A fast-growing fintech meets a fast-tightening rulebook
Razorpay, long celebrated as a backbone of India’s online commerce, entered 2025 under intense scrutiny after the Enforcement Directorate (ED) widened its probe into alleged fraudulent cryptocurrency flows linked to the HPZ Token scheme. At the center were frozen virtual accounts that investigators say intermediated proceeds of crime; Razorpay has said it has no fresh ED notice, has cooperated historically, and is not complicit—but the episode has nevertheless raised the bar for compliance expectations across the sector.
What makes this case consequential is the scale—both of HPZ and India’s real-time payments economy. On one side, ED says ₹2,200 crore of “proceeds of crime” were generated, with ₹497.20 crore attached/frozen and 286 bank and virtual accounts identified across 20 states. On the other, India’s UPI rails set fresh records in 2025, pushing volumes and values that dwarf most markets and magnify any compliance lapse.
What the ED says—straight from the filing
An official ED press release dated 23 January 2025 (Special Court, PMLA, Dimapur) declared Bhupesh Arora a Fugitive Economic Offender in the HPZ Token & Others case. ED’s account: an app-based token (“HPZ Token”) offered astronomical returns on “Bitcoin mining,” raised ~₹2,200 crore, routed funds through layers of shell companies, and siphoned money overseas. The release notes ₹497.20 crore attached/frozen so far and lists 286 bank/virtual accounts traced nationwide.
The same release details Arora’s non-appearance despite summons, a non-bailable warrant (July 2024), departure to Dubai (September 2022), and the court’s FEO order on 22 January 2025. ED also cites nine immovable properties attached and claims Arora/associates created 200+ companies to launder funds—illustrating the “layering” pattern investigators look for in KYC/AML cases.
Parallel reporting in mainstream outlets captured the operational choke point: while bulk payouts sat briefly with payment gateways, ED moved to freeze ~₹500 crore across eight platforms—including PayU (₹130 crore), Easebuzz (₹33.4 crore), Razorpay (₹18 crore), Cashfree (₹10.6 crore), Paytm (~₹2.8 crore)—to halt onward remittances pending inquiry.
To understand the stakes, look at Razorpay’s throughput:
- $150B annualized TPV (Feb 2024)—a milestone marked when the company unveiled “Payment Gateway 3.0” and an AI assistant (Ray).
- $180B annualized TPV (Dec 2024 / Jan 2025 interviews)—reflecting a step-up through 2024 into early 2025; leadership also cited ~24% revenue growth and 300M+ end consumers served across India via the platform.
- Southeast Asia push (Mar 2025)—about $1B TPV currently in SEA with a $5B two-year target after entering Singapore, suggesting a deliberate regional diversification amid domestic regulatory flux.
These figures matter because AML/KYC controls must scale with throughput. When your platform handles tens to hundreds of billions of dollars annually, even a small defect in onboarding or monitoring can translate into large absolute exposure—hence the market’s sensitivity to any ED action, however indirect.
Razorpay, for its part, has consistently said it cooperates with agencies, files required reports, and has not received fresh ED notices specific to 2025 media claims—an assertion also echoed by other gateways in this round. The companies frame themselves as intermediaries that move money between verified banked counterparties, not as principals to the crypto schemes under probe.
How big is India’s real-time payments base now- and why it raises the bar)?
India’s UPI continues to set global pace in 2025:
- July 2025: 1,947 crore transactions totaling ₹25.1 lakh crore—fresh monthly highs on both counts.
- August 2025 (avg daily): value ~₹90,446 crore vs ~₹75,743 crore in January—a striking acceleration through the year, per SBI analysis.
- IMF-flagged global lead: ~18 billion real-time transactions monthly, underscoring India’s interoperability and ubiquity.
- NPCI dashboards: granular member/category stats show how deeply UPI penetrates retail flows—another reason regulators emphasize reporting and reversals, and debate MDR to sustain infrastructure investment.
- Policy debate (2025): authorities actively consider a 0.2–0.3% MDR for large merchants to ensure industry sustainability and reduce free-riding on rails crucial to national infrastructure.
This macro context explains why payment aggregators face higher scrutiny: any AML gap can scale instantly. It also explains industry calls for clearer crypto rules, licensing clarity for aggregators, and standardized suspicious transaction reporting (STR) protocols aligned with FIU-IND and PMLA requirements.
Is this Razorpay’s first regulatory stress test? A short timeline
- 2022: In an earlier phase of the HPZ/Chinese-app investigations, ED announced freezes of ~₹46 crore across multiple gateways, including Razorpay—an early sign that authorities were mapping payment intermediaries used by suspect networks.
- 2024: Company touts $150B TPV, adds fraud-mitigation and AI features, signaling both growth and a product focus on risk controls.
- Late 2024–Early 2025: Media reports surface on ₹500 crore frozen across gateways in the HPZ probe; companies push back on “fresh probe” framing while acknowledging sector-wide cooperation. ED’s FEO filing against Arora gives the case sharper legal contours.
The throughline: as volumes surged, controls hardened, and ED sharpened its playbook—from merchant-level forensic trails to FEO proceedings aimed at deterrence and asset recovery.
