complianceindiapayments

In‑App Payment Compliance Manual for India: A Developer's Playbook

mmanuals

2026-02-03

10 min read

Step-by-step playbook for developers integrating in-app payments in India — align with CCI, RBI, app stores and minimize antitrust risk.

Hook: Stop guessing — build in‑app payments for India without triggering CCI or RBI penalties

If you're a developer or product lead shipping in‑app payments in India in 2026, your checklist now spans technical security, RBI licensing and guidance, app store restrictions, and a heightened Competition Commission of India (CCI) scrutiny that can escalate into multi‑billion‑dollar liability for platform owners. This playbook gives a step‑by‑step compliance blueprint you can apply today, with practical code, documentation patterns, and risk mitigation tactics focused on minimizing antitrust exposure.

Executive summary (what to do first)

Priority actions — implement these within 30 days:

Run a regulatory map: identify whether your product is a Payment Aggregator (PA), uses a third‑party PSP, or only routes payments for physical goods.
Document choice: capture flows and UI that show users alternatives and fee transparency.
Lock down RBI requirements: ensure PSP/PA partners are RBI‑registered or licensed under current RBI directions and maintain audit trail of certificates.
Prepare antitrust mitigation: adopt a non‑discrimination policy, maintain logs of merchant/shopfront onboarding, and implement an internal competition risk register.

Context in 2026: why this matters now

Late 2025 and early 2026 saw rising enforcement in India. CCI has intensified inquiries into app platform payment practices, and high‑profile investigations (including continued scrutiny around major app stores) show the regulator will pursue remedies and penalties aggressively. RBI continues to tighten controls over payment aggregators, tokenization, and data security — and expects firms to keep up‑to‑date compliance records during audits.

Key trend: regulators are moving from guidance to enforcement — technical logs and contractual proof now carry regulatory weight.

Step 1 — Legal & product classification: are you a PA, PSP, merchant, or platform?

Before writing a single integration line, classify your role. The regulatory obligations differ:

Payment Aggregator (PA): if you collect payments on behalf of multiple merchants and perform payment routing, you may fall under RBI PA rules and need registration or compliance with RBI directions.
Payment Service Provider (PSP): a licensed gateway or bank partner with direct settlement obligations. Integration with certified PSPs reduces your regulatory burden but requires due diligence.
Marketplace / Platform: if you host storefronts and control in‑app purchase routing, you must show non‑discriminatory access and fair commercial terms to avoid antitrust concerns.
Merchant / Seller: if you only sell goods/services and use a PSP, maintain records and refund/settlement mechanisms aligned with RBI timelines.

Actionable: create a two‑page classification memo and store it with your compliance artifacts.

Step 2 — Map applicable regulations and policies

Create a single source of truth that maps product features to rules. Include items such as:

RBI payment aggregator and tokenization guidelines, and any 2023–2025 clarifications relevant in 2026.
Data localization and sensitive personal data storage rules impacting payment data.
App Store (Apple) and Google Play billing policies for digital goods — document exceptions (physical goods, peer‑to‑peer, etc.).
Competition law signals from CCI and recent enforcement trends (e.g., increased scrutiny on forced use of in‑house payments).

Actionable: produce a compliance matrix that links each feature to a regulation and owner (legal, product, infra).

Step 3 — Design patterns that reduce regulatory & antitrust risk

Design choices influence legal risk. Apply these patterns:

1. Offer genuine choice

Expose a selection of certified PSPs in the checkout UI. Document how you choose and rotate them.
Avoid UI dark patterns that bias users toward a proprietary payment method.

2. Transparent fee presentation

Display merchant fees and platform commissions clearly prior to checkout.
Keep an audit trail of rate changes and merchant notifications.

3. Non‑discrimination policy

Publish and enforce a policy that prohibits preferential treatment of owned payment products (e.g., better UX, lower commission).
Log timeline of feature rollouts across payment methods as evidence.

Actionable: embed a choice widget and a transparent fee banner in your checkout flow within your next sprint.

