What legal requirements must be met for online payment integration in India?
Business KYC and Bank Verification
- Businesses must complete Know Your Customer (KYC) verification with the payment gateway.
- Documents include PAN card, Aadhaar card (for proprietors), GST certificate, and canceled cheque or bank statement.
- The bank account must match the business or proprietor’s name.
- Non-KYC-compliant accounts may be restricted or unable to process payouts.
- Sole proprietors, partnerships, LLPs, and private limited companies have slightly different KYC requirements.
Compliance with RBI Guidelines
- All payment processors must be authorized by the Reserve Bank of India (RBI).
- Merchants are not allowed to store sensitive card data — tokenization must be used as per RBI norms.
- Real-time settlement and refund processes must comply with timelines set by the RBI.
- UPI payments are routed through NPCI-approved banks with fraud detection in place.
- Businesses must not mislead customers about refund timelines or transaction conditions.
PCI-DSS and Data Security Standards
- While payment gateways handle card data, merchants must use PCI-DSS-compliant tools and platforms.
- Websites must use HTTPS (SSL certificate) to encrypt data in transit.
- Payment forms should be hosted securely, preferably by the gateway (not embedded via iframe).
- Sensitive information like CVV, OTP, and PIN must not be stored by the merchant site.
- Gateways use tokenization and encryption to meet global security standards.
GST and Tax Compliance
- Businesses must provide a valid GSTIN during onboarding if registered for GST.
- Payment gateway commissions include GST, which can be claimed as Input Tax Credit.
- Monthly settlements must be reported in accounting records and tax filings.
- Platforms like Razorpay and Cashfree provide downloadable GST-compliant invoices.
- Earnings through the gateway must be reported as taxable income under Indian IT law.
Privacy and Consent Requirements
- Websites must display privacy policies detailing data usage and payment terms.
- Consent for storing non-sensitive data like name, email, or phone must be obtained.
- Refund and cancellation policies must be clearly mentioned before checkout.
- Users must be informed if third-party processors are involved in handling payments.
- Integration must comply with India’s Digital Personal Data Protection (DPDP) Act.
