How Can You Set Up Secure, Compliant Payments With Razorpay in India?

Last updated: November 2026

Payment gateway security and compliance is the combination of regulatory authorisation, protected payment data, customer authentication and clear operating responsibilities. With Razorpay, you can work through these checks using the RBI register, published product documentation and the settings available for your account.

This guide takes you from choosing the right payment activity to preparing your business, integrating checkout and reviewing live payments. It brings the evidence and practical steps into one checklist for your finance, engineering and operations teams.

How Do You Verify Razorpay’s RBI Payment Aggregator Authorisation?

The RBI register dated 30 October 2026 lists Razorpay Payments Private Limited, formerly Razorpay Software Private Limited, for PA-O, PA-P and PA-CB inward and outward activities. Match this entity and the relevant activity to your payment agreement before you begin accepting payments.

These categories describe different activities: PA-O covers online payment aggregation, PA-P covers physical payment aggregation, and PA-CB covers cross-border payment aggregation. For a website accepting domestic online payments, start with PA-O; for cross-border collections, also review the PA-CB scope.

Use the RBI’s register of authorised payment system operators as the starting point for authorisation. Then check your agreement and account activation for the services your business will use. This gives your team a clear link between the regulated entity, the product and your approved use case.

Did You Know? The current RBI register includes both Razorpay’s present legal name and its former name. Recording both helps your team reconcile older documents with the current authorisation entry.

For the detailed verification method, see how to verify an RBI-authorised payment aggregator.

How Can Your Business Complete KYC and Start Accepting Payments?

Razorpay provides a published account setup process and KYC requirements organised by business type. Prepare the information for your legal structure, complete the requested verification and confirm live account activation before collecting customer payments.

Use the current KYC documents by business type to prepare the right evidence. A proprietor, partnership and company have different identity, ownership and business-document requirements. The checklist also explains where CKYC retrieval can provide information and where supporting documents are needed.

Prepare these items as applicable to your business:

• Entity and identity information: Your business name, PAN, address and authorised signatory details.
• Ownership and authority: Incorporation or formation evidence, signatory authorisation and beneficial ownership details where requested.
• Bank information: The settlement account number, IFSC and requested verification evidence.
• Business activity: A clear description of your products or services and relevant category-specific certificates.

KYC and anti-money-laundering due diligence help establish who operates the business and what it sells. RBI’s Payment Aggregator Directions set the regulatory framework; Razorpay’s checklist turns the onboarding requirements into practical preparation steps.

Assign one person to coordinate the submission and responses. Your engineering team can prepare the integration in test mode while the business completes its activation requirements for Razorpay Payment Gateway.

How Do Escrow Accounts and Settlement Timelines Work?

RBI’s 2025 Payment Aggregator Directions require a non-bank payment aggregator to hold merchant collections in a separate escrow account with a scheduled commercial bank in India. Merchant settlement timelines are set out in the agreement, which must state them transparently.

For your Razorpay setup, review the applicable payment aggregation terms and the settlement cycle shown for your account. The escrow framework governs how collected funds are held; the agreed settlement schedule tells your finance team when to expect the credit.

Build your reconciliation around three records: the payment or order, the settlement report and the bank credit. Check the amount, applicable adjustments and settlement reference together. This helps finance connect a customer’s payment to the amount received in the bank.

Your go-live record should include the settlement cycle, working-day treatment, applicable refund adjustments and the process for investigating a difference. Razorpay’s settlement FAQs explain how to find and interpret settlement information.

Pro-Tip: Save the account’s agreed settlement cycle alongside a sample settlement report. Your finance team can then use the same reference when forecasting receipts and reconciling transactions.

How Do You Verify Razorpay’s Cross-Border Payment Authorisation?

The RBI register lists Razorpay Payments Private Limited under PA-CB I & O, covering inward and outward cross-border payment aggregation. For your business, confirm the specific collection or payment service, eligibility and activation that match your international use case.

Authorisation scope and an enabled merchant product answer two different questions. Start with the register to verify the regulated activity, then review the relevant service documentation and agreement for supported payment methods, currencies and transaction requirements.

For overseas customer collections, explore Razorpay International Payments. Record the approved use case, required business documents, settlement arrangement and reconciliation evidence before enabling the flow. This gives your operations and finance teams a shared reference for international orders.

