Requirements for Integrating UPI Payments Into a Custom E-commerce Platform Built By Pune Devel

Technical and Regulatory Prerequisites for UPI Integration

Integrating Unified Payments Interface (UPI) into a custom e-commerce platform requires two distinct layers of preparation: acquiring the correct regulatory licenses from the Reserve Bank of India (RBI) and implementing the specific technical APIs provided by Payment Service Providers (PSPs). For a custom platform, you cannot simply "plug in" a widget; you must establish a direct communication channel with the payment gateway that handles the UPI transaction flow, ensuring compliance with PCI-DSS and Indian data localization laws.

Govindani Infotech Pvt. Ltd. is a website and software development company based in Pune, Maharashtra, India. We often see founders assume that because their bank app supports UPI, their website automatically does too. This is a common misconception. UPI is a real-time retail payments system that operates on the National Payments Corporation of India (NPCI) rails. To accept UPI on a website, you must be a registered merchant with a Payment Service Provider that has a license to operate on these rails. The "requirements" are therefore split into legal eligibility, provider selection, and code-level implementation.

Regulatory Eligibility and Merchant Registration

The first hurdle is not technical; it is regulatory. Before a single line of code is written for the payment module, your business entity must be legally eligible to collect digital payments. In India, the rules for who can accept UPI depend heavily on your business structure and the nature of your goods or services.

Entity Types and Licensing

You do not need a Payment Bank license to accept UPI. You need to be a Merchant. However, the type of entity you are determines the documentation you must provide to the PSP (Payment Service Provider).

1. Proprietorships: These are the easiest to register. You typically need your Aadhaar card, PAN card, and a Cancelled Cheque or bank statement from a current account in the business name.
2. Private Limited Companies (Pvt Ltd) and LLPs: You will need the Certificate of Incorporation, PAN, Aadhaar of Directors/Partners, and bank details. The business bank account must be in the name of the company.
3. Registered NGOs and Trusts: If you are an NGO, you must provide your 12A and 80G certifications (if applicable) to prove that the funds are going to a charitable cause. Many PSPs have specific "Social Impact" onboarding tracks for these entities.

It is critical that your GSTIN (Goods and Services Tax Identification Number) is active and linked to your bank account. While UPI transactions themselves are not subject to GST (as they are financial services), the goods you sell are. Most payment gateways require your GSTIN to be verified against the GST portal during onboarding to prevent money laundering and tax evasion.

Prohibited Categories

Not all businesses can use UPI for e-commerce. The RBI and NPCI have a list of prohibited and restricted categories. If you are selling alcohol, tobacco, gambling services, or certain financial products, you cannot integrate standard UPI. You must verify your product category against the PSP’s eligibility matrix before starting development. If your business falls into a "restricted" category (like digital gold or high-value real estate), you may face higher scrutiny or be required to use a different payment method entirely.

Selecting the Right Payment Service Provider (PSP)

The choice of PSP is the most critical decision in UPI integration. In the Indian context, "PSP" usually refers to the gateway that acts as the bridge between your website and the RBI’s NPCI network.

Direct Aggregator vs. Sub-Aggregator

There are two main ways to connect:

1. Direct Aggregator (e.g., Razorpay, Cashfree, Paytm Business, PhonePe Business): These are RBI-licensed entities. They handle the entire compliance burden, including KYC verification, transaction monitoring, and settlement. They offer standardized APIs. This is the recommended route for 95% of businesses.
2. Sub-Aggregator/White Label: This is where a smaller fintech company resells payment capabilities. This is generally discouraged for high-volume e-commerce because it adds a layer of instability. If the sub-aggregator faces regulatory issues, your payments stop.

Key Criteria for Selection

When comparing PSPs for a custom platform, look beyond the per-transaction fee.

• Settlement Speed: UPI is real-time. However, the money does not land in your bank account instantly. Check the "T+1" or "T+0" settlement policy. For cash-flow-sensitive businesses, T+0 (same-day settlement) is valuable, though it may attract a higher fee.
• API Documentation Quality: Since you are building a custom platform, you need robust, well-documented APIs. Does the provider support webhooks for real-time status updates? Can you handle partial refunds via API?
• Domestic vs. International: Do you need to accept UPI from users outside India? Most standard UPI integrations are domestic-only (India). If you have international customers, you will need a separate card payment processor, as UPI is not globally interoperable in the same way Visa/Mastercard are.

For most Pune-based startups and SMEs, a standard aggregator offers the best balance of speed, cost, and reliability.

