E-Commerce FDI Compliance Checklist: Press Note 2 & Marketplace Rules

Why E-Commerce FDI Compliance Demands a Structured Approach

India permits 100% foreign direct investment in e-commerce marketplace entities under the automatic route -- but only if the platform operates as a pure marketplace. The distinction between marketplace and inventory-based models is not theoretical: the Enforcement Directorate conducted raids across 19 locations in November 2024 targeting vendors of Amazon and Flipkart, and the Competition Commission of India published over 2,700 pages of findings documenting preferential seller treatment on both platforms.

Press Note 2 (2018 Series), issued by DPIIT on 26 December 2018 and effective from 1 February 2019, introduced specific anti-circumvention rules that transformed compliance from a general principle into a measurable, auditable obligation. This checklist translates those rules into concrete compliance actions that foreign-funded marketplace entities must implement and maintain. For background on why the inventory model is prohibited, see our detailed analysis on e-commerce FDI and the inventory model ban.

Checklist Part 1: Entity Structure and FDI Reporting

Before launching marketplace operations, the Indian entity must be properly structured and all FDI inflows correctly reported.

Entity Incorporation

• Incorporate the Indian entity as a private limited company or wholly owned subsidiary of the foreign parent
• Ensure the Memorandum of Association (MoA) explicitly includes e-commerce marketplace activities in the objects clause
• Appoint at least one resident director who has stayed in India for a minimum of 182 days in the financial year
• Obtain a Digital Signature Certificate (DSC) for all directors

FDI Inflow Reporting

• File FC-GPR with the RBI within 30 days of share allotment against foreign investment
• File FLA return with the RBI by 15 July each year (for all entities with FDI, covering the previous financial year)
• Ensure the investment is reported under the correct NIC code for marketplace e-commerce activities
• Maintain documentation showing the investment was received through proper banking channels via an authorised dealer bank

GST and Business Registrations

• Obtain GST registration in every state where the entity has a place of business
• Register as a Tax Collector at Source (TCS) under Section 52 of the CGST Act -- mandatory for all e-commerce operators
• Collect TCS at 0.5% (0.25% CGST + 0.25% SGST for intra-state, or 0.5% IGST for inter-state) on the net value of taxable supplies made through the platform — the rate was halved from 1% with effect from 10 July 2024
• File GSTR-8 (TCS return) by the 10th of the following month

Checklist Part 2: Marketplace Model Compliance (Press Note 2)

These are the core compliance requirements that distinguish a lawful marketplace from a prohibited inventory-based operation.

No Inventory Ownership or Control

• The marketplace entity must not own, purchase, or hold title to any goods sold on the platform at any point in the transaction
• If the platform offers fulfilment services (warehousing, packing, shipping), the inventory must remain legally owned by the seller at all times
• Document that the platform does not make purchasing, stocking, or replenishment decisions for any seller
• Audit warehouse operations to confirm the platform does not commingle its own goods (if any) with seller inventory

25% Vendor Sales Concentration Cap

• No single vendor or its group companies may account for more than 25% of the marketplace's total sales value in any financial year
• Implement real-time monitoring dashboards that track cumulative sales by vendor entity and flag when any vendor approaches the 20% threshold (giving a 5% buffer)
• Map group company relationships for all vendors -- a vendor and its parent, subsidiaries, and affiliates are treated as a single entity for this calculation
• If a vendor hits 25% mid-year, the platform must restrict further sales from that vendor for the remainder of the financial year
• Maintain quarterly snapshots of vendor-wise sales data as audit evidence

25% Purchase Control Test

• Separately, inventory is deemed controlled by the marketplace if a vendor sources more than 25% of its purchases from the marketplace entity or its group companies
• This means the marketplace cannot be a significant supplier of goods to its own vendors -- doing so creates a deemed inventory control relationship
• Require vendors to self-certify annually that they do not source more than 25% of their total purchases from the marketplace entity or its group companies
• Include this self-certification as a condition of the seller agreement

Equity Participation Restriction

• If the marketplace entity or any of its group companies holds equity in a seller, that seller is prohibited from selling on the marketplace
• Maintain a register of all group companies (parent, subsidiaries, associates, joint ventures) and update it whenever the corporate structure changes
• Cross-reference the group company register against the seller database before onboarding any new vendor
• Conduct periodic audits (at least quarterly) to catch any changes in ownership that create prohibited relationships

No Price Influence

• The marketplace must not directly or indirectly influence the sale price of goods or services listed on the platform
• Pricing recommendations, analytics tools, or market data may be provided, but the final pricing decision must rest solely with the seller
• Cashback and discount programs funded by the platform must be applied uniformly across all sellers -- not selectively to influence pricing of specific products or vendors
• Document that no minimum advertised price (MAP) or maximum retail price (MRP) mandates are imposed by the platform on sellers

