Essential Business Licenses for E-Commerce Startups in India

Essential Business Licenses for E-Commerce Startups in India

If you launch an Indian e-commerce business in 2026 without the right licence stack, you risk GST registration cancellation, marketplace account suspension, FSSAI seizures, and DPDP penalty orders that scale with turnover. The complete compliance roadmap covers six layers: entity incorporation through MCA V3, mandatory GST registration for every seller and operator, product-specific certifications (FSSAI, BIS, Drugs, Legal Metrology), the Import-Export Code and Udyam MSME registration, Consumer Protection (E-Commerce) Rules disclosures, and Digital Personal Data Protection obligations. Each layer has a hard deadline or a triggering event — missing any one of them is not recoverable without penalty.

Why E-Commerce Licences Are Not the Same as Offline Compliance

A brick-and-mortar retailer below Rs. 40 lakh in goods turnover can legally operate without a GSTIN. An e-commerce seller cannot — Section 24(ix) and (x) of the CGST Act, 2017 override the threshold for anyone who sells through a platform or operates one. Similarly, a neighbourhood grocery store needs only a basic FSSAI registration, but an online food marketplace must hold — or verify that every listed seller holds — a valid FSSAI licence before any product goes live.

The regulatory architecture around e-commerce in India for FY 2026-27 sits at the intersection of at least five central statutes (CGST Act, Companies Act 2013, DPDP Act 2023, Consumer Protection Act 2019, BIS Act 2016) and several state-level laws (Professional Tax, Shops and Establishments). Treating compliance as a one-time checkbox exercise is an expensive mistake; it is a living obligation that scales as your platform's GMV, product categories, and user base grow. The question is not whether to comply, but in what sequence.

Step 1: Incorporate the Right Entity Before You Take a Single Order

Most VC-backable e-commerce ventures in India register as a Private Limited Company under the Companies Act 2013. The SPICe+ (Simplified Proforma for Incorporating Company Electronically Plus) form on the MCA V3 portal (mca.gov.in) handles name reservation, DIN (Director Identification Number) allotment, PAN, TAN, GSTIN pre-application, and EPFO/ESIC registration in a single integrated filing. Expect a turnaround of 3–7 working days when documents are clean.

What you need before you file SPICe+:

1. DSC (Digital Signature Certificate) for every proposed director — Class 3, valid for 2–3 years — from a licensed Certifying Authority
2. Proof of registered office address: electricity bill not older than 2 months, plus a No-Objection Certificate from the owner if the premises are rented
3. Subscriber Sheet along with the Memorandum and Articles of Association (MOA/AOA)
4. Minimum authorised capital declaration (there is no minimum paid-up capital requirement for a Pvt Ltd post-2015)

After incorporation, you must file Form INC-20A (Commencement of Business declaration) within 180 days of the date on the Certificate of Incorporation. This requires evidence that the subscribed paid-up share capital has actually been received in the company's bank account. Skipping INC-20A attracts a penalty of Rs. 50,000 on the company and Rs. 1,000 per day on each director until it is filed, under Section 10A of the Companies Act 2013. Many founders celebrate the CIN and immediately move on to product development — the 180-day clock is silently running.

Solo founders or co-founders who want lighter ongoing compliance may prefer an LLP (Limited Liability Partnership) under the LLP Act 2008, registered through the FiLLiP form. Annual compliance for an LLP is simpler (Form 8 — Statement of Account and Solvency, and Form 11 — Annual Return) compared to the Pvt Ltd stack (MGT-7A, AOC-4, board resolutions, statutory audit). However, LLPs cannot issue ESOPs, face restrictions on FDI in certain sectors, and are less familiar to institutional investors. If you are raising external capital within 24 months, incorporate a Pvt Ltd from day one.

Shops and Establishment registration for the registered office is required under the relevant state Act — for example, the Karnataka Shops and Commercial Establishments Act or the Maharashtra Shops and Establishments (Mahaonline) portal. Most states now issue this digitally within 7–14 days. Without it, several banks will not open a current account for the entity.

Step 2: GST Registration — Mandatory for Every E-Commerce Player, Every Time

This is the single most misunderstood compliance point for Indian e-commerce startups. The normal aggregate turnover thresholds — Rs. 40 lakh for goods, Rs. 20 lakh for services — do not apply once you fall into either of two categories defined under the CGST Act:

• E-Commerce Operator (ECO): You own and operate the marketplace, aggregator app, or platform through which third-party sellers transact.
• E-Commerce Seller: You supply goods or services through an ECO. Even if your annual sales are Rs. 3 lakh, you must register.

