Choosing a Payment Gateway: Compliance Checklist for Indian Businesses
In March 2020, the RBI stopped several payment aggregators from onboarding new merchants until they secured formal authorization. Businesses that had already integrated with those gateways didn't get much warning, and as a result, some had to migrate mid-quarter, mid-launch, in a couple of cases even in the mid-funding round.
That episode is a useful reminder for anyone shortlisting a payment gateway today and accepting that compliance isn't the fine print you check after you have picked a provider; rather, it's one of the things that decides which providers even belong on your shortlist.
Most founders and finance teams evaluate gateways on transaction fees, settlement speed, and checkout experience, and all these are critical, no doubt. But a gateway that's cheap and fast and non-compliant isn't a shortcut; it's a big liability sitting quietly on your balance sheet, waiting for an audit, a regulatory circular, or a customer dispute to disrupt your operations and lose all progress you have made till today.
Quick Checklist Before Choosing a Payment Gateway
- Valid RBI PA (or PA-CB) authorization, verifiable, not just claimed
- Merchant funds held in an RBI-mandated escrow account
- Documented, non-rushed KYC and onboarding process
- GST-compliant invoicing with clear TDR and fee breakups
- Card data handled through tokenization, not passed through your systems
- Transaction-level, exportable settlement and reconciliation reports
- Self-serve access to historical data for audits and filings
Compliance Checklist for Indian Businesses When Choosing a Payment Gateway
- RBI Authorisation
Since the RBI's 2020 guidelines on Payment Aggregators (PAs), any entity handling online payment collection on behalf of merchants needs explicit authorization from the central bank.
To get the authorization, payment gateways need net worth details, escrow account mandates, and ongoing reporting obligations.
What to check:
- Does the payment gateway hold a valid RBI PA license (or PA-CB license, if you need cross-border collections)?
- Is merchant money routed through an RBI-mandated escrow account, separate from the gateway's own operating funds?
- Can they show you the license, not just claim it in a sales deck?
If a provider is vague about this, or says authorization is in process without a clear timeline, that's a real flag, not a technicality to wave through.
- KYC Process and Merchant Onboarding
Payment gateways are required to run KYC checks on the merchants they onboard, and in this process you will be asked to submit business documentation;
- PAN
- GST certificate
- Bank account proof
- Beneficial ownership details
This can feel like friction when you just want to start collecting payments, but it's critical to your onboarding experience. A gateway that skips or rushes this step is usually cutting the same corner elsewhere, be it in fraud monitoring, dispute handling, and how seriously it takes regulatory scrutiny generally.
- GST Rules Implementation
GST touches payment gateways in a few places business owners don't always think through upfront:
- The gateway's transaction fee (TDR) attracts GST, which means you need a proper tax invoice for input credit and not just a settlement statement with a fee line buried in it.
- If you sell across states, your GST registration and invoicing setup need to line up with how the gateway reports and settles funds.
- Platform fees, convenience fees, or any pass-through charges to customers need to be treated correctly for GST purposes; this is where a lot of D2C brands get their invoicing wrong without realizing it.
Ask a prospective gateway how their invoicing works in practice, and to get a complete picture, ask for a sample invoice and don’t just trust their word for it.
- PCI DSS Security
If your business touches card payments at all, PCI DSS compliance matters, and it's worth understanding what kind of security this compliance provides. PCI DSS (Payment Card Industry Data Security Standard) governs how card data is stored, transmitted, and processed.
The practical question for a merchant isn't only about ensuring they are PCI compliant; most gateways will provide you with the certification for the same. What matters more is where card data touches your systems, if at all.
A gateway that tokenizes card details and keeps your servers out of the data flow entirely reduces your own compliance burden significantly. One that routes raw card data anywhere near your infrastructure is putting the pressure back on you to adhere to the PCI norms and ensure compliance.
- Reconciliation Process
Reconciliation doesn’t make the list and is not talked about as much as licensing or KYC, but it's where a lot of real-world compliance headaches actually originate.
If your settlement reports don't cleanly match your books, refunds unaccounted for, partial settlements unexplained, fee deductions that don't add up, that gap becomes a problem the moment an auditor or tax authority asks for an explanation.
What's worth checking:
- Does the gateway provide settlement reports detailed enough to reconcile automatically, or are you doing it manually in a spreadsheet every month?
- Are refunds, chargebacks, and fee deductions itemized clearly, transaction by transaction?
- Can your finance team pull historical settlement data without raising a support ticket every time?
- Audit Readiness
When your GST filings, statutory audit, or a tax notice requires transaction-level evidence, you need to be able to produce it fast, and without depending entirely on a support team's response time.
A compliance-ready gateway should let you export transaction histories, settlement records, and fee breakdowns independently, in formats your accountants can actually work with. If pulling six months of clean data requires an email thread and a week of waiting, that's a problem that you will only discover at the worst possible time, during an actual audit.
Conclusion
This checklist is meant to make sure the gateway you pick today does not become a finance team's problem eight months later.
This is also part of why compliance infrastructure has become a genuine differentiator among Indian gateways, not just a checkbox. Providers like Cashfree, for instance, operate under RBI's PA-CB license for cross-border collections, offer GST-compliant invoicing and detailed settlement reporting built for reconciliation, and structure onboarding around proper KYC rather than a shortcut sign-up flow, the kind of groundwork that matters more once you're past your first few months of transactions and into actual audit cycles.
Working with Cashfree this festive season means you will get 0% MDR benefit on all transactions until you reach the ₹20 lakh GMV limit. The offer stands throughout the festive season until March 2027 and also provides dedicated account manager support from day one.
Choosing a payment gateway for your business isn’t just about checking the fees and settlement timelines, but it's also about ensuring the payment gateway can secure your funds, protect your data, and give you the information needed.