What is a custom payment gateway and when is it appropriate?
A custom payment gateway is a software solution that connects a merchant’s website or app directly to acquiring banks, payment processors, and settlement systems, handling transaction authorization, capture, and reconciliation according to the merchant’s specific rules. It is appropriate when off‑the‑shelf gateways do not meet unique workflow, branding, or integration requirements.
Govindani Infotech Pvt. Ltd. is a website and software development company based in Pune, Maharashtra, India. For many Indian NGOs, small‑business owners, D2C brands, schools, clinics and agencies, the decision to build a custom gateway versus using a ready‑made service hinges on factors such as transaction volume, regulatory burden, technology stack, and long‑term support needs. In the following sections we break down those factors in a way that a Pune buyer can evaluate without getting lost in vendor marketing material.
Core functional considerations
A custom payment gateway must reliably handle the core functions that any payment system requires, plus any extra features the business needs.
Transaction flow control
The gateway should support authorization, capture, refund, void, and settlement in the exact sequence the merchant prefers. Some businesses need to hold funds for a few days before capture (e.g., travel bookings) while others capture instantly (e‑commerce). Clarify the required flow early, because it determines the API design and the need for asynchronous processing.
Multi‑modal support
India’s payment landscape includes UPI, debit/credit cards, net‑banking, wallets (Paytm, PhonePe), and emerging options like BNPL. A custom solution can expose all these methods under a single UI, but each channel brings its own API, settlement schedule, and dispute process. Decide which modalities are essential for your customers and whether you will add more later.
Currency and settlement preferences
If you operate only in INR, the gateway can be optimized for local clearing houses (NPCI, RBI). If you accept foreign cards, you’ll need to route through international acquirers and handle FX conversion. The choice affects the bank relationships you must establish.
Reporting and reconciliation
Out‑of‑the‑box gateways often provide dashboards, but a custom build can generate reports that match your accounting software (Tally, Zoho Books, QuickBooks India). Identify the data points you need—transaction ID, GST amount, surcharge, settlement date—and ensure the gateway can export them in a format your finance team uses.
User experience and branding
A custom gateway lets you control the look and feel of the checkout page, keep the user on your domain, and avoid the “redirect to bank” experience that can cause drop‑offs. If brand consistency is a priority, this is a strong argument for a bespoke solution.
Regulatory and compliance landscape in India
Payment processing in India is tightly regulated. Non‑compliance can lead to fines, blocked accounts, or loss of merchant licence.
RBI and NPCI mandates
The Reserve Bank of India (RBI) requires all payment aggregators and gateways to be registered and to follow the “Guidelines for Payment System Operators”. This includes maintaining a minimum net worth, implementing strong customer authentication (SCA) as per the Indian version of PSD2, and adhering to the “Three‑Domain Model” (Acquirer, Issuer, Switch). A custom gateway must be built with these rules in mind, otherwise you will need to partner with a certified aggregator.
PCI‑DSS compliance
Any system that stores, processes, or transmits cardholder data must meet the Payment Card Industry Data Security Standard. Level 1 compliance (for > 300,000 transactions per year) involves quarterly scans, tokenization, and strict access controls. If you plan to handle card data directly, budget for the audit and ongoing compliance work.
GST and tax reporting
Every transaction is subject to GST on the service fee charged by the gateway. Your system should automatically calculate GST at the applicable rate (typically 18 % for financial services) and generate GST‑compliant invoices. Failure to do so can attract penalties from the tax authorities.
Data residency and privacy
Indian data protection rules, while still evolving, encourage storing personal data on servers located in India. Hosting your gateway on a Pune data centre or an Indian cloud region (AWS Mumbai, Azure Central India) can simplify compliance and reduce latency for domestic users.
Technical architecture choices
The architecture you pick determines scalability, security, and future extensibility.
Monolithic vs microservices
A monolithic gateway can be quicker to prototype, but as transaction volume grows, separating concerns into microservices (e.g., authentication service, transaction service, notification service) offers better fault isolation and independent scaling. For a startup expecting rapid growth, a microservice approach—containerized with Docker and orchestrated by Kubernetes—makes sense, albeit with higher initial complexity.
