Nepal's Payment System Explained: PSOs vs PSPs vs BFIs in Plain Language
Every time you scan a QR code in Nepal, at least three regulated institutions handle that payment — you only ever see one of them. Here's what BFI, PSO, and PSP actually mean, and why the difference matters even if you never plan to read a single NRB circular.
You don't need to know this jargon to send money on eSewa or scan a Fonepay QR code — the apps are built so you never have to think about it. But the moment something goes wrong — a payment stuck mid-transfer, a merchant dispute, a question about who's actually responsible for your money sitting in a wallet — this structure suddenly matters a great deal. Understanding it also makes you a sharper user: you'll know why some apps can hold your balance and others can't, why certain QR codes work across every bank and others don't, and who you're actually trusting when you tap "pay."
Nepal Rastra Bank (NRB) organizes the country's digital payment ecosystem into three distinct layers, each licensed and regulated differently under the Payment and Settlement Act, 2075 (2019). Get comfortable with these three terms and the rest of Nepal's fintech landscape — who owns what, who's liable for what — starts making a lot more sense.
Fig. 1 — NRB regulates three distinct layers: PSPs (what you see), PSOs (the switch underneath), and BFIs (where the money actually sits).
What Is a BFI (Bank and Financial Institution)?
The institutions where your money legally lives
A BFI is any bank or financial institution licensed by NRB under the Banks and Financial Institutions Act (BAFIA), 2073 — commercial banks (Class A), development banks (Class B), finance companies (Class C), and microfinance institutions (Class D). This is the foundation layer of the entire system: no matter how many apps a payment passes through, the money itself is ultimately held in an account at a licensed BFI.
BFIs are unique in this three-layer structure because they're allowed to offer PSP-style services directly — mobile and internet banking — without needing a separate PSP license, since they're already regulated at a higher standard under BAFIA. That's why your bank's own mobile app can send and receive payments just like eSewa or Khalti can.
What Is a PSO (Payment System Operator)?
The infrastructure that connects everything behind the scenes
A PSO builds and runs the plumbing — the switches, clearing systems, and card or QR networks that let a payment initiated in one app actually reach an account at a different bank. You never open a PSO's app directly; you interact with it indirectly every time your wallet or bank app shows a QR code with a "Fonepay" or "SCT" logo in the corner.
PSOs include clearing houses (which settle transactions between banks), card networks like Visa and Mastercard, and interoperable QR/fund-transfer switches like Fonepay and SCT. Because they sit at the core of the entire payment system, NRB's licensing bar for PSOs is intentionally higher than for PSPs — a failure at this layer could affect every bank and wallet connected to it at once.
What Is a PSP (Payment Service Provider)?
The apps you actually open and use
A PSP is the customer-facing layer — the wallet or app you download, register on with your citizenship or ID, and use to pay bills, top up mobile credit, or scan a merchant's QR code. PSPs don't operate the core switching infrastructure themselves; instead, they connect to one or more PSOs to actually route a payment through to its destination bank.
This is also the layer where most first-time confusion happens: your wallet balance feels like "your money sitting in the app," but structurally, that balance is typically pooled and held in escrow at a partner BFI — the PSP is a regulated intermediary, not the final custodian of your funds.
How NRB Licenses and Regulates Each
All three categories fall under NRB's Payment Systems Department, but the process and bar differ by layer. An applicant first submits a Letter of Intent with a refundable application fee, followed by a detailed business, technical, and security plan. NRB then reviews capital adequacy, cybersecurity readiness, governance structure, and AML/CFT compliance before issuing a license.
- PSPs operating through cards need a minimum paid-up capital in the tens of millions of rupees; those operating primarily through telecom/mobile channels face a somewhat lower threshold.
- PSOs face a materially higher capital requirement, reflecting their systemic role — a PSO outage or breach can cascade across every bank and wallet connected to it.
- BFIs are licensed separately and more comprehensively under BAFIA, and are exempted from separately re-qualifying for a PSP license since their regulatory bar already exceeds it.
- With the exception of BFIs, a single company generally cannot hold both a PSP and a PSO license at the same time — NRB deliberately keeps the customer-facing and infrastructure layers structurally separate.
As of recent NRB records, Nepal has roughly a dozen licensed PSOs and over two dozen licensed PSPs, alongside dozens of BFIs — a three-tier ecosystem that's grown considerably since digital payments took off.
How They Interact in a Single Transaction
Here's what actually happens, layer by layer, when you scan a merchant's QR code using your eSewa app to pay for chiya at a local shop whose account is at a different bank than yours:
You open eSewa (PSP) and scan the merchant's QR code, entering the amount and confirming with your PIN.
eSewa recognizes the QR belongs to Fonepay's (PSO) interoperable network, since the merchant's bank isn't directly linked to eSewa's own settlement pool.
Fonepay routes the transaction request to the merchant's actual bank and confirms the merchant's account details are valid.
Behind eSewa, your prepaid balance draws down from the pooled account eSewa holds at its own partner BFI.
Fonepay clears the interbank movement, and the merchant's BFI credits the funds into the merchant's actual bank account.
Both you and the merchant see a confirmation within seconds — even though the payment just crossed a PSP, a PSO, and two separate BFIs.
Why This Structure Exists: Safety and Oversight
Separating PSPs, PSOs, and BFIs isn't bureaucratic overhead for its own sake — it's a deliberate risk-containment design that most modern payment regulators (including NRB) converge on:
- Custody stays with regulated banks. Because your actual money sits at a BFI rather than inside a wallet app's own balance sheet, a wallet company failing or shutting down doesn't automatically mean your funds vanish with it.
- Systemic risk is isolated at the infrastructure layer. Concentrating switching and clearing in a small number of heavily capitalized, tightly audited PSOs makes it far easier for NRB to monitor and secure the single point every transaction passes through.
- Competition stays healthy at the app layer. Because PSPs plug into shared, interoperable PSO infrastructure rather than each building a private network, dozens of wallet apps can compete on user experience without users being locked into whichever wallet a particular merchant happens to support.
- Accountability is traceable. When something goes wrong, NRB — and you — can identify exactly which layer failed: a user-facing bug (PSP), a routing or settlement failure (PSO), or an account-level issue (BFI).
Quick-Reference Table
| Layer | Role | Governed By | Holds Customer Funds? | Examples |
|---|---|---|---|---|
| PSP | User-facing wallet / payment app | Payment and Settlement Act, 2075 | No — funds pooled at a partner BFI | eSewa, Khalti, IME Pay, Prabhu Pay |
| PSO | Backend switch, clearing & card network | Payment and Settlement Act, 2075 | No — routes and clears only | Fonepay, SCT, NCHL, Visa, Mastercard |
| BFI | Licensed bank or financial institution | BAFIA, 2073 | Yes — final custodian of funds | Commercial banks, development banks, microfinance BFIs |
The next time your QR payment confirms in under two seconds, you'll know it just quietly crossed all three of these regulated layers — an app you trust, a switch you never see, and a bank that's legally accountable for where your money actually sits. That's not complexity for its own sake; it's the structure that lets Nepal's digital payment system scale to millions of users without any single company holding all the risk.
This article is for general educational purposes only and does not constitute legal or regulatory advice. Licensing categories, capital thresholds, and the list of licensed institutions are periodically updated by Nepal Rastra Bank — refer to NRB's Payment Systems Department (nrb.org.np) for the current official list and requirements.
Discussion