Business startup guide | India

How to Start an Online Payment Solutions Business in India

An online payment solutions business helps merchants accept digital payments through websites, mobile applications, payment links, invoices and other channels. The regulatory requirements depend on whether the business merely provides technology or actually handles and settles customer funds.

Payment solutions can serve both business-to-business (B2B) and retail transactions. Merchants may integrate a checkout with their shopping cart or collect payments through hosted payment pages, online invoicing, quick-pay links and recurring payment arrangements. Supported instruments can include credit cards, debit cards, net banking and Unified Payments Interface (UPI), subject to the relevant network and regulatory rules.

Important distinction: Incorporating a company or building a secure website does not itself authorise an entity to operate as a payment aggregator. Businesses that collect and settle merchant funds must assess Reserve Bank of India (RBI) authorisation requirements before commencing regulated operations.

1. Choose the Online Payment Business Model

Payment gateway technology provider

A payment gateway supplies technical infrastructure to route payment instructions, integrate checkout systems and connect merchants with authorised payment providers. A provider that does not handle funds may fall outside payment aggregator authorisation requirements, but must still meet applicable contractual, cybersecurity, privacy and card-network obligations.

Payment aggregator

A payment aggregator facilitates merchants accepting payments from customers and receives, pools or transfers funds for settlement to merchants. Non-bank payment aggregators are subject to RBI authorisation and applicable directions. The exact rules vary with the activity, including online, physical point-of-sale and cross-border arrangements.

Software and merchant services

Other possible services include payment-link generation, invoicing, reconciliation dashboards, fraud monitoring, subscription management, payment analytics and integration support. A new enterprise can initially partner with an authorised aggregator instead of undertaking regulated settlement itself.

2. Select the Legal Structure

Structure	Key provisions	Practical suitability
Sole proprietorship	Business owned by one individual; owner and business are not separate legal persons.	May provide software, consulting and technical services; not a substitute for the company and authorisation requirements applicable to a non-bank payment aggregator.
Partnership firm	Indian Partnership Act, 1932, Sections 4 (definition of partnership) and 69 (restrictions affecting enforcement of contractual rights by unregistered firms).	Possible for technology services. A written partnership deed and registration are advisable; ordinary partnership does not provide general limited liability.
Limited liability partnership	Limited Liability Partnership Act, 2008; an LLP is a separate legal entity with limited liability subject to statutory exceptions.	Can suit professional or technology services; verify eligibility before undertaking any regulated payment activity.
Private limited company	Companies Act, 2013, Sections 2(68) (private company), 3 (formation) and 149 (board composition). Generally requires at least two members and two directors, except an eligible one-person company.	Common structure for scalable fintech ventures. Non-bank payment aggregator applicants must meet the RBI's prescribed eligibility conditions.
Public limited company	Companies Act, 2013, Sections 2(71), 3 and 149. Generally requires at least seven members and three directors.	Suitable for larger enterprises with substantial investment and governance requirements.

Company incorporation is carried out through the Ministry of Corporate Affairs (MCA) using the applicable incorporation services. Obtain PAN, TAN and other registrations as required. Liability protection is not absolute, particularly where fraud, personal guarantees or statutory breaches are involved.

3. RBI Authorisation, Capital and Compliance

The Reserve Bank of India regulates payment systems under the Payment and Settlement Systems Act, 2007. Section 4 generally prohibits operating a payment system without RBI authorisation unless an exemption applies; Section 7 concerns authorisation. The RBI's payment aggregator framework and subsequent directions prescribe eligibility, governance, merchant onboarding, settlement, security and reporting obligations.

Under the RBI's framework for non-bank payment aggregators, the prescribed net-worth benchmark has included Rs. 15 crore at application and Rs. 25 crore by the stipulated deadline for applicable online payment aggregator categories, with continuing maintenance requirements. These are regulatory net-worth benchmarks, not an estimate of total startup expenditure. Check the latest RBI directions for the specific category and application date before relying on these figures, especially for newly introduced or revised categories.

