Indian online merchants cannot store credit card information from 2022

PayPal restrictions exist because india doesn't have free capital account convertibility and forex providers need to implement regulatory mechanisms to comply with forex regulations. The regulations on forex haven't changed in many years. It's paypal who isn't bothered to comply with mechanisms implemented and hence removed those features as they felt customers like you aren't worth it to them.

Most developing countries have capital controls like India for financial stability reasons and removing it for the sake of small segment of entrepreneurs feeling difficulty to process some payments or can't manage the accounting is not in the interest of the state or it's people.

Stripe thinks you are worth it to them and are providing that service. Find better service providers. Talk to a bank.

As far as GST is concerned, every country has tax accounting. Some other countries like in Europe have it way worse on the paperwork. Have you ever dealt with pre-GST service tax or VAT paperwork? Accounting is a universal thing and it's the reality of doing business.If you think just by jumping one country to the other you can avoid taxes or paperwork you need to rethink your approach to business. Most countries who don't have taxes or tax paperwork are just tax havens living off someone else's money. Will you go to NZ/Canada and not do their tax paperwork?

If it's getting harder, maybe your size is large enough to hire an accountant to do that work for you.

If you have so many customers overseas maybe you better incorporate a foreign subsidiary or an IFSC subsidiary to manage USD transactions.

These rules won't be changed for you - there are larger socio economic reasons for the rules.

It seems here people see this rule as "merchants can't store card numbers any more". This is actually a lot more than that, this is the new rule: you cannot store card numbers for recurring payment. Even if you are PCI-DSS compliant. Even if you are audited by the RBI. Even if you're sponsored by a bank. The only way to store a Visa number is to use the Visa tokenization service.

Now if you know a bit of the card payment industry, you will know that you need the card number just to process the payment, the refund, etc. So you still have to store the card number. And you can. You just can't use it for recurring payment any more.

My personal take: Giving full control to Visa and Mastercard over their card numbers for recurring payment seems to be a nice transfer of power to these two giants. But the time scale has been very short (a few months only). So practically, most recurring card payments will stop working or be illegal in two weeks. This is will more or less break existing subscriptions working with cards.

India (the RBI at least) has been in a campaign for independence in the payment infrastructure. American Express[0], Diners[1], Mastercard[2] have been banned in India. Diners' ban has been lifted now, but still. Rupay is a failure with a market share of 0.34%[3] (in comparison UPI is at 37.73%), in spite of having ZERO MDR on debit transactions[4].

This change is not for the sake of security. You can have the best firewalls, cutting-edge HSM, security team and pass 12 audits a year. You will be allowed to save these card numbers but you won't be able to authorized to use it for recurring payments. This is just a move against cards, and to promote UPI instead. By making recurring card payment a hindrance, more people will transition to UPI.

[0] https://www.americanexpress.com/en-in/company/notice/rbi-imp... [1] https://www.reuters.com/article/india-banking-american-expre... [2] https://westfaironline.com/138440/mastercard-banned-from-new... [3] https://www.npci.org.in/PDF/npci/statics/RETAIL-PAYMENTS-STA... [4] https://economictimes.indiatimes.com/opinion/et-editorial/st...

I don't have the experience to know if this is actually the case, but it seems completely plausible that different countries have different regulations (or enforcement thereof) such that US companies have to care about PCI more than Indian companies.

> These $100B in annual sales aren't processed by script kiddies, it's a very large and mature industry.

Those are less connected than you think; loads of companies run obscenely large monetary transactions and essential business processes with horrifying hacked-up systems (50k LoC files, 20-year-old Perl scripts that nobody understands, Solaris 2.x desktop in the maintenance closet...); utility and good code are less correlated than we wish.

Whereas the Indian Model is "Pessimistic". Put in as much checks as possible to reduce the rate of fraud before the transaction has even completed.

Thoughts?