Fair and Non-Discriminatory Treatment

• All services offered by the marketplace to sellers -- logistics, warehousing, advertising, payment processing, search placement -- must be available to all sellers on equal terms
• Service agreements must be standardised with published rate cards available to every seller
• Search algorithm and product listing criteria must be transparent and not biased towards any specific seller or group of sellers
• No exclusive launch agreements that give a specific seller preferential visibility or placement for an extended period

Arm's Length Service Pricing

• All services provided to sellers must be priced at arm's length, consistent with transfer pricing principles
• Benchmark service fees against comparable third-party providers in the market
• Maintain documentation of the benchmarking exercise -- this becomes critical evidence during audits
• If the marketplace offers services at below-market rates, ensure the discount is uniformly available and not selectively applied to affiliated or preferred vendors

Checklist Part 3: Annual RBI Compliance Certificate

This is the single most important annual compliance obligation specific to e-commerce marketplace entities with FDI.

Statutory Auditor Certificate Requirements

• The marketplace entity must furnish a certificate, along with a report from its statutory auditor, to the Reserve Bank of India confirming compliance with all FDI guidelines for e-commerce
• The deadline is 30 September of each year for the preceding financial year (e.g., the certificate for FY 2025-26 is due by 30 September 2026)
• The auditor must independently verify: no inventory ownership, vendor sales concentration within 25%, no prohibited equity relationships, no price influence, and arm's length service provision
• The certificate must be addressed to the RBI through the company's authorised dealer bank

Preparing for the Audit

• Compile vendor-wise sales data for the entire financial year, broken down by month and by vendor group
• Prepare the group company register with ownership documentation for all related entities
• Document all service agreements with sellers, including rate cards and any modifications during the year
• Maintain records of cashback and discount programs showing uniform application across sellers
• Keep warehouse audit reports confirming separation of platform-owned assets (if any) from seller inventory
• Retain board resolutions and internal policy documents demonstrating commitment to marketplace-only operations

Checklist Part 4: Consumer Protection Compliance

E-commerce marketplace entities must also comply with the Consumer Protection (E-Commerce) Rules, 2020, which impose additional transparency and operational requirements.

Mandatory Disclosures

• Display seller information (name, address, contact details, GST registration number) prominently on every product listing
• Show country of origin for all products listed on the platform
• Display the total price inclusive of all charges (shipping, handling, taxes) before checkout
• Publish a clear return, refund, and exchange policy
• Display delivery and shipment timeline estimates

Grievance Redressal

• Appoint a Grievance Officer and display their name, contact details, and designation on the platform
• Acknowledge consumer complaints within 48 hours of receipt
• Resolve complaints within one month from the date of receipt
• Maintain a complaint log with resolution status for regulatory inspection

Product Liability

• While marketplace entities are not generally liable for products sold by sellers, the platform must not render any product information that is false or misleading
• Remove listings that violate applicable laws upon receiving a valid complaint or notice
• Record every seller's consent to comply with applicable product safety standards

Checklist Part 5: Data Protection and IT Act Compliance

E-commerce platforms handle vast quantities of personal data, making compliance with India's data protection framework critical.

Digital Personal Data Protection Act, 2023

The DPDP Act's substantive obligations are being brought into force in phases under the Digital Personal Data Protection Rules, 2025 (notified in November 2025), with the core data-fiduciary duties taking effect on the staggered timelines set out in those rules — platforms should build the following into their compliance architecture now:

• Implement consent-based data collection with clear, specific purposes disclosed to users
• Provide users the right to access, correct, and erase their personal data
• Appoint a Data Protection Officer if the entity is notified as a Significant Data Fiduciary by the Central Government — large e-commerce platforms are likely candidates
• Implement data breach notification procedures -- the Act requires intimation of breaches to the Data Protection Board and affected users in the prescribed form and manner
• Track cross-border transfer restrictions -- the Act permits transfers to all countries except those restricted by Central Government notification

IT Act and Intermediary Guidelines

• Publish terms of use, privacy policy, and acceptable use policy on the platform
• Appoint a Grievance Officer under the IT Intermediary Guidelines (the Chief Compliance Officer and Resident Grievance Officer requirements apply only to significant social media intermediaries -- those with over 50 lakh registered users -- which a pure e-commerce marketplace ordinarily is not)
• Remove unlawful content within three hours of a lawful order (rule 3(1)(d) of the IT Rules 2021 as amended by G.S.R. 120(E) of 10 February 2026; 36 hours before 20 February 2026) of receiving a government or court order

Checklist Part 6: FEMA Penalties and Enforcement Risk

Non-compliance with e-commerce FDI norms is treated as a contravention of FEMA, with penalties enforced by the RBI (for compoundable offences) and the Enforcement Directorate (for serious violations).