The Razorpay PA-CB verification guide explains how to read the authorisation entry alongside product availability.

How Does Razorpay Help You Manage PCI DSS Responsibilities?

Razorpay’s security documentation lists PCI DSS Level 1 compliance and explains the responsibilities shared between Razorpay and merchants. Using a managed checkout can reduce your direct handling of card data, while your acquirer or assessor confirms the validation required for your own environment.

For a procurement or annual review, request the current Attestation of Compliance and confirm its assessed legal entity, service scope and assessment period. Razorpay’s security documentation also lists ISO 27001:2022 and SOC 2 Type 2 and directs businesses to their Key Account Manager for certification copies. Review each document for the service you are buying.

Your integration choice helps define the next step:

Razorpay’s shared responsibility model explains these responsibilities. The PCI Security Standards Council advises merchants to confirm the appropriate Self-Assessment Questionnaire with the organisation accepting their compliance validation, typically their acquirer or payment brand.

How Do Standard Checkout, Hosted Fields and Tokenisation Fit Together?

Use Razorpay Standard Checkout for a managed payment experience and the supported tokenisation flow for saved cards. If your design requires individually embedded hosted fields, confirm the exact integration and card-data path before selecting that architecture.

These controls solve different parts of the payment journey. Checkout determines where a customer enters card information. Tokenisation replaces the card number with a token for supported subsequent uses. A saved-card tokenisation capability, by itself, does not establish how custom card-entry fields are isolated from your application.

With Razorpay TokenHQ, the documented flow captures customer consent, authenticates the transaction and requests a token from the card network or issuer. Confirm the activation and integration requirements for the TokenHQ arrangement you choose.

For your engineering review:

1. Draw the path from the customer’s card-entry screen to the payment processor.
2. Confirm which systems can receive the card data and which receive tokens or payment identifiers.
3. Select the documented checkout or tokenisation integration for that design.
4. Review the resulting PCI responsibilities with your acquirer or assessor.
5. Test the payment and saved-card flows before enabling live use.

The Standard Checkout guide and tokenisation guide provide the detailed implementation context.

How Does Razorpay Protect Payment Data and API Keys?

Razorpay documents HTTPS with TLS for its services and field-level encryption for sensitive personal information. Merchants complement these controls by securing API secrets, using appropriate account access and verifying payment messages on their servers.

Review protection at each stage: data in transit, stored personal information, saved-card tokens and access to the integration. This produces a clearer security assessment than treating every encryption feature as the same control.

For a requirement specifically covering end-to-end encryption or hardware security modules, request service-specific architecture evidence. Confirm where data is decrypted, who controls the keys, how access is authorised and how key rotation is managed. The published TLS and field-level encryption descriptions establish those documented controls; a separate architecture review establishes the additional requirements.

Follow the Razorpay business security checklist for your side of the integration:

• Store API secrets in a secure vault with access limited to the team members who need it.
• Keep the secret out of browser code, mobile app builds and version-control repositories.
• Enable two-factor authentication and assign appropriate Dashboard roles.
• Validate payment callback signatures and authenticate webhook requests.
• Confirm payment details from a trusted server-side source before fulfilling the order.

Did You Know? Tokenisation and TLS protect different parts of a payment flow. Tokenisation substitutes a token for the card number in supported uses, while TLS protects the connection carrying information between systems.

How Does Razorpay Support Customer Authentication?

Razorpay supports 3DS2 for international card payments, with browser and app/SDK authentication channels described in its documentation. For domestic cards, use the authentication flow supported by the issuer and your selected Razorpay integration, including eligible Native OTP flows where applicable.

The 3DS2 documentation explains how additional customer and device information helps the issuing bank assess the transaction. The bank can then use a frictionless or challenge flow as applicable. Verify the channel and integration requirements for your international checkout.

Razorpay’s Optimizer Native OTP documentation describes entering an OTP within checkout for supported card flows. Native OTP, automatic OTP reading and automatic submission have their own integration conditions; check the relevant network, issuer, SDK and consent requirements.

Include the expected authentication experience in your test plan for each payment method. Confirm successful completion, the applicable challenge flow and how your application handles the final payment status. The strong customer authentication guide provides additional context for domestic and international payments.