Both categories are captured by Section 24(ix) and (x) of the CGST Act, 2017, making registration compulsory regardless of turnover.

E-Commerce Operator vs. Marketplace Seller: Who Collects TCS?

Under Section 52 of the CGST Act, every ECO must collect Tax Collected at Source (TCS) at 1% — split as 0.5% CGST + 0.5% SGST/UTGST for intra-state supplies, and 1% IGST for inter-state supplies — on the net value of taxable supplies made by sellers through its platform. The seller continues to pay their own output GST on their invoices; TCS is an additional amount deposited by the operator on the seller's behalf, which the seller can claim as credit in their electronic cash ledger on the GST portal.

An ECO must file GSTR-8 by the 10th of the following month, reporting total supplies made through the platform and TCS collected. Non-filing attracts a late fee of Rs. 200 per day (Rs. 100 CGST + Rs. 100 SGST) with no statutory upper cap for GSTR-8 as of FY 2026-27. Interest at 18% per annum runs on the actual unpaid TCS from the due date. Many operators file their own GSTR-1 and GSTR-3B diligently but forget that GSTR-8 is a separate, parallel obligation.

GST Registration Steps

1. Log in to the GST portal (gstin.gov.in) → Services → Registration → New Registration → Form GST REG-01
2. Documents: PAN, Aadhaar, Certificate of Incorporation, MOA/AOA, proof of principal place of business, bank account details (cancelled cheque or passbook first page), authorised signatory photograph and DSC
3. The application officer may issue Form GST REG-03 (notice for clarification) — respond within 7 working days via GST REG-04, or the application is rejected
4. GSTIN is granted via GST REG-06 within 7 working days of a complete submission

If your startup operates warehouses or offices across multiple states, you need a separate GSTIN per state, each with its own return-filing obligations (GSTR-1, GSTR-3B monthly; GSTR-9 annually).

Step 3: Product-Specific Licences — FSSAI, BIS, Drugs, and Legal Metrology

Your entity registration and GSTIN are sector-agnostic. What you sell determines the next certification layer, and each of these carries criminal liability for non-compliance — not just fines.

FSSAI for Online Food Sellers

Every business that manufactures, stores, distributes, or sells food products — including through a website or delivery app — must hold a valid FSSAI licence or registration under the Food Safety and Standards Act 2006. The tier depends on your annual turnover:

A marketplace that lists food sellers but does not physically handle the food is still required under FSSAI's e-commerce food business guidance to verify that every listed seller holds a current FSSAI number and to display that number on every product listing page. Selling food without a licence can attract a fine of up to Rs. 5 lakh and operational closure under Sections 31 and 63 of the FSS Act 2006.

BIS Certification for Electronics, Toys, and Notified Goods

The BIS Act 2016 mandates that products in notified categories carry BIS certification before they are sold in India — online or offline. The scheme most relevant to e-commerce is the Compulsory Registration Scheme (CRS), which covers over 70 categories of electronics and IT goods: mobile phones, laptops, power banks, LED lights, smart watches, wireless earbuds, and similar products.

Under CRS, the manufacturer or importer must:

1. Get the product tested at a BIS-recognised laboratory — testing costs typically range from Rs. 40,000 to Rs. 1,20,000 per model depending on category
2. Apply on the BIS portal (manakonline.in) with test reports and factory documents
3. Receive the CRS registration number and display it on the product, packaging, and product listing page

For toys, the Quality Control Order under the BIS Act requires ISI marking (IS 9873 series). Selling non-certified electronics or toys on Amazon India, Flipkart, or your own site can result in platform de-listing and a penalty of up to Rs. 2 lakh plus seizure of goods under Section 17 of the BIS Act 2016, with repeat offenders facing imprisonment of up to 2 years.

If you import electronics for resale in India, the BIS CRS registration must be obtained at the Indian importer level — a foreign manufacturer's BIS mark issued to their entity does not automatically transfer to you as an importer.