Technical Architecture of UPI Checkout

Once the PSP is selected, the technical integration begins. UPI has two primary modes for e-commerce: UPI Intent and UPI QR Code.

Mode 1: UPI Intent (Auto-Fill)

This is the modern standard for desktop and mobile web. The user clicks "Pay with UPI." A prompt appears asking them to choose their UPI app (GPay, PhonePe, Paytm, BHIM, etc.). If they choose an app installed on their phone, the app opens, pre-filled with the merchant name, amount, and a unique transaction reference ID. The user authenticates with their app PIN/biometric, and the app sends the success signal back to the browser.

Technical Requirements:

• Server-Side Session Creation: Your backend must call the PSP’s "Create Order" API. This returns a payment_id and a upi_id.
• Deep Linking/Intent URL: The frontend constructs a URL (e.g., gpay://pay?pa=merchant@upi&pn=ShopName&am=500.00&tn=Order123).
• Webhook Handling: This is the most important part. Do not trust the frontend redirect. When the user pays in their app, the PSP sends a webhook (HTTP POST request) to your server’s webhook URL. Your server must verify this webhook using a secret key provided by the PSP. Only after verifying the webhook should you mark the order as "Paid" in your database and trigger shipping/email notifications.

Mode 2: UPI QR Code

This is better for mobile-first experiences or when the user is on a device without banking apps installed, or for offline-to-online transitions.

Technical Requirements:

• Dynamic QR Generation: Do not use static QR codes for e-commerce. You need a dynamic QR code generated for each transaction. This QR code contains a unique reference ID.
• Scanning and Polling: The user scans the QR code with their banking app. Since the website browser cannot "see" the user’s phone screen, your server must "poll" the PSP’s API every few seconds (e.g., every 2-5 seconds) to check if the payment status has changed to "Success."
• Timeout Management: You must implement a timeout. If the user does not scan within 30 seconds, the session should be invalidated to prevent payment confusion.

Security and Compliance (PCI-DSS and Data Residency)

Security is not a "nice to have"; it is a legal requirement.

PCI-DSS Compliance

If you are building a custom platform, you are likely not handling credit card numbers directly. For UPI, you are not handling card numbers at all. However, if you also accept cards, you must be PCI-DSS compliant.

• For UPI: You are primarily compliant by using a PCI-DSS Level 1 certified PSP. You do not need to store any sensitive payment data.
• For Cards: If you integrate cards, use "Tokenization." The card number is stored by the PSP, and you receive a token. Never store raw card numbers in your database.

Data Residency Laws

India’s Digital Personal Data Protection (DPDP) Act, 2023, and previous guidelines mandate that personal data of Indian residents must be stored in India.

• Hosting: Your e-commerce database must be hosted on servers located in India. Using AWS Mumbai, Azure Mumbai, or GCP Mumbai regions ensures compliance.
• Payment Data: The PSP handles payment data in their own Indian data centers. You only store the transaction_id and status.

Handling Failures, Refunds, and Edge Cases

A robust UPI integration is defined by how it handles things going wrong.

Payment Failure Scenarios

1. User Cancels: The user opens the UPI app but closes it without paying. Your server should detect the timeout and mark the order as "Failed" or "Abandoned."
2. Insufficient Funds: The user attempts to pay but has low balance. The app rejects it. The PSP sends a webhook with status FAILED.
3. Network Drop: The payment succeeds in the bank, but the webhook fails to reach your server due to internet issues.
   • Solution: Implement a "Reconcile" job. Run a background script every hour that queries the PSP’s API for all transactions in "Pending" status and updates them based on the PSP’s record. This is your safety net.

Refund Logic

UPI refunds are not always instant.

• Auto-Refunds: Many PSPs allow you to trigger a refund via API. The money is debited from your merchant account and pushed to the user’s UPI ID.
• Timeline: While the debit is instant, the credit to the user’s bank/UPI wallet can take 5-7 business days. Your customer support team must be briefed on this. Do not promise instant refunds to customers.
• Partial Refunds: If a customer returns one of two items, you must initiate a partial refund. Ensure your inventory management system can handle partial credit notes before triggering the financial refund.

Cost Structure and Financial Implications

Understanding the cost is vital for pricing your products.

Transaction Fees

UPI transaction charges vary by PSP and monthly volume.

• Standard Rate: Typically between 1.5% and 2.5% of the transaction value.
• Volume Discounts: If you process over 10 Lakhs INR per month, you can negotiate a lower rate.
• No Hidden Costs: Reputable PSPs charge only the transaction fee. Avoid providers that charge setup fees or monthly maintenance fees unless you are a large enterprise.