Step 4 — Technical compliance checklist

Operational controls and secure implementations show you mean compliance. Implement the following:

Tokenization: never store PANs. Use tokenized card references per PSP/RBI mandates.
Data localization: ensure storage of payment related logs and KYC artifacts comply with Indian data residency where required.
Strong customer authentication (SCA): comply with two‑factor flows; align with RBI transaction risk analysis thresholds.
Certificate verification: maintain validated certificates for PSP partners and periodic re‑validation (quarterly recommended).
Audit trails: immutable logs for payment routing decisions, merchant onboarding, price changes, and dispute handling — and keep these retrievable in a secure backup system (automated backups & versioning).

Example: a minimal server validate webhook in Node.js for payment verification:

const crypto = require('crypto')
function verifyWebhook(body, headerSignature, secret) {
  const expected = crypto.createHmac('sha256', secret).update(JSON.stringify(body)).digest('hex')
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(headerSignature))
}

Actionable: include this verification in all webhook handlers and require PSPs to sign payloads. For developer toolkits and quick starter patterns, see a compact developer starter approach (ship a micro‑app in a week).

Step 5 — Merchant onboarding and contractual safeguards

How you onboard merchants affects competition risk.

Use standardized merchant contracts that disclose payment routing, fees, and data sharing. Keep versioned copies.
Give merchants the option to use their own PSP accounts where feasible (helps against claims of lock‑in).
Write termination and repricing clauses to be fair and predictable; document communications when terms change.

Sample contract clause (plain language):

"You may choose any PSP approved by the platform for settlement. Platform will not unduly restrict or discriminate against any PSP that meets our security and certification criteria."

Actionable: add this clause to merchant T&Cs and retain signed acceptance timestamps. Consider automating parts of merchant onboarding to capture contemporaneous evidence and checklists.

Step 6 — App store policy alignment (Apple & Google)

App stores have their own rules for digital goods. Two practical approaches:

For digital content/services: use the app store's in‑app purchase where required and document the legal rationale in a compliance memo.
For physical goods/services: route to your PSPs or a web checkout and keep evidence the purchase is for a physical/delivery service.

Because of CCI scrutiny, maintain records showing why any decision to require in‑app purchases was a technical or policy necessity rather than anti‑competitive behavior.

Step 7 — Monitoring, metrics, and reporting

Regulators look for systemic evidence. Implement dashboards and scheduled reports covering:

Payment method share by volume and value (monthly).
Time‑to‑switch metrics — how long it takes to route to alternative PSPs (weekly).
Merchant complaints and escalations categorized by payment method (daily/weekly).
Security incidents and remediation timelines (incident response SLA adherence).

Actionable: create an automated monthly compliance report combining logs, contracts, and merchant feedback for legal review. Embed observability into your telemetry so regulators can see neutral, queryable datasets.

Step 8 — Antitrust mitigation playbook (specific to CCI risk)

CCI investigations examine whether platforms distort competition. Prepare these defenses proactively:

1. Document legitimate pro‑competitive reasons

Security and fraud reduction measures that justify centralization or a preferred payment path.
Performance metrics showing superior availability, settlement speed, or refund handling that benefit merchants and users.

2. Evidence of non‑price‑based reasons for product design

Technical constraints (e.g., secure enclave integration) that require a specific payment approach.
User experience A/B test results showing differences were user‑driven, not anti‑competitive.

3. Maintain contemporaneous contemporaneous records

Meeting notes, product decision memos, and rollout plans that explain rationale and alternatives considered.
Keep a 'competition register' documenting any exclusionary decisions and remediation steps.

Actionable: create a templated 'antitrust posture' document to update every major payment change and store it in your compliance folder.

Step 9 — Simulations and tabletop exercises

Run quarterly exercises that simulate an investigation and an RBI audit. Include scenarios such as:

CCI information notice — produce logs and merchant communication for a 12‑month window.
RBI surprise inspection — show PSP certification, onboarding checklists, and tokenization evidence.
App store policy enforcement — simulate an app update requiring checkout changes and preserve review correspondence.

Actionable: schedule the first tabletop within 45 days and correct gaps in a 90‑day sprint. Build tabletop scenarios from public incident playbooks such as the public-sector incident response playbook to shape timelines and evidence requests.