Authorisation, permissible activities, escrow or settlement account arrangements, merchant due diligence, grievance redressal and transaction reporting must be reviewed before launching. Cross-border payment aggregation can attract a distinct RBI framework, and card or UPI participation may require network approvals and partnerships.

Other legal requirements

Data protection: The Digital Personal Data Protection Act, 2023 and rules or commencement notifications applicable at the relevant time govern covered personal-data processing. Review consent, notices, security safeguards and breach obligations.
Information technology: The Information Technology Act, 2000, including Section 43A where applicable, and relevant cybersecurity directions may apply. Assess CERT-In incident-reporting obligations.
Know your customer: RBI KYC directions and anti-money-laundering requirements may apply according to the entity's regulatory status and activities.
Tax: Assess GST registration, invoicing, income tax, TDS and any transaction-specific provisions with a qualified adviser.
Consumer protection: Maintain transparent fees, refund and dispute processes and truthful advertising.

4. Technology, Infrastructure and Security

A dependable payment platform requires a secure website and application, database and transaction infrastructure, reliable high-speed internet, monitoring and disaster recovery. Common technical components include API integrations, encrypted connections, tokenisation where applicable, audit logs, access controls, fraud detection, reconciliation and uptime monitoring.

For card transactions, assess the current PCI DSS requirements and RBI restrictions on storage of card credentials. Avoid retaining sensitive authentication data and use compliant tokenisation or authorised providers. Test software, backups, incident response and vendor security before production deployment.

Office facilities can be owned, rented or operated remotely where permitted. Basic requirements may include computers, licensed software, business telephones, secure internet, printers, furniture and technical support facilities; fax machines are generally unnecessary.

5. Employee Requirements

A small technology provider can start with a lean team, whereas a regulated payment aggregator needs personnel proportionate to its scale and obligations.

Experienced software developers and payment integration programmers.
Cybersecurity, infrastructure and systems administration specialists.
Risk, compliance, legal and data protection personnel.
Merchant onboarding, customer support and after-sales technicians.
Finance, accounting, settlement and reconciliation staff.
Sales, marketing and partnership managers.
Office administration and general support, where needed.

Independent reviews, segregation of duties and appropriate management oversight become increasingly important as transaction volumes increase.

6. Opening a Business Bank Account

Banks apply customer due diligence under RBI KYC requirements. Typical documents vary by constitution and bank policy:

Proprietorship: proprietor's PAN, identity and address verification, photographs where required, and acceptable evidence of business activity and address.
Partnership: partnership deed, firm PAN, address evidence, partner and authorised-signatory KYC, and registration certificate where available or required.
Company: certificate of incorporation, company PAN, memorandum and articles of association, board resolution or authority to operate the account, registered office evidence and authorised-signatory KYC.

For regulated payment aggregation, a regular current account is not a replacement for the escrow, settlement and other banking arrangements required by RBI directions.

7. Capital Planning, Launch and Advertising

Prepare a business plan covering incorporation and professional fees, development, hosting, cybersecurity audits, compliance staffing, office costs, bank and network integrations, customer support, insurance and working capital. A technology-only service may have a substantially lower capital requirement than an authorised payment aggregator. No universal startup-cost figure applies.

Define the service: gateway technology, merchant software or regulated aggregation.
Obtain legal advice on authorisation and choose an appropriate business entity.
Incorporate and complete tax, banking and contractual documentation.
Develop secure systems, complete testing and obtain required audits or approvals.
Negotiate arrangements with authorised banks, payment aggregators and networks.
Launch a controlled pilot, monitor transactions and maintain customer support.
Expand through search engine optimisation, educational articles, online advertising, business referrals, demonstrations, email outreach with appropriate consent, and relevant industry events.

Traditional newspaper advertising, brochures and outdoor advertising may also be considered according to budget, although targeted digital marketing is often more measurable for business customers.

8. Official Laws and Regulatory Resources

Regulatory requirements can change through notifications and circulars. Confirm the current operative rules and authorisation category before accepting or settling payments on behalf of merchants. Requirements outside India depend on the applicable local laws.