Drug Licence for Pharmacy and Wellness Products

E-pharmacies and platforms selling OTC medicines, prescription drugs, Ayurvedic formulations, or medical devices require a drug licence under the Drugs and Cosmetics Act 1940, administered by state drug controllers and the CDSCO. Medical devices — thermometers, pulse oximeters, glucometers — additionally require CDSCO MD-15 registration under the Medical Devices Rules 2017. This sector carries the most complex pre-launch compliance; plan for 60–120 days minimum.

Legal Metrology for Pre-Packaged Commodities

If you sell goods in pre-determined quantities — any FMCG, packaged food, stationery, hardware — the Legal Metrology (Packaged Commodities) Rules 2011 under the Legal Metrology Act 2009 require every package to declare net quantity, MRP (including all taxes), manufacturer's name and address, month and year of manufacture, and batch/lot number where applicable. Critically, online product listing pages must replicate all these declarations — regulators treat the digital display as equivalent to the physical package label. Non-compliance attracts a penalty of up to Rs. 25,000 for the first offence and Rs. 50,000 for repeat offences under Section 33 of the Act.

Step 4: IEC Code and Udyam/MSME Registration — Two Free, High-Return Filings

Import-Export Code (IEC) from DGFT

If your business model involves importing inventory from overseas (electronics from China, textiles from Bangladesh), selling on Amazon Global or Etsy, or receiving international payments through a payment aggregator, you need an Import-Export Code (IEC) from the Directorate General of Foreign Trade (DGFT) under the Foreign Trade Policy 2023. The IEC is a PAN-linked 10-digit code, issued free of cost, valid for lifetime unless surrendered or revoked.

Apply at dgft.gov.in → Services → IEC → Apply for IEC. Documents: PAN, Aadhaar or passport of the authorised signatory, Certificate of Incorporation, cancelled cheque. Processing time: typically 1–3 working days. Without an IEC, import shipments will be held at customs and international payment settlements may be blocked by the payment gateway.

Udyam MSME Registration

Udyam Registration at udyamregistration.gov.in is voluntary but operationally valuable. It classifies your entity as Micro, Small, or Medium based on investment in plant and machinery plus annual turnover. Most early-stage e-commerce startups qualify as Micro (investment below Rs. 1 crore, turnover below Rs. 5 crore).

This 15-minute, cost-free registration unlocks:

• MSME Samadhaan portal — recover delayed B2B payments exceeding 45 days with interest at 3× the RBI bank rate, enforceable through the MSME Facilitation Council
• Priority sector lending (PSL) classification for collateral-free credit under CGTMSE
• 50% subsidy on trademark filing fees: Rs. 4,500/class versus Rs. 9,000/class for other entities
• Access to the Government e-Marketplace (GeM) for B2G selling — a significant revenue channel for office supplies, electronics, and logistics startups

Step 5: Consumer Protection (E-Commerce) Rules, 2020 — What Your Website Must Display Before You Go Live

Every e-commerce entity operating in India must comply with the Consumer Protection (E-Commerce) Rules, 2020, as amended in 2021, framed under the Consumer Protection Act 2019. These rules distinguish between marketplace entities (platforms hosting third-party sellers) and inventory entities (platforms selling their own stock), with obligations on both.

Mandatory website and app disclosures under Rule 4:

• Legal name, PAN, CIN, registered address, functional telephone number, and email — in a location accessible from every page, typically the footer
• Full name, designation, contact number, and email of a Grievance Officer, who must acknowledge complaints within 48 hours and resolve them within one calendar month
• Country of origin for every product listed — this requirement is actively enforced by the Central Consumer Protection Authority (CCPA)
• Estimated delivery timeframe displayed before checkout
• Complete return, refund, and cancellation policy with no conditions buried in terms
• No manipulated or artificially discounted prices presented as "deals"
• No fake, paid, or incentivised reviews

For marketplace platforms specifically, you must not allow sellers to transact unless they have submitted their GSTIN, PAN, and physical address. Preferential treatment for related-party sellers — a provision aimed at vertically integrated marketplaces — is explicitly prohibited.

The CCPA can impose a penalty of up to Rs. 10 lakh for a first violation and Rs. 50 lakh for repeat violations. The CCPA has issued notices to multiple platforms over missing country-of-origin disclosures — do not launch without this in place.

