How Can You Set Up Secure, Compliant Payments With Razorpay in India?

Set up secure, compliant payments with Razorpay by verifying the authorised entity, completing business verification and configuring the documented checkout, authentication and payment controls for your account. Payment gateway security and compliance brings these steps together with clear settlement terms and ongoing reviews, giving your team a practical process from onboarding to live operations.

This guide takes you from choosing the right payment activity to preparing your business, integrating checkout and reviewing live payments. It brings the evidence and practical steps into one checklist for your finance, engineering and operations teams.

How Do You Verify Razorpay’s RBI Payment Aggregator Authorisation?

Verify Razorpay’s authorisation by matching your payment agreement to Razorpay Payments Private Limited, formerly Razorpay Software Private Limited, in the RBI register dated 30 October 2026. The register lists PA-O, PA-P and PA-CB inward and outward activities, helping your team identify the authorisation relevant to its payment flow.

These categories describe different activities: PA-O covers online payment aggregation, PA-P covers physical payment aggregation, and PA-CB covers cross-border payment aggregation. For a website accepting domestic online payments, start with PA-O; for cross-border collections, also review the PA-CB scope.

Use the RBI’s register of authorised payment system operators as the starting point for authorisation. Then check your agreement and account activation for the services your business will use. This gives your team a clear link between the regulated entity, the product and your approved use case.

Did You Know? The current RBI register includes both Razorpay’s present legal name and its former name. Recording both helps your team reconcile older documents with the current authorisation entry.

For the detailed verification method, see how to verify an RBI-authorised payment aggregator.

How Can Your Business Complete KYC and Start Accepting Payments?

Complete Razorpay KYC by selecting your business type, preparing the listed documents and submitting the requested verification information. Once your live account is activated, you can start collecting payments through the services enabled for your business.

Use the current KYC documents by business type to prepare the right evidence. A proprietor, partnership and company have different identity, ownership and business-document requirements. The checklist also explains where CKYC retrieval can provide information and where supporting documents are needed.

Prepare these items as applicable to your business:

• Entity and identity information: Your business name, PAN, address and authorised signatory details.
• Ownership and authority: Incorporation or formation evidence, signatory authorisation and beneficial ownership details where requested.
• Bank information: The settlement account number, IFSC and requested verification evidence.
• Business activity: A clear description of your products or services and relevant category-specific certificates.

KYC and anti-money-laundering due diligence help establish who operates the business and what it sells. RBI’s Payment Aggregator Directions set the regulatory framework; Razorpay’s checklist turns the onboarding requirements into practical preparation steps.

Assign one person to coordinate the submission and responses. Your engineering team can prepare the integration in test mode while the business completes its activation requirements for Razorpay Payment Gateway.

How Do Escrow Accounts and Settlement Timelines Work?

An escrow account holds merchant collections separately with a scheduled commercial bank in India, as required for non-bank payment aggregators under RBI’s 2025 Directions. For your Razorpay account, use the transparently stated settlement timeline in your agreement to plan when collections reach your bank.

For your Razorpay setup, review the applicable payment aggregation terms and the settlement cycle shown for your account. The escrow framework governs how collected funds are held; the agreed settlement schedule tells your finance team when to expect the credit.

Build your reconciliation around three records: the payment or order, the settlement report and the bank credit. Check the amount, applicable adjustments and settlement reference together. This helps finance connect a customer’s payment to the amount received in the bank.

Your go-live record should include the settlement cycle, working-day treatment, applicable refund adjustments and a process for matching and resolving reconciliation entries. Razorpay’s settlement FAQs explain how to find and interpret settlement information.

Pro-Tip: Save the account’s agreed settlement cycle alongside a sample settlement report. Your finance team can then use the same reference when forecasting receipts and reconciling transactions.

How Do You Verify Razorpay’s Cross-Border Payment Authorisation?

Verify Razorpay’s cross-border authorisation through the PA-CB I & O entry for Razorpay Payments Private Limited in the RBI register. This covers inward and outward cross-border payment aggregation; match the entry to the service, eligibility and activation requirements for your international use case.

Connect regulatory verification to product setup in two steps: first check the authorised activity in the register, then confirm the service enabled for your account. Review the service documentation and agreement for supported payment methods, currencies and transaction requirements.

For overseas customer collections, explore Razorpay International Payments. Record the approved use case, required business documents, settlement arrangement and reconciliation evidence before enabling the flow. This gives your operations and finance teams a shared reference for international orders.