Step 10 — Incident response & regulator engagement

When regulators call, speed and completeness matter.

Designate a regulator response lead (legal + product + infra) and create a contact list.
Prepare a one‑page incident pack per the type (CCI inquiry vs RBI audit) containing: classification memo, compliance matrix, merchant contract samples, recent dashboards, and security attestations.
For CCI: proactive remediation and willingness to offer remedies (choice, API access, or clearer disclosures) can reduce penalties.

Actionable: prepare the incident pack template and run a mock submission.

Operational templates & artifact checklist

Keep these artifacts ready and versioned:

Two‑page product classification memo.
Compliance matrix mapping features to RBI and app store rules.
Merchant standard contract and proof of acceptance timestamps.
Payment routing logs (12 months) and signature verification of webhooks.
PSP / PA certificates and quarterly revalidation logs.
Monthly compliance report and competition register.

Case study (hypothetical): Platform X avoids CCI escalation

Platform X faced merchant complaints over required in‑app payments. They implemented a three‑month remediation:

Added two certified PSPs to checkout and documented selection criteria.
Published a non‑discrimination policy and updated merchant contracts.
Built a dashboard to show payment method parity and shared it with regulators proactively.

Result: CCI closed the inquiry after Platform X demonstrated choices, transparent fees, and no performance bias.

Takeaway: proactive transparency often reduces enforcement exposure.

Advanced strategies & future predictions (2026 and beyond)

Expect the following through 2026–2027:

Higher fines tied to global turnover: CCI's willingness to consider global revenues for penalty calculation increases the stakes for multinational platforms.
More formalized PSP certification: RBI and NPCI will push stricter integration and tokenization standards; platforms should expect certification audits.
Data‑driven antitrust inquiries: CCI will increasingly rely on telemetry — platforms must retain neutral, queryable datasets for defense.

Strategic tip: build a compliance data lake (retention, anonymization, queryability) to respond fast to discovery requests. Also consider registries and cloud filing patterns from edge registry discussions when designing retention and indexing.

Quick audit runbook (for the first 48 hours)

Assemble the response team and the incident pack template.
Freeze changes to payment routing and preserve logs.
Export merchant and PSP contract snapshots for the requested window.
Run integrity checks on tokenization and webhook signature logs.
Prepare an initial written response acknowledging receipt and timeline to regulators (48–72 hours).

Checklist summary: 30/60/90 day plan

30 days

Product classification memo and compliance matrix.
Basic telemetry dashboards for payment share and complaints.

60 days

Non‑discrimination policy published and embedded in merchant contracts.
Tokenization verified, webhook signing enforced, localization checks done.

90 days

Quarterly tabletop, compliance report automation, PSP certificate revalidation.
Competition register and market impact memo for leadership review.

Final practical tips

Keep all decision memos and internal analyses — lack of contemporaneous records is a common regulatory pitfall.
Use neutral language in product labels and flows — avoid wording that signals forced use of a particular payment method.
Automate retention and retrieval of logs — manual pulls are slow and error‑prone under audit pressure. Follow data engineering best practices outlined in data engineering patterns.
Engage counsel early for any product change that centralizes payments or alters merchant economics.

Key takeaways

Classify early: your obligations depend on whether you are a PA, PSP, merchant, or platform.
Design for choice and transparency: this reduces CCI antitrust risk.
Document everything: logs, memos, contracts, and dashboards are your primary defense.
Prepare quickly: build an incident pack and run tabletop exercises quarterly.

Closing — next steps

Start with the 30/60/90 checklist today: draft your classification memo, add a transparent fee banner to your checkout, and schedule a tabletop compliance exercise. If you need a ready‑to‑use compliance pack (templates for the classification memo, merchant clause, incident pack, and webhook verification code), download our developer compliance toolkit or schedule a 30‑minute audit walkthrough with our experts.

Call to action: Download the compliance toolkit and run your first tabletop in 45 days — every month you delay increases regulatory risk and remediation cost.

manuals

Contributor

Senior editor and content strategist. Writing about technology, design, and the future of digital media. Follow along for deep dives into the industry's moving parts.