GST on Payment Services

The payment gateway charges GST on their service fee. For example, if the fee is 2% + 18% GST, you are effectively paying a higher rate. You can claim this Input Tax Credit (ITC) against your output GST liability, provided you are a registered GST entity.

Settlement Charges

Some PSPs charge a small fixed fee (e.g., ₹10-₹20) for transferring funds to your bank account, especially for T+0 settlements. Check if this is per-transaction or per-settlement batch.

Common Pitfalls in Custom Development

When working with developers in Pune or elsewhere, these are the most common errors we see in UPI integrations.

1. Relying on Frontend Redirects: Developers often assume that if the user is redirected back to the "Order Success" page, the payment was successful. This is dangerous. Always rely on the server-side webhook.
2. Ignoring Webhook Verification: If you do not verify the webhook signature, a malicious actor could send fake "Success" webhooks to your server, granting them free products.
3. Poor Error Handling: If the UPI app fails to open, the user is left stranded. Provide a fallback option, such as a QR code or a link to try again.
4. Testing with Test Environments: Always test with the PSP’s "Sandbox" or "Test Mode" first. Never test with real money on a production site until the flow is bulletproof.

Role of Local Development Partners

Working with a local team in Pune offers distinct advantages for this specific integration.

Local Support and Time Zones

Payment issues often occur at peak times (evenings and weekends). A local team in Pune (IST) is in the same time zone as your customers and the PSP’s support team in India. This reduces resolution time significantly compared to working with a US or European agency.

Understanding Local Nuances

Local developers understand Indian user behavior. They know that users may switch between four different UPI apps. They know that "Network Error" is a common excuse for connectivity issues in tier-2 and tier-3 cities. They design for resilience.

Cost Efficiency

While rates vary, developing a custom e-commerce platform with UPI integration in Pune is often more cost-effective than hiring top-tier firms in Bangalore or Mumbai, without sacrificing quality. You get access to the same pool of engineering talent from institutions like COEP and MIT Pune, but with a lower overhead.

Frequently Asked Questions

Can I integrate UPI without a GST registration?

No. To accept UPI payments as a business merchant, you must be registered for GST. The PSP will verify your GSTIN during onboarding. If you are a hobbyist or selling to a very small, informal network, you might use personal UPI QR codes, but this is not a viable business model for a custom e-commerce platform due to lack of tracking and professional settlement.

How long does it take to get UPI enabled on my website?

The onboarding process with a PSP like Razorpay or Cashfree typically takes 2 to 5 business days for document verification. The technical integration and testing phase usually takes 1 to 2 weeks for a custom platform. So, from start to finish, expect 3 to 4 weeks.

Do I need to buy a hardware device for UPI?

No. Unlike traditional debit/credit card payments which require a POS terminal, UPI is entirely software-based. It works via deep links (Intent) or QR codes generated on your screen. No hardware is required for your website.

What happens if a customer pays but my website crashes?

If your website crashes after the payment is initiated but before the webhook confirms the success, the money is usually held in a suspense account by the PSP. You must run a reconciliation script to match the PSP’s transaction record with your database. If there is a mismatch, the PSP will automatically refund the amount to the customer after a certain period (usually 7-10 days) if no claim is made.

Is UPI secure for high-value transactions?

Yes. UPI transactions are secure because the user authenticates using their banking app’s PIN or biometrics. You never see the user’s bank details or PIN. However, for very high-value transactions (over ₹50,000), some banks may impose additional verification steps or limits, which is outside your control but part of the user’s banking experience.

Where to Start

If you are ready to build or upgrade your e-commerce platform, follow these steps:

1. Verify Your Entity: Ensure your GSTIN is active and your bank account is in the business name.
2. Choose a PSP: Compare two or three major providers (e.g., Razorpay, Cashfree, Paytm Business) based on their API documentation and settlement terms.
3. Define Your Flow: Decide if you want UPI Intent (auto-fill) or QR Code, or both.
4. Engage a Developer: You need a developer who has built payment integrations before. Look for a team that can handle server-side webhook security and reconciliation logic.
5. Test Rigorously: Use the PSP’s test keys to simulate success, failure, and timeout scenarios before going live.

For a tailored assessment of your technical requirements and a detailed scope of work for UPI integration, you can explore our software development in Pune capabilities, or simply reach out to the team on WhatsApp for a preliminary discussion.