Compliance now, and in the future
Across India’s payments stack, you can expect:
- Deeper merchant KYC/KYB: more rigorous beneficial-ownership checks, industry blacklists, geo-risk flags, and enhanced due diligence for higher-risk categories.
- Real-time behavioral monitoring: anomaly detection on payout batching, velocity, circular flows, and rapid account-hopping—especially for virtual accounts.
- STR/CTR discipline: tighter cadence and data quality for Suspicious Transaction Reports and Cash Transaction Reports, mapped to FIU-IND taxonomy.
- “Three lines of defense” at scale: business + risk + audit operating with independent mandates and board-level oversight, not just founder-driven policies.
- Regulatory clarity on crypto touchpoints: banks, PAs, PGs, and VASPs need a shared rulebook to avoid “grey-zone” arbitrage.
Global parallels reinforce the direction: the EU’s MiCA regime and supervisory pressure in the US/Singapore/UAE show that high-growth fintech can coexist with high-trust compliance—but only with sustained investment and transparent engagement with supervisors.
Where lies ahead for Razorpay?
Two things can be true at once:
- Fact pattern: ED’s official record in HPZ is clear on ₹2,200 crore proceeds, ₹497.20 crore attached/frozen, 286 accounts, 20 states, and an FEO order against the named accused.
- Company stance: Razorpay (and peers) deny fresh ED notices in 2025 media cycles, reiterate past cooperation, and emphasize their intermediary role.
What matters next is audit-quality evidence on whether onboarding and monitoring were reasonably designed for the risk at hand. Regardless of final findings, market discipline is already doing its work: large merchants and partner banks now ask harder questions, and gateways are raising AML bars to preempt reputational shock.
A pivotal compliance reset for Indian fintech
The HPZ episode is a stress test of India’s payments guardrails at peak scale. The ED’s filings lay out the alleged crime network; the gateways’ responses highlight the practical limits of intermediaries in a high-velocity ecosystem. The way forward is not to trade growth for governance, but to institutionalize governance as the price of growth. UPI’s record-setting cadence, Razorpay’s multibillion-dollar TPV, and a live debate on MDR and licensing point to the same endgame: India’s digital economy is too important to be fragile. Expect crisper rules, heavier responsibility on aggregators, and greater transparency among all players—so the rails stay fast, and the system stays clean.
Finally, the Razorpay–HPZ Token saga is more than just a company under investigation. It’s a wake-up call for an entire ecosystem—one where speed and scale have raced ahead of safeguards. As India’s payment rails shatter records and fintech ambitions soar, the HPZ episode teaches an unvarnished lesson: checks and balances aren’t optional; they’re essential. Whether or not Razorpay emerges cleared from this mess, the market has shifted. Banks, regulators, and merchants are demanding better visibility, traceability, and guardrails. More than ever, fintechs must thread the needle—accelerating growth while building governance that’s not just robust, but transparent and proactive. If the HPZ case forces a recalibration, where compliance becomes a market differentiator and not a hurdle, then India’s digital payments revolution will emerge not just bigger—but stronger, more trusted, and more sustainable.
Frequently Asked Questions
1. Did the ED officially name Razorpay as complicit in the HPZ Token scandal?
No. The ED’s official press release focuses on the accused network—HPZ Token, key figures including Bhupesh Arora, and shell company structures used to launder proceeds. While media reports mentioned frozen funds passing through Razorpay’s platform, Razorpay itself has issued statements saying it has not received any new ED notices, is fully cooperating, and remains an intermediary rather than an active participant in the scheme.
2. How much money did the ED freeze across payment gateways, and what portion involves Razorpay? The ED has frozen around ₹500 crore across eight payment gateways amid the HPZ probe. Razorpay’s share is approximately ₹18 crore. For context, PayU had ~₹130 crore frozen, Easebuzz around ₹33.4 crore, Cashfree about ₹10.6 crore, and Paytm approximately ₹2.8 crore. Though significant in absolute terms, the frozen amount in Razorpay’s case is comparatively modest.
3. How large is Razorpay’s processing volume right now?
As of early 2025, Razorpay processes approximately $180 billion in annualized Total Payment Volume (TPV). It achieved the $150 billion mark around February 2024 and continues to scale. The fintech is also expanding regionally—with around $1 billion TPV already in Southeast Asia and an ambitious $5 billion two-year target set after entering the Singapore market.
4. How big is India’s real-time payment ecosystem, and how does that impact compliance expectations?
India’s payments ecosystem—especially UPI—is among the world’s fastest-growing. In July 2025, UPI recorded 1,947 crore transactions totaling ₹25.1 lakh crore, setting fresh highs. By August, the average daily transaction value had surged to ₹90,446 crore. These extraordinary volumes mean that any gap in monitoring or KYC can magnify into serious systemic risk, driving regulators to enforce stricter compliance standards across fintech platforms.
5. What regulatory changes are expected after the HPZ-Razorpay episode?
Several shifts are likely:
- Tighter licensing or registration requirements for payment aggregators and gateways.
- Stronger KYC and KYB protocols, particularly for high-risk merchants or verticals.
- Stricter, near-real-time monitoring for suspicious transactions and automated STR filing.
- Possible introduction of Merchant Discount Rate (MDR) on select categories to fund compliance infrastructure.
- Greater clarity on how platforms that touch crypto—even peripherally—should operate within India’s regulatory framework.
