadline, follow one simple security principle:

Do not allow the email itself to become your proof of authenticity.

Independently open the official service, log in and confirm whether the same requirement appears inside your authenticated account.

This single practice can significantly reduce the risk of credential-phishing attacks.

Conclusion

PayU's additional KYC process should be viewed as part of the broader compliance and merchant due-diligence environment surrounding India's digital payment ecosystem.

RBI's Payment Aggregator framework places obligations around merchant onboarding, KYC/AML safeguards, due diligence, security and ongoing risk management.

If you have received a PayU communication stating that additional KYC is pending and specifying September 1, 2026, first verify the requirement directly inside your PayU Dashboard. If confirmed, check the exact documents requested, ensure that business, PAN, GST, bank and ownership information is consistent, and submit the required information well before the deadline.

Most importantly, never provide passwords, OTPs, UPI PINs or banking credentials merely because an email claims that urgent KYC verification is required.

Disclaimer

This article is provided for general information, technical awareness and educational purposes only. Payment gateway requirements, RBI regulations, KYC procedures, documentation requirements, deadlines and PayU policies can change over time and can also differ depending on the merchant's legal constitution, business category and risk profile.

The September 1, 2026 deadline discussed in this article is based on the PayU merchant communication supplied for this case and should not be interpreted as a universal deadline applicable to every PayU merchant or every payment aggregator in India.

Before taking compliance, legal, taxation, banking or financial action, merchants should verify the latest requirements directly through their PayU Dashboard, PayU's official support channels, RBI notifications and, where appropriate, their Chartered Accountant, Company Secretary, legal adviser or compliance professional.

#Tags

#PayU #PayUKYC #PayUIndia #PayUMerchant #AdditionalKYC #KYCUpdate #KYC2026 #MerchantKYC #PaymentGateway #PaymentGatewayIndia #PaymentAggregator #RBI #RBICompliance #RBIKYC #DigitalPayments #DigitalPaymentsIndia #MerchantVerification #BusinessVerification #KYCCompliance #AML #CFT #CustomerDueDiligence #MerchantDueDiligence #PayUCompliance #PayUDashboard #PayUSupport #PayUKYCUpdate #PayUKYCPending #PaymentCompliance #FintechIndia #IndianFintech #OnlinePayments #OnlineBusiness #EcommerceIndia #BusinessKYC #UBO #BeneficialOwner #PANVerification #GSTVerification #BankVerification #CyberSecurity #PhishingAwareness #EmailSecurity #KYCScam #PaymentSecurity #MerchantSecurity #RBIRegulations #PaymentAggregatorKYC #FinancialCompliance #SecurePayments