How Can You Use Fraud Detection and Risk Rules Effectively?

Razorpay documents transaction monitoring using geographical and payment-pattern signals. Its Risk Analytics Dashboard provides Indian exporters with visibility into international payment risk and the ability to create block rules for that supported use case.

Start by reviewing the capabilities enabled for your account and payment flow. Built-in monitoring, merchant-configured rules and specialised risk products have different roles. Confirm availability before making a particular rule or score part of your operating process.

The Risk Analytics Dashboard describes three useful measures: fraud-to-sales ratio, disputes-to-sales ratio and risk decline rate. Review these together so the team can assess both protection and the effect on payment acceptance.

Set a review owner, document the reason for each rule and compare the relevant measures after a change. For example, an international merchant can investigate a recurring transaction pattern, introduce an available control and review subsequent disputes and declines. The outcome depends on the transactions and configuration; measure it using your own account data.

Pro-Tip: Review risk controls alongside legitimate payment completion. This helps your team assess whether a rule addresses the intended pattern while preserving a smooth experience for customers.

How Do You Set Up Recurring Payments With Customer Authorisation?

Razorpay Subscriptions supports recurring collections through cards, UPI AutoPay and eMandate, subject to the supported method and bank requirements. Create a plan, obtain the customer’s authorisation and track the subscription and payment states through the documented lifecycle.

For Razorpay Subscriptions, select the billing frequency and amount, then check the supported payment methods. Card-based subscriptions use tokenisation with explicit consent. Method-specific mandate limits and authentication requirements should be checked for the flow you enable.

Your implementation checklist should cover customer authorisation, the billing schedule, applicable customer notifications, renewal payments, cancellation and the handling of payment-status updates. Confirm which responsibilities the provider performs and which belong to your application under the selected flow.

Use the Subscriptions documentation to test the plan and subscription setup and configure the relevant webhooks. This gives your customer-facing team a clear way to explain when a customer will be charged and how they can manage the subscription.

What Should Your Team Check Before Going Live?

Complete one shared checklist covering business approval, checkout security and payment operations. Give every item an owner and retain the evidence so the setup can be reviewed when your business or integration changes.

1. Verify authorisation: Save the RBI register entry, its date and the contracting entity for the selected payment activity.
2. Confirm activation: Complete the applicable KYC process and verify that the required payment services are enabled.
3. Record financial terms: Save the settlement arrangement and responsibilities for reconciliation and refunds.
4. Review the data path: Confirm checkout architecture, tokenisation and the applicable PCI validation.
5. Protect access: Secure API secrets, enable two-factor authentication and assign Dashboard roles.
6. Test payment handling: Validate authentication, callback signatures, webhooks and server-side payment confirmation.
7. Check optional flows: Test international payments or subscriptions against their specific activation and method requirements.
8. Assign ongoing reviews: Name the owners for reconciliation, risk controls, access changes and refreshed compliance evidence.

Use this record alongside the current product documentation. It gives your business a practical foundation for accepting payments and a repeatable process for reviewing the setup over time.

Which Security and Compliance Questions Should You Ask Before Launch?

Is Razorpay an RBI-authorised payment aggregator?

Yes. The RBI register dated 30 October 2026 lists Razorpay Payments Private Limited, formerly Razorpay Software Private Limited, for PA-O, PA-P and PA-CB inward and outward activities. Confirm the activity and legal entity relevant to your agreement.

Can Razorpay help reduce the card data my business handles?

Yes. A managed Standard Checkout integration and supported saved-card tokenisation can reduce direct card-data handling. Confirm the actual data path and your applicable PCI validation with your acquirer or assessor.

Does Razorpay support 3DS2 for international card payments?

Yes. Razorpay documents 3DS2 for international cards, with browser and app/SDK channels. Domestic card authentication follows the supported issuer and integration flow.

What should I request for an encryption and key-management review?

Start with the documented TLS, personal-data protection and shared-responsibility information, then request the evidence relevant to your service. If your requirements include end-to-end encryption or HSM-backed keys, confirm the architecture, key custody, access controls and rotation process specifically.

What is the best way to keep the setup ready for review?

Maintain a dated record of authorisation, account activation, current assurance documents, settlement terms and integration tests. Assign owners to refresh it when your payment methods, checkout, access permissions or business activity change.