The Razorpay PA-CB verification guide explains how to read the authorisation entry alongside product availability.

How Does Razorpay Help You Manage PCI DSS Responsibilities?

Razorpay helps you manage PCI DSS responsibilities through its documented PCI DSS Level 1 compliance and shared responsibility model. Choose the supported checkout for your data-handling needs, then confirm your merchant validation with your acquirer or assessor to establish a clear compliance process.

For a procurement or annual review, request the current Attestation of Compliance and confirm its assessed legal entity, service scope and assessment period. Razorpay’s security documentation also lists ISO 27001:2022 and SOC 2 Type 2 and directs businesses to their Key Account Manager for certification copies. Review each document for the service you are buying.

Your integration choice helps define the next step:

Razorpay’s shared responsibility model explains these responsibilities. The PCI Security Standards Council advises merchants to confirm the appropriate Self-Assessment Questionnaire with the organisation accepting their compliance validation, typically their acquirer or payment brand.

How Do Standard Checkout, Hosted Fields and Tokenisation Fit Together?

Use Razorpay Standard Checkout for a managed payment experience and the supported tokenisation flow for saved cards. For individually embedded hosted fields, review the exact integration and card-data path with the provider to establish the architecture and PCI responsibilities before implementation.

These controls solve different parts of the payment journey. Checkout determines where a customer enters card information. Tokenisation replaces the card number with a token for supported subsequent uses. Review tokenisation and card-entry isolation as separate controls: verify the token flow in the tokenisation documentation and confirm custom-field isolation through the relevant architecture evidence.

With Razorpay TokenHQ, the documented flow captures customer consent, authenticates the transaction and requests a token from the card network or issuer. Confirm the activation and integration requirements for the TokenHQ arrangement you choose.

For your engineering review:

1. Draw the path from the customer’s card-entry screen to the payment processor.
2. Confirm which systems can receive the card data and which receive tokens or payment identifiers.
3. Select the documented checkout or tokenisation integration for that design.
4. Review the resulting PCI responsibilities with your acquirer or assessor.
5. Test the payment and saved-card flows before enabling live use.

The Standard Checkout guide and tokenisation guide provide the detailed implementation context.

How Does Razorpay Protect Payment Data and API Keys?

Razorpay documents HTTPS with TLS to protect connections and field-level encryption for sensitive personal information. Complete your payment setup by storing API secrets securely, assigning appropriate account access and verifying payment messages on your server.

Review protection at each stage: data in transit, stored personal information, saved-card tokens and access to the integration. Map each control to its purpose so your team can verify protection throughout the payment flow.

For end-to-end encryption or hardware security module requirements, complete a service-specific architecture review with supporting evidence. Confirm the decryption points, key custody, authorised access and rotation process against your requirements. Use the published TLS and field-level encryption documentation for those controls, and the architecture evidence to assess end-to-end encryption and HSM requirements separately.

Follow the Razorpay business security checklist for your side of the integration:

• Store API secrets in a secure vault with access limited to the team members who need it.
• Load API secrets securely into the trusted server environment; keep browser code, mobile app builds and repositories limited to appropriate public integration values.
• Enable two-factor authentication and assign appropriate Dashboard roles.
• Validate payment callback signatures and authenticate webhook requests.
• Confirm payment details from a trusted server-side source before fulfilling the order.

Did You Know? Tokenisation and TLS protect different parts of a payment flow. Tokenisation substitutes a token for the card number in supported uses, while TLS protects the connection carrying information between systems.

How Does Razorpay Support Customer Authentication?

Razorpay supports 3DS2 for international card payments, with browser and app/SDK authentication channels described in its documentation. For domestic cards, use the authentication flow supported by the issuer and your selected Razorpay integration, including eligible Native OTP flows where applicable.

The 3DS2 documentation explains how additional customer and device information helps the issuing bank assess the transaction. The bank can then use a frictionless or challenge flow as applicable. Verify the channel and integration requirements for your international checkout.

Razorpay’s Optimizer Native OTP documentation describes entering an OTP within checkout for supported card flows. Native OTP, automatic OTP reading and automatic submission have their own integration conditions; check the relevant network, issuer, SDK and consent requirements.

Include the expected authentication experience in your test plan for each payment method. Confirm successful completion, the applicable challenge flow and how your application handles the final payment status. The strong customer authentication guide provides additional context for domestic and international payments.

How Can You Use Fraud Detection and Risk Rules Effectively?

