Banking & Fintech Acronyms in India: PSS, AUA, KUA, NPCI & More

India's digital-payments and banking ecosystem runs on a dense alphabet soup of acronyms — PSS, AUA, KUA, NPCI, UPI, PA, PG and more. For anyone working on compliance, security, or audits in BFSI and fintech, knowing exactly what these mean (and which regulator owns them) is the difference between a smooth assessment and a confused one. This glossary explains the ones that come up most, in plain English, with why each matters for security and compliance.

PSS stands for Payment and Settlement Systems. In Indian banking the term traces to the Payment and Settlement Systems Act, 2007 (the "PSS Act"), under which the Reserve Bank of India (RBI) regulates and supervises payment systems in the country. Any entity operating a payment system — from card networks to wallets to UPI apps — does so under authorisation tied to the PSS Act. For compliance teams, "PSS" is shorthand for the RBI-regulated payments perimeter, which brings obligations like the Digital Payment Security Controls and the annual System Audit Report (SAR).

AUA stands for Authentication User Agency. In the Aadhaar ecosystem run by UIDAI, an AUA is an entity that uses Aadhaar authentication to verify the identity of its customers (for example, during onboarding or transactions). AUAs connect to UIDAI's authentication services through an ASA (Authentication Service Agency). Because AUAs handle Aadhaar-linked authentication, they fall under strict UIDAI security and audit requirements.

KUA stands for KYC User Agency. A KUA is an AUA that is additionally permitted to use Aadhaar e-KYC — i.e., to fetch a customer's demographic (and where permitted, photo) details from UIDAI for Know Your Customer purposes, with consent. Every KUA is an AUA, but not every AUA is a KUA. KUAs carry the heaviest data-protection expectations because they process Aadhaar e-KYC data, making security audits and data-handling controls essential.

ASA stands for Authentication Service Agency. An ASA is an entity with a secure leased-line connection to UIDAI's Central Identities Data Repository (CIDR) that provides the connectivity AUAs/KUAs use to send authentication and e-KYC requests. AUAs/KUAs either become their own ASA or contract one.

NPCI is the National Payments Corporation of India, the umbrella organisation that operates retail payment systems in India, including UPI, IMPS, RuPay, NACH, AePS, FASTag and more. NPCI sets the operating rules and security requirements for participants in these systems, which sit alongside the RBI's PSS-Act obligations.

UPI is the Unified Payments Interface, NPCI's real-time interbank payment system that powers most of India's instant mobile payments. Entities building on UPI (apps, PSPs, TPAPs) must meet NPCI's procedural and security guidelines in addition to RBI norms.

PA stands for Payment Aggregator and PG for Payment Gateway. Under RBI's guidelines, Payment Aggregators (which handle funds) require RBI authorisation and must meet defined security, governance, and data-storage standards; Payment Gateways (which provide the technology to route transactions, without handling funds) are technology providers. PAs undergo a mandatory System Audit by a CERT-In empanelled auditor.

Each of these roles — PSS-authorised operator, AUA, KUA, PA — carries its own security and audit obligations, often overlapping (RBI's Digital Payment Security Controls, UIDAI's audit requirements, NPCI's rules, and CERT-In's incident-reporting Directions). Mapping which apply to your business is the first step in any compliance program, because a single product can sit under several at once.

CyberSigma is a CERT-In empanelled cybersecurity firm that helps Indian banks, NBFCs, payment aggregators and fintechs meet the security and audit requirements behind these roles — from the System Audit Report (SAR) for PSOs/PAs and Aadhaar (AUA/KUA) security reviews to VAPT, RBI/SEBI cyber audits and PCI DSS. Engagements are delivered by senior auditors, so the same evidence supports multiple regulators rather than forcing repeat assessments.

Behind every banking and fintech acronym is a regulator and a set of obligations. Knowing whether you're a PSS-authorised operator, an AUA, a KUA or a Payment Aggregator tells you which security controls and audits you owe — and getting that mapping right early saves months of rework. When in doubt, a scoped readiness review with a CERT-In empanelled partner is the fastest way to clarity.