Step 6: DPDP Compliance — Consent, Notices, and Data Security Under the DPDP Act 2023

The Digital Personal Data Protection Act, 2023 (DPDP Act) governs how you collect, store, process, and transfer the personal data of your users. E-commerce businesses — which, by definition, collect names, phone numbers, email addresses, delivery addresses, payment data, and browsing behaviour — are Data Fiduciaries with binding obligations under the Act as operative in FY 2026-27.

Core obligations for every e-commerce startup:

1. Notice before consent (Section 5): Before collecting any personal data, give the user a clear, plain-language notice explaining what data you collect, the specific purpose, and how they can withdraw consent. Generic "we use cookies" banners do not satisfy this.

1. Consent management (Section 6): Consent must be free, specific, informed, and revocable at any time. Pre-ticked checkboxes and bundled multi-purpose consents are non-compliant. Maintain an auditable consent log that you can produce to the Data Protection Board of India on request.

1. Data minimisation and purpose limitation (Section 8): If you collect an email for order confirmation, you cannot use it for promotional campaigns without a separate, specific consent. Repurposing data is a distinct violation.

1. Children's data (Section 9): If any user under 18 may interact with your platform — relevant for toy stores, EdTech, and gaming accessories — you must implement verifiable parental consent before processing their data. This has significant UX and technical implications.

1. Breach notification: Upon a personal data breach, report to the Data Protection Board of India within the timeframe as notified under the Rules. Do not assume that a breach affecting a cloud vendor's servers is not your obligation to report — if you collected the data, you report it.

1. Cross-border data transfers: Transfers of personal data outside India are permissible to countries not on the government's negative/restricted list. Until the final restricted-country list is published, document all data flows to overseas vendors — CRMs, cloud storage, analytics platforms — and execute data processing agreements with those entities.

Penalties under the DPDP Act are among the steepest in any Indian statute: up to Rs. 250 crore per incident for personal data breaches caused by inadequate security measures, and up to Rs. 50 crore for failure to maintain the notice-and-consent framework.

Minimum compliance floor for a pre-launch startup:

• Privacy Policy covering all Section 5 disclosures, written in plain English (or Hindi if your audience requires it)
• Cookie consent banner with granular, category-wise opt-in controls
• Separate, unchecked marketing consent checkbox at signup
• Data retention and erasure policy — define when you will delete inactive customer data
• A dedicated [email protected] contact routed to a named Data Protection Officer or responsible officer

Common Mistakes E-Commerce Founders Make With Compliance

1. Treating GST registration as something to do "once revenue starts." Section 24 applies from the first sale. A startup that has been transacting for 6 months without a GSTIN owes GST on every past invoice, plus interest at 18% p.a. and a penalty equal to 100% of the tax amount under Section 73 of the CGST Act. There is no grace period for e-commerce sellers.

2. Assuming the marketplace's FSSAI licence covers you as a seller. Amazon Pantry and BigBasket operate under their own FSSAI licences for the products they source and sell directly. If you are a third-party seller on their platform, you must hold your own FSSAI registration or licence. Supplying food under the marketplace's FSSAI number is an offence for both parties.

3. Importing and selling electronics without BIS CRS registration. Customs may clear the first shipment because the inspector did not check the BIS database on that day. The problem surfaces when CCPA or a competitor files a complaint against your listings. Entire inventory batches — sometimes worth Rs. 20–50 lakh — have been seized and destroyed by state authorities.

4. Using a GDPR privacy policy template downloaded from a UK website. GDPR's legal basis of "legitimate interest" does not exist under the DPDP Act. The Act's sole legal basis for processing personal data is consent (with narrow exceptions). A mismatched privacy policy is not just cosmetically wrong — it creates genuine regulatory exposure.

5. Filing GSTR-1 and GSTR-3B but forgetting GSTR-8 as an operator. These run as parallel, independent obligations. An operator who files their own returns correctly but misses GSTR-8 for 10 months accumulates Rs. 200/day × 300 days = Rs. 60,000 in late fees alone, before accounting for interest on undeposited TCS and the risk of GSTIN suspension under Rule 21A of the CGST Rules.

6. Ignoring the INC-20A deadline after incorporation. The 180-day clock is not prominently flagged on the MCA V3 dashboard. Founders who incorporate in Q4 sometimes only discover the missed deadline when the ROC issues a strike-off notice months later. Filing INC-20A late is possible but triggers penalties for every director; missing it entirely triggers compounding daily fines plus potential disqualification.