Use the monitoring and risk controls enabled for your payment flow, then review their effect on payment acceptance and protection using your account data. Razorpay documents geographical and payment-pattern monitoring; for Indian exporters, its Risk Analytics Dashboard provides international-payment insights and block rules for that supported use case.

Build your operating process around the capabilities enabled for your account and payment flow. Identify the role of built-in monitoring, available merchant-configured rules and any activated specialist products, then assign an owner to review each control.

The Risk Analytics Dashboard describes three useful measures: fraud-to-sales ratio, disputes-to-sales ratio and risk decline rate. Review these together so the team can assess both protection and the effect on payment acceptance.

Set a review owner, document the reason for each rule and compare the relevant measures after a change. For example, an international merchant can investigate a recurring transaction pattern, introduce an available control and review subsequent disputes and declines. Use your account data to measure the results for the transactions and configuration you review.

Pro-Tip: Review risk controls alongside legitimate payment completion. This helps your team assess whether a rule addresses the intended pattern while preserving a smooth experience for customers.

How Do You Set Up Recurring Payments With Customer Authorisation?

Set up recurring payments with Razorpay Subscriptions by creating a plan, selecting a supported payment method and obtaining the customer’s authorisation. Cards, UPI AutoPay and eMandate provide documented recurring-payment options; confirm the method and bank requirements, then track each subscription through its lifecycle.

For Razorpay Subscriptions, select the billing frequency and amount, then check the supported payment methods. Card-based subscriptions use tokenisation with explicit consent. Match the mandate amount and authentication setup to the documented requirements for your selected method.

Your implementation checklist should cover customer authorisation, the billing schedule, applicable customer notifications, renewal payments, cancellation and the handling of payment-status updates. Confirm which responsibilities the provider performs and which belong to your application under the selected flow.

Use the Subscriptions documentation to test the plan and subscription setup and configure the relevant webhooks. This gives your customer-facing team a clear way to explain when a customer will be charged and how they can manage the subscription.

What Should Your Team Check Before Going Live?

Complete one shared checklist covering business approval, checkout security and payment operations. Give every item an owner and retain the evidence so the setup can be reviewed when your business or integration changes.

1. Verify authorisation: Save the RBI register entry, its date and the contracting entity for the selected payment activity.
2. Confirm activation: Complete the applicable KYC process and verify that the required payment services are enabled.
3. Record financial terms: Save the settlement arrangement and responsibilities for reconciliation and refunds.
4. Review the data path: Confirm checkout architecture, tokenisation and the applicable PCI validation.
5. Protect access: Secure API secrets, enable two-factor authentication and assign Dashboard roles.
6. Test payment handling: Validate authentication, callback signatures, webhooks and server-side payment confirmation.
7. Check optional flows: Test international payments or subscriptions against their specific activation and method requirements.
8. Assign ongoing reviews: Name the owners for reconciliation, risk controls, access changes and refreshed compliance evidence.

Use this record alongside the current product documentation. It gives your business a practical foundation for accepting payments and a repeatable process for reviewing the setup over time.

Frequently Asked Questions

Confirm the authorised entity, checkout data path, authentication flow and security evidence for the services you plan to enable. Use the answers below to complete your launch checklist and assign the next step to the appropriate team.

Is Razorpay an RBI-authorised payment aggregator?

Yes, the RBI register dated 30 October 2026 lists Razorpay Payments Private Limited, formerly Razorpay Software Private Limited, for PA-O, PA-P and PA-CB inward and outward activities. Match the listed activity and legal entity to your agreement to complete your authorisation check.

Can Razorpay help reduce the card data my business handles?

Yes, a managed Standard Checkout integration and supported saved-card tokenisation can reduce direct card-data handling. Confirm the data path and applicable PCI validation with your acquirer or assessor, then implement the supported integration.

Does Razorpay support 3DS2 for international card payments?

Yes, Razorpay documents 3DS2 for international cards, with browser and app/SDK channels. Select the supported international channel for your integration; for domestic cards, follow the authentication flow supported by the issuer and integration.

What should I request for an encryption and key-management review?

Request the current TLS, personal-data protection and shared-responsibility documentation, together with architecture evidence for your service. Assess end-to-end encryption or HSM-backed key requirements through that architecture evidence, including key custody, access controls and rotation.

What is the best way to keep the setup ready for review?

Maintain a dated record of authorisation, account activation, current assurance documents, settlement terms and integration tests. Assign owners to refresh it when your payment methods, checkout, access permissions or business activity change.