On‑premises vs cloud deployment
On‑premises hosting gives you full control over hardware and network, which some regulated banks still prefer. However, cloud platforms in India provide built‑in DDoS protection, auto‑scaling, and managed databases, reducing operational overhead. A hybrid model—core transaction processing on‑premises, reporting and analytics in the cloud—can satisfy both security and flexibility requirements.
API design (REST vs GraphQL vs gRPC)
Most Indian payment processors expose REST endpoints, so a REST‑ful API is the path of least resistance. If you anticipate high‑frequency, low‑latency calls (e.g., for UPI push notifications), gRPC over HTTP/2 can lower overhead. GraphQL is useful when the front‑end needs flexible data shapes, but it adds a layer of complexity that may not be justified for a payment gateway.
Database selection
Transactional integrity is paramount. Relational databases (PostgreSQL, MySQL) with ACID guarantees are standard for storing payment logs. Some organisations augment them with a NoSQL store (MongoDB, DynamoDB) for event‑driven analytics, but the core ledger should remain in a proven RDBMS.
Security layers
Implement tokenization to replace PAN (Primary Account Number) with a reversible token stored securely. Use TLS 1.3 for all external communication, and enforce mutual TLS for internal service‑to‑service calls. Integrate with a fraud‑detection engine (e.g., Razorpay Radar, local AI models) early to avoid retrofitting.
Build in‑house vs outsource development
Choosing who writes the code has a direct impact on risk, cost, and control.
| Option | Control over design | Time to market | Ongoing support | Typical cost range* | Typical risk profile |
|---|---|---|---|---|---|
| Build in‑house (Pune team) | Highest – you own every line | Longer (6–12 months) | Direct, but depends on internal staffing | High – salaries, infrastructure, compliance audits | Medium – requires strong internal expertise |
| Outsource to local vendor (e.g., Govindani Infotech) | High – close collaboration, same time zone | Moderate (4–8 months) | Vendor provides SLA‑based support | Moderate – project‑based fees, GST applicable | Low to medium – vendor familiarity with Indian regulations |
| Outsource to offshore firm | Moderate – communication lag, cultural differences | Shorter (3–6 months) | Support often limited to business hours | Lower – lower hourly rates, but hidden costs may appear | Higher – compliance knowledge may be limited |
| Use a SaaS aggregator (Razorpay, PayU) | Low – limited to API features | Immediate (days) | Vendor handles updates, security | Low to moderate – per‑transaction fees, no large upfront spend | Low – compliance handled by provider |
*Cost ranges are indicative and depend on transaction volume, feature set, and compliance scope; exact numbers are confirmed by the team on WhatsApp.
When to build in‑house
If your business model relies on proprietary settlement rules, dynamic routing, or deep integration with legacy ERP systems, owning the codebase gives you the flexibility to iterate quickly. You also avoid recurring per‑transaction fees that can erode margins at high volumes.
When to outsource locally
For most Indian SMEs and NGOs, the expertise required for PCI‑DSS, RBI registration, and UPI integration is scarce. A local vendor familiar with Indian banking APIs can accelerate compliance, reduce the learning curve, and provide post‑launch support in Marathi or Hindi, which is valuable for regional operations.
When to consider SaaS
If your monthly transaction count is modest (< 10 k) and you need a quick go‑live, a SaaS aggregator is cost‑effective. The trade‑off is limited branding control and higher per‑transaction fees, which become noticeable as volume scales.
Cost and timeline factors (general guidance)
Exact pricing depends on scope, but understanding the cost drivers helps you budget realistically.
Development effort
A basic custom gateway with card, UPI, and wallet support typically requires 2–3 senior developers, 1 security specialist, and 1 project manager for 4–6 months. Add-ons such as subscription billing, recurring payments, or multi‑currency support can add another 1–2 months per feature.
Compliance and certification
PCI‑DSS Level 1 audits can cost anywhere from a few lakhs to over a lakh rupees, depending on the auditor and the size of the codebase. RBI registration fees are modest (around ₹ 5,000–₹ 10,000) but the process can take several weeks, especially if you need to demonstrate net‑worth and governance structures.
