Razorpay, UPI and GST: what your online store needs on day one

If you are launching an online store in India, five things need to be sorted before the first order: a payment gateway account in your business’s name, a clear view of what each payment method costs you, GST registration (usually needed sooner than people expect), the pages and policies consumer law asks for, and a plan for the customer data you will collect.

None of it is hard, but the paperwork takes longer than the build if you leave it to the last week.

This is general information as of October 2026, not legal or tax advice. Fees and rules change, so check with your CA before you act on any of it.

What a payment gateway actually charges

A payment gateway (strictly, a payment aggregator) collects money from your customer by UPI, card, netbanking or wallet and settles it into your bank account, minus its fee. Razorpay is a common starting point for Indian stores, so we use its published pricing as the example. Cashfree, PayU and others work in a similar way; compare them on your own mix of payment methods.

Razorpay’s standard plan, as listed on its pricing pages in October 2026:

There is no setup fee and no annual maintenance charge on the standard plan. The 18% GST applies to the fee, not your full order value. On a ₹1,000 order at 2%, you pay ₹20 plus ₹3.60 GST and receive ₹976.40. Introductory offers and custom rates for higher volumes also exist, so check the live pricing page before you sign up.

Two things catch people out. The fee is deducted before settlement, so your bank credit will never match your order total; whoever does your accounts needs the gateway’s settlement report to reconcile. And refunds usually don’t return the original fee, so a high return rate costs you twice.

UPI: still free for customers, changing for merchants

UPI is how most of your customers will want to pay. From January 2020, banks could not charge merchants a merchant discount rate (MDR) on UPI and RuPay debit card payments. A gateway’s platform fee is separate from MDR, which is why gateways still charge for UPI.

That changed in September 2026. The government notified that UPI payments to merchants of up to ₹2,000 stay free of MDR, and NPCI issued a framework for a fee on larger payments. As reported, the standard rate is about 0.4% above ₹2,000, with caps, lower rates for some sectors and an exemption for the smallest merchants. Payments between individuals remain free.

If you already pay a gateway platform fee, the practical question is whether and how your gateway passes this through. Ask them in writing whether your UPI rate changes, and from when. As of October 2026 the details are still settling, so check with your gateway and your CA.

A few other payment rules worth knowing:

• Higher UPI limits for some merchants. Person-to-person transfers stay at ₹1 lakh a day, but from 15 September 2025 NPCI allowed up to ₹10 lakh a day for payments to verified merchants in selected categories. Useful if you sell high-ticket items.
• No stored card numbers. Since 1 October 2022, RBI rules do not allow merchants to store customers’ full card details. Saved cards work through tokens, which your gateway handles. Your developer should never build a “save card” feature that keeps card numbers on your own server.
• Subscriptions run on e-mandates. The customer authenticates once. After that, RBI allows recurring debits of up to ₹15,000 without a fresh OTP, and up to ₹1 lakh for mutual funds, insurance premiums and credit card bills.
• Expect proper KYC. Under RBI’s payment aggregator directions, issued in September 2025, gateways must check merchants before onboarding them. Keep your business documents, bank details and a live website with policy pages ready.

GST: when an online store must register

The general rule is that you register for GST once your aggregate turnover crosses ₹40 lakh a year for goods (₹20 lakh in some special category states) or ₹20 lakh for services (₹10 lakh in special category states). Online sellers often need to register well before that.

• Selling goods to customers in other states from your own website is an inter-state supply. Inter-state suppliers of goods must register regardless of turnover. For a D2C brand shipping across India, that usually means registering on day one.
• Selling through marketplaces such as Amazon or Flipkart used to need registration from the first rupee. Since 1 October 2023, small sellers of goods can skip it if they sell only within one state, stay under the threshold, and get an enrolment number on the GST portal using their PAN. Ship to another state and the exemption no longer applies.

Being registered also lets you claim input tax credit on what you buy for the business, including gateway fees, ad spend and the invoice for building the store, all of which carry 18% GST.

If other sellers list on your platform

The rules change if you run a marketplace rather than a store. You then become an e-commerce operator under GST. You must register regardless of turnover, collect tax at source (TCS) on the net value of other sellers’ taxable supplies, and file a monthly return. The TCS rate was cut from 1% to 0.5% from 10 July 2024. Separately, operators must deduct income-tax TDS on payments to sellers; that rate was cut from 1% to 0.1% from 1 October 2024.

Selling only your own products on your own website does not make you an e-commerce operator for TCS. If you are building a multi-vendor platform, talk to your CA before any code is written, because payouts, invoicing and reporting have to be designed around these rules.

The pages and policies consumer law expects

The Consumer Protection (E-Commerce) Rules, 2020 cover online retail of every kind, including single-brand stores. In practice your site needs:

1. Your legal business name, address, and customer care email and phone number, easy to find.
2. A grievance officer’s name and contact details. Complaints must be acknowledged within 48 hours and resolved within one month.
3. Clear return, refund, exchange, delivery and cancellation terms, shown before the customer pays.
4. A full price breakdown, including taxes and delivery charges, before checkout.
5. A privacy policy and terms of use. Your gateway will usually ask for these during KYC anyway.

Also stay clear of the 13 “dark patterns” the Central Consumer Protection Authority listed in November 2023. They include false urgency (“only 2 left” when it isn’t true), basket sneaking (adding items or charges the customer didn’t choose), drip pricing and subscription traps. These are easy to build by accident when someone asks for “something to push conversions”.

Customer data: plan for the DPDP Act now

Every order gives you a name, a phone number and an address. The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, notified in November 2025, set out how you must handle that data. Most obligations apply from May 2027, after an 18-month transition, but a store you build today will still be running then.

• Collect only what you need, with a clear notice saying why.
• Ask for marketing consent separately, and let people withdraw it. Don’t pre-tick the box.
• Keep the data secure, and have a plan to inform customers and the Data Protection Board if there is a breach.
• Delete what you no longer need, and be able to handle requests to access, correct or erase data.

Penalties under the Act go up to ₹250 crore for failing to take reasonable security safeguards. Building for this from the start costs far less than retrofitting it.

What we’d do

Before launch: register for GST if you will ship across states, open the gateway account in the business’s name rather than a developer’s, start KYC early because it can take days, and get the policy pages written and reviewed.

In the build: use the gateway’s hosted checkout or tokenised cards, show the full price up front, keep marketing consent separate, and make sure orders and settlements can be exported in a format your CA can actually use.

If you’re weighing this for your own project, send us a WhatsApp. A person replies within one working day.