Penalty Structure

Risk Mitigation Actions

• Conduct quarterly internal compliance reviews against all Press Note 2 requirements
• Engage external legal counsel for an annual compliance audit separate from the statutory auditor's certificate
• Maintain a compliance manual that documents all policies, procedures, and controls related to marketplace-only operations
• Train all employees involved in seller relationships, pricing, and fulfilment on FDI compliance requirements
• Establish an escalation protocol for any situation that could create the appearance of inventory control or price influence
• Consider proactive FEMA compounding if past violations are identified -- voluntary disclosure is treated more favourably than discovery during investigation

Checklist Part 7: Ongoing Monitoring and Reporting Calendar

Compliance is not a one-time exercise. Foreign-funded marketplace entities must maintain an ongoing monitoring framework.

Monthly Obligations

Quarterly Obligations

Annual Obligations

Checklist Part 8: Transfer Pricing for E-Commerce Marketplace Operations

Foreign-funded e-commerce marketplace entities that transact with their overseas parent or group companies must comply with India's transfer pricing regulations under sections 161 to 173 of the Income-tax Act, 2025 (sections 92 to 92F of the Income-tax Act, 1961).

Transactions Requiring Documentation

• Technology licensing fees paid to the parent company for platform software, algorithms, or proprietary systems
• Management service fees for centralised functions such as finance, HR, or legal shared services
• Brand licensing fees or royalties for use of the parent company's brand name or trademarks
• Intercompany loans or guarantees provided by the parent to the Indian entity
• Cost-sharing arrangements for jointly developed technology or marketing campaigns

Compliance Requirements

• Maintain contemporaneous transfer pricing documentation demonstrating that all intercompany transactions are at arm's length
• File the accountant's report on international transactions -- Form No. 48 (formerly Form 3CEB) for tax year 2026-27 onwards, under section 172 of the Income-tax Act, 2025 and rule 85 of the Income-tax Rules, 2026 -- at least one month before the due date for furnishing the return of income under section 263(1)(c)
• Benchmark intercompany pricing against comparable uncontrolled transactions using approved methods (CUP, TNMM, RPM, CPM, or PSM)
• Consider an Advance Pricing Agreement (APA) for large, recurring transactions -- APAs provide certainty for 5-9 years and eliminate audit risk on covered transactions

For FY 2025-26 and earlier years the report was Form 3CEB under Rule 10E of the Income-tax Rules, 1962, furnished under section 92E of the Income-tax Act, 1961. Which of the two a filing made after 1 April 2026 in respect of FY 2025-26 must use is not settled by the notified rules -- the Income-tax Rules, 2026 contain no repeal-and-savings provision. Check the form actually enabled on the e-filing portal before filing, and take professional advice.

Common Compliance Failures and How to Avoid Them

Based on regulatory actions against e-commerce entities, these are the most frequent compliance failures:

Structuring Through Shell Sellers

Creating shell entities that technically own inventory while the platform exercises operational control. The ED specifically targets these structures. Solution: ensure all sellers are genuinely independent businesses with their own management, customers, and commercial rationale beyond selling on your platform.

Exceeding the 25% Vendor Cap

Failing to track group company relationships allows affiliated sellers to collectively exceed the cap without detection. Solution: implement automated monitoring that maps corporate ownership trees and aggregates sales across related entities in real time.

Private Label Products

Launching private-label products on the platform while operating under the marketplace model. If the marketplace entity or its group companies own, develop, or source any products sold on the platform, this constitutes prohibited inventory-based e-commerce. Solution: maintain strict separation between the marketplace entity's corporate group and any product brands.

Selective Cashback and Discounts

Offering cashback or discount programs that disproportionately benefit specific sellers or product categories. This is treated as indirect price influence. Solution: design all promotional programs to be uniformly available to all sellers on the platform.

Late RBI Certificate Filing

Missing the 30 September deadline for the statutory auditor compliance certificate. Solution: begin the audit process no later than July to allow sufficient time for data compilation, auditor review, and submission through the AD bank.

Key Takeaways

• 100% FDI in marketplace e-commerce is permitted under the automatic route, but compliance with Press Note 2 (2018) requirements is mandatory and auditable through the annual RBI statutory auditor certificate due by 30 September.
• The 25% vendor cap is the most operationally significant rule -- no single vendor or its group companies can exceed 25% of total platform sales, and separately, vendors must not source more than 25% of their purchases from the marketplace entity or its group companies.
• Equity participation creates an absolute bar -- if the marketplace or its group companies hold equity in a seller, that seller cannot sell on the platform, period.
• FEMA penalties for violations are severe -- up to 3x the amount involved, INR 5,000 per day for continuing violations, and potential criminal prosecution with up to 5 years imprisonment for serious cases.
• Compliance requires continuous monitoring, not annual box-ticking. Monthly vendor concentration reviews, quarterly internal audits, and annual external certifications form the minimum compliance architecture.