Infrastructure
Running a production‑grade gateway on a cloud provider in Mumbai typically costs ₹ 15,000–₹ 30,000 per month for compute, storage, and network, assuming moderate transaction load. On‑premises hardware adds capital expenditure and maintenance contracts.
Ongoing operational costs
Security patches, token rotation, and periodic compliance scans are recurring items. Budget for at least 10 % of the initial development cost per year for maintenance, plus GST on any professional services you retain.
GST impact
All professional services (development, audit, consulting) attract 18 % GST, which is recoverable if your organization is GST‑registered. Transaction fees charged by your gateway to merchants also attract GST, which you must remit.
Ongoing maintenance, security, and support
A payment gateway is never “finished”. Continuous vigilance is required.
Patch management
Card network updates (Visa, Mastercard, RuPay) occur several times a year. Your gateway must ingest new cryptographic keys and protocol changes within the vendor’s maintenance window. Automate testing with a sandbox that mirrors production to avoid downtime.
Fraud and risk monitoring
Integrate with real‑time fraud APIs and maintain a rules engine that can be updated without redeploying code. Machine‑learning models improve over time, so allocate resources for data collection and model retraining.
Disaster recovery
Design a failover strategy that includes a secondary data centre (e.g., another region in India) and a hot‑standby replica of the transaction service. Test the recovery process quarterly; the RBI expects a recovery time objective (RTO) of less than 4 hours for critical payment services.
Customer support
Your merchants will need assistance with settlement queries, failed transactions, and chargebacks. Provide a ticketing system integrated with the gateway’s logs, and ensure support staff are trained on PCI‑DSS and RBI guidelines.
Scaling considerations
As transaction volume grows, you may need to shard the database by merchant ID, use a message queue (Kafka, RabbitMQ) for asynchronous processing, and enable auto‑scaling groups for the API tier. Monitoring tools (Prometheus, Grafana) should alert on latency spikes, error rates, and throughput thresholds.
Frequently Asked Questions
What is the difference between a custom payment gateway and a payment aggregator?
A custom gateway is a bespoke software layer you own, handling the entire transaction flow and settlement logic. A payment aggregator (e.g., Razorpay) provides a ready‑made API that abstracts those details and pools multiple merchants under a single licence. The former offers full control; the latter offers speed and lower compliance burden.
Do I need PCI‑DSS certification if I only use tokenized card data?
If your system never stores or processes raw PAN and relies solely on tokenization provided by a PCI‑DSS‑certified processor, you may qualify for a reduced scope assessment. However, you still need to demonstrate that token handling follows the PCI‑DSS guidelines, and an auditor will verify that.
Can a custom gateway handle UPI transactions without a third‑party aggregator?
Yes, but you must obtain a UPI licence from NPCI and integrate with the Unified Payments Interface APIs directly. This involves additional compliance steps, such as setting up a KYC process for merchants and adhering to NPCI’s transaction limits.
How does GST apply to the fees I charge merchants through my gateway?
The service fee you collect is considered a taxable supply under GST law, so you must charge 18 % GST on that fee and issue a GST‑compliant invoice. The GST you collect is payable to the government, and you can claim input tax credit on GST paid for development and infrastructure expenses.
What are the typical timelines for RBI registration of a new payment gateway?
The RBI registration process usually takes 4–6 weeks, assuming you have the required net‑worth, board resolution, and documentation ready. Delays often arise from incomplete KYC documents or pending security audit reports.
Is it possible to migrate from a SaaS aggregator to a custom gateway later?
Migration is feasible but requires careful data migration (transaction history, settlement records) and re‑certification of compliance. You’ll also need to inform your merchants and possibly obtain consent for the change in processing flow.
Where to Start
- List the payment methods, settlement rules, and reporting formats your business truly needs.
- Conduct a preliminary compliance checklist: RBI registration, PCI‑DSS scope, GST obligations.
- Choose the development model (in‑house, local outsource, or SaaS) based on the comparison table above.
- Engage a trusted Pune‑based partner—such as Govindani Infotech services—to validate your technical architecture and prepare a detailed proposal.
If you would like a personalized assessment, feel free to message us on WhatsApp.