Worked Example: Building the Compliance Stack for "SnackTech" — A D2C Food + Electronics Brand

Consider two co-founders launching SnackTech Private Limited in April 2026 — a direct-to-consumer brand selling trail mixes, protein bars, and Bluetooth earbuds through their own website and Amazon India. Here is how their compliance stack builds chronologically, along with what the penalties would have been had they delayed.

Month 1 — April 2026: Entity and Core Registrations

• Incorporate via SPICe+ on MCA V3. Certificate of Incorporation issued. Government fees and stamp duty: approximately Rs. 8,500.
• DSC for both directors: Rs. 2,000 each.
• Open current bank account; credit subscribed capital of Rs. 1 lakh.
• INC-20A deadline: 30 September 2026 (180 days from April 3 incorporation). Calendar it immediately.
• Apply for GSTIN: mandatory as they sell through Amazon (an ECO). Approved in 5 working days.
• Apply for FSSAI State Licence (Form B on foscos.fssai.gov.in): projected turnover above Rs. 12 lakh. Fee: Rs. 3,000. Approval timeline: 30–60 days.

Month 2 — May 2026: Product Certifications

• Submit Bluetooth earbuds for BIS CRS testing at a recognised lab. Testing cost: Rs. 55,000. BIS registration fee: as notified on manakonline.in. Registration timeline: 45–90 days.
• Register on Udyam portal as Micro enterprise: free, 15 minutes, certificate issued instantly.
• Apply for IEC on dgft.gov.in: free. Approved in 2 working days (needed for component imports).
• File trademark for "SnackTech" under Classes 29 (food) and 9 (electronics): Rs. 4,500 × 2 = Rs. 9,000 (startup rate with Udyam certificate).

Month 3 — June 2026: Go-Live Compliance Checklist

• Privacy Policy and granular cookie consent banner published.
• Grievance Officer name and email displayed in website footer.
• Country of origin declared on every product listing page.
• FSSAI licence number visible on every food product listing and on the package.
• BIS CRS registration number on earbuds product page and physical packaging.
• Legal Metrology declarations (MRP inclusive of all taxes, net quantity, manufacturer address) on all packaging and matching digital listings.

What the penalties would have been if GST registration was delayed by 3 months: SnackTech's monthly GMV through their own website: Rs. 8 lakh; through Amazon: Rs. 7 lakh. Total Rs. 15 lakh/month. Assume blended GST rate of 12%. Monthly GST liability: Rs. 1,80,000. Three months of unregistered operation = Rs. 5,40,000 tax unpaid. Interest at 18% p.a. for 90 days = Rs. 5,40,000 × 18% × 90/365 = approximately Rs. 23,900. Penalty under Section 73 (bona fide non-fraud cases): 10% of tax = Rs. 54,000. Total preventable cost in just three months: Rs. 77,900 — before accounting for Amazon's suspension of the seller account and the revenue loss from a 2–3 week marketplace freeze.

Key Takeaways

• GST registration is mandatory from the day of your first e-commerce transaction, regardless of turnover — Section 24 of the CGST Act creates a hard compulsion for every seller through a platform and every operator of one.
• FSSAI, BIS CRS, and Drug Licence are product-triggered, not turnover-triggered — even a Rs. 50,000/month food or electronics seller needs the full product certification before the first listing goes live.
• INC-20A has a 180-day hard deadline after incorporation — calendar it the moment you receive your Certificate of Incorporation and treat it as a non-negotiable deliverable.
• GSTR-8 is a separate monthly obligation for marketplace operators, running in parallel to your own GST returns, with a Rs. 200/day late fee and no upper cap — do not confuse it with GSTR-1.
• The DPDP Act 2023 requires consent-based data processing — privacy policies copied from GDPR jurisdictions do not comply with Indian law; build a proper consent management layer with auditable logs before you collect a single email address.
• Consumer Protection (E-Commerce) Rules 2020 are enforceable from day one — grievance officer disclosure, country-of-origin labelling, and transparent pricing are not aspirational; the CCPA issues notices proactively, including against newly launched platforms.
• Udyam registration and the IEC are both free, take under three working days combined, and unlock delayed-payment protection, priority lending, trademark fee subsidies, and cross-border trade capability — there is no rational reason to skip either.