Key takeaways
Only integrate a gateway that holds RBI's PA-CB-E or PA-CB-E&I authorisation; using an unlicensed aggregator creates direct FEMA exposure for your agency
Per-transaction limit via a PA-CB gateway is ₹25 lakh; PCI DSS v4.0.1 compliance, including client-side script monitoring, became mandatory on 31 March 2025
File your GST LUT in Form RFD-11 before your first export invoice each financial year or IGST at 18% becomes payable on every invoice
An eFIRA for every international payment helps support GST zero-rated exports and FEMA compliance
Monthly EDF filing becomes mandatory from 1 October 2026 under the new EXIM Regulations (FEMA 23(R)/2026-RB)
Choosing an international payment gateway comes down to one question most developers skip: does this provider hold a valid PA-CB authorisation from RBI? Since RBI/DPSS/2025-26/141 took effect on 15 September 2025, agencies routing international client payments through an unlicensed aggregator face direct FEMA liability, not the gateway. Get the regulatory layer right first; the technical integration follows.
Digital cross-border payments growth: India’s UPI processed more than 6 lakh international transactions in the first four months of FY 2025-26, highlighting the increasing demand for faster and compliant payment solutions for global transactions.
Why PA-CB authorisation is the first thing to verify
RBI's Master Direction on Regulation of Payment Aggregators (RBI/DPSS/2025-26/141), effective 15 September 2025, consolidates all payment aggregator activity into a single framework. For agencies collecting money from foreign clients, only a gateway with PA-CB-E (export) or PA-CB-E&I (export and import) authorisation is a compliant option.
Three authorisation categories exist under this framework:
PA-CB-E covers inward remittances only
PA-CB-I covers outward payments only
PA-CB-E&I covers both directions
An agency billing international clients needs a gateway in either the PA-CB-E or PA-CB-E&I category. The per-transaction ceiling is ₹25 lakh. Non-bank aggregators must maintain a minimum net worth of ₹15 crore at application, rising to ₹25 crore by the end of their third financial year from authorisation.
The gateway must hold inward funds in a dedicated Inward Collection Account (InCA) with an AD Category-I bank. Co-mingling of inward and outward funds is prohibited. Merchant agency onboarded from 1 January 2026 onward must meet full KYC standards from the point of onboarding, with no grace period. Confirm your gateway's PA-CB certificate before signing any integration agreement.
What technical and security requirements apply to your website
Integrating a payment gateway reduces your PCI DSS scope but does not eliminate your obligations. PCI DSS v4.0.1, with all future-dated requirements now mandatory as of 31 March 2025, introduced 64 updated requirements compared to the previous version.
The two requirements most relevant to agency websites are:
Requirement 6.4.3: All scripts on payment pages must be inventoried, authorised, and integrity-checked to prevent digital skimming attacks
Requirement 11.6.1: Ongoing monitoring of the cardholder data environment for unauthorised changes to HTTP headers and scripts
Most agencies fall into PCI DSS Level 4 (fewer than 20,000 e-commerce transactions per year), where a Self-Assessment Questionnaire is acceptable rather than a full QSA audit. Still, Requirements 6.4.3 and 11.6.1 apply at every level.
RBI's data localisation mandate (RBI Circular, April 2018) requires all payment system data to be stored only in India. Foreign processing is permitted, but any data copy held overseas must be deleted within 24 hours of transaction processing. This covers customer name, mobile number, email, bank account details, payment credentials, transaction reference, timestamp, and amounts. Verify your gateway's data residency architecture before integration.
GST compliance before you accept your first international payment
Service exports to foreign clients qualify as zero-rated supplies under Section 16 of the IGST Act, 2017, but only when five conditions under Section 2(6) are all met:
the supplier is in India
the recipient is outside India
the place of supply is outside India
payment arrives in convertible foreign exchange
supplier and recipient are not related entities
GST registration is compulsory for exporters under Section 24 of the CGST Act regardless of turnover. The standard ₹20 lakh threshold does not apply because exports are classified as inter-state supplies.
Before raising your first export invoice, file a Letter of Undertaking in Form GST RFD-11 on the GST portal. A valid LUT lets you invoice at zero tax for the entire financial year (April to March). If you export without one, IGST at 18% becomes payable on every invoice issued during that gap. Report all export invoices in Table 6A of GSTR-1.
An eFIRA (electronic Foreign Inward Remittance Advice) for each inward payment serves as proof that foreign exchange was received. Without it, the zero-rated status of that invoice can be challenged.
FEMA realisation rules every agency must know
Under FEMA notification, the period to realise export proceeds will be extended from 9 months to 15 months from the date of export. For INR-invoiced exports, the realisation period extends to 18 months under the same notification (A.P.(DIR Series) Circular No. 20, dated 16 January 2026), with EXIM Regulations effective from 1 October 2026.
If you hold proceeds in a foreign currency account within an IFSC, you may retain them for up to 3 months from receipt. Non-IFSC accounts carry a 1-month retention limit. The cost of missing these deadlines is significant. Under FEMA Section 13(1), penalties run up to three times the contravention amount when the sum is quantifiable, ₹2 lakh fixed when it is not, plus ₹5,000 per day for continuing violations.
From 1 October 2026, monthly EDF (Export Declaration Form) filing becomes mandatory under the new EXIM Regulations. Agencies should build this into their finance calendar now rather than scrambling at the deadline.
Documentation checklist for gateway onboarding
Every PA-CB gateway will request a standard set of documents during merchant onboarding. The following items are required under merchant due diligence norms:
PAN card of the business
GST registration certificate
Certificate of Incorporation or partnership deed
Active bank account details (AD Category-I bank preferred)
Website URL with live checkout, returns, and privacy policy pages
Business address proof
LUT acknowledgment for the current financial year
Your website must display a refund policy, a physical contact address, and a privacy policy before gateway activation. Missing any of these blocks onboarding. Assign the correct RBI FETERS purpose code to each inward remittance category your agency bills for; an incorrect purpose code is one of the most common FEMA contraventions and can trigger scrutiny during AD bank reviews.
How Jio Payment Solutions helps
For agencies integrating an international payment gateway, the onboarding and compliance process can be as important as the payment experience itself. Jio Payment Solutions is an RBI-licensed payment aggregator with both PA-PG and PA-CB authorisations, enabling Indian businesses to accept international payments while supporting the regulatory requirements applicable to cross-border collections.
For agency websites, Jio Payment Solutions offers API-based integration, supports recurring payments for subscription-based services, automates eFIRA generation, and helps streamline FEMA-related reporting. Businesses also get digital onboarding, a merchant dashboard for payment tracking, and access to multiple international payment methods, allowing them to manage overseas client collections through a single integration.
Getting your international payment gateway integration right
Integrating an international payment gateway involves more than adding a checkout page to your website. Choosing an RBI-authorised PA-CB gateway, meeting PCI DSS security requirements, complying with GST and FEMA regulations, and maintaining the required export documentation all play a role in ensuring smooth cross-border collections.
Before going live, verify that your payment gateway supports the compliance and reporting requirements your business needs. Taking these steps early can help you streamline international payments, avoid regulatory issues, and provide a reliable payment experience for your overseas clients.