Loyalty program compliance in India: GST, TDS, PPI and prize rules
A trade loyalty program moves money and value to thousands of retailers, dealers and influencers every month — which puts it squarely inside income-tax, GST, RBI and data-protection law. Most programs are designed for behaviour first and discover the compliance bill at audit. This guide maps the five areas that matter so you can build them in from day one. It sits alongside our deeper 194R guide and the TDS calculator. It is a practitioner's map, not legal advice — confirm specifics with your chartered accountant and counsel.
Important. Tax and regulatory positions in India shift through circulars, notifications and rulings. Nothing here is legal or tax advice, and no case law is cited because your facts govern the outcome. Use this to brief the right questions to your CA, GST advisor and legal counsel before launch.
The five compliance areas of an Indian loyalty program
Every rupee of reward you pass to the trade touches at least one of these regimes, and usually two or three at once. A ₹15,000 gold coin handed to a top dealer is simultaneously a business perquisite under income tax, potentially a supply question under GST, and a piece of personal-data processing when you record the PAN to withhold tax. The discipline is to design the reward, the rail and the record together.
The five areas, in the order they usually bite: income-tax withholding (194R and 194B), GST on rewards and vouchers, RBI prepaid-instrument rules when you use gift cards or wallets, the Prize Chits and Money Circulation Schemes (Banning) Act plus state gaming law when you run draws, and the Digital Personal Data Protection Act over the KYC you collect. Take them one at a time.
The compliance map, area by area
TDS Section 194R — benefits arising from business
What it covers: any benefit or perquisite given to a resident that arises from their business or profession — which is exactly what a scheme reward to a retailer, dealer, electrician or mason is. Rate and threshold: 10% once the aggregate benefit to one PAN crosses ₹20,000 in a financial year. The trap: the threshold aggregates across every scheme — QR rewards, a free demo board, a festive gift, a trip — so a partner who never won ₹20,000 from a single scheme still crosses it in total. Build for it: collect PAN at enrolment, aggregate per PAN across all schemes, and withhold automatically at payout. Non-cash rewards (gold, trips) have no cash to deduct from, so you must recover or gross up the tax before releasing the benefit. Full detail in the 194R guide.
TDS Section 194B — winnings from lottery and games of chance
What it covers: winnings from lotteries, crossword puzzles, card games and other games of any sort — the bucket a pure lucky draw falls into. Rate: 30% with a low threshold, and no expense-set-off for the winner. Why it matters: if your program bolts on a chance-based draw, that leg is taxed at a punitive 30% and reported differently from your 194R earned-rewards leg — two withholding regimes in one program. Build for it: keep earned rewards (purchase- or scan-linked, taxed under 194R) cleanly separated from any chance mechanic, and think hard about whether you need a draw at all when verified-activity rewards drive behaviour without the tax and legal drag. See gamification in trade loyalty for chance-free mechanics.
GST on rewards, free goods and vouchers
Cash and UPI payouts are not a supply of goods or services, so the payout itself generally sits outside GST — but the treatment of input tax credit on the scheme spend, and whether a reward is recharacterised as a discount, are live questions. Free goods and gifts raise valuation and ITC-reversal issues. Vouchers have their own regime with specific timing-of-supply and valuation rules that have moved through circulars and rulings. Build for it: map each reward type in your catalog to a GST position agreed with your advisor, keep documentation that shows schemes as trade incentives rather than disguised consideration, and revisit the position when you add voucher or gift-card rewards. This is the area most likely to change year to year.
RBI prepaid payment instrument (PPI) rules
When it applies: the moment you reward with gift cards, wallet loads or branded prepaid instruments rather than bank cash. Who carries the burden: issuing a PPI is a regulated activity — you almost never do it yourself. You buy vouchers or card value from an RBI-authorised PPI issuer or an aggregator working with one, and the issuance, KYC and redemption compliance sits with that authorised entity. Build for it: use only compliant voucher and prepaid partners, keep the paper trail of who issued the instrument, and remember that choosing a voucher rail does not remove your own 194R and GST duties on the value you distribute. Vouchers can help budget control and 194R optics, but they are not a compliance shortcut. More on rails in the UPI reward payouts guide.
Prize Chits & Money Circulation Act and state gaming law
What it constrains: the Prize Chits and Money Circulation Schemes (Banning) Act prohibits money-circulation and chain-style schemes where rewards depend on enrolling others or on an element of chance in a pooled structure; state lottery and gaming laws govern draws and games of chance and vary by state. The risk zone: referral chains that pay for recruitment down a tree, and lottery-style draws run without regard to state rules. Build for it: reward verified purchases, scans and sales performance — outcomes the partner controls through their own business — rather than chance or recruitment. A single-level referral reward for a genuine, verified new active partner is very different from a multi-level payout tree. Get legal sign-off on any draw or referral mechanic before it goes live.
Digital Personal Data Protection (DPDP) duties over KYC
What you hold: to run a compliant program you collect phone numbers, PAN (for 194R), and bank or UPI details (for payout) — all personal data. What is expected: collect only what you need, state the purpose at enrolment, use it only for that purpose, secure it, and honour access and erasure expectations. Build for it: a clear enrolment notice in the partner's language, PAN and bank details stored encrypted with restricted access, retention limited to what tax and audit require, and an audit trail. The brand is the accountable data fiduciary; the platform must give you the controls, but the accountability does not transfer. Vernacular consent matters when your users are low-literacy — see app adoption for low-literacy users.
A worked example: one dealer, four rewards, four regimes
Take a single gold-tier dealer over one financial year. They earn ₹14,000 in scan-linked slab rewards paid by UPI, receive a ₹9,000 switchgear demo board free, win a ₹40,000 foreign-trip incentive on annual target, and get a ₹5,000 voucher hamper at Diwali. Walk the compliance:
Income tax. All four are business benefits under 194R. Their aggregate is ₹68,000, well over the ₹20,000 threshold, so 10% — ₹6,800 — must be withheld across the year. The UPI rewards are easy to deduct from; the demo board, trip and voucher are non-cash, so the tax on those must be recovered from the dealer or grossed up and borne by the brand (and a borne tax is itself generally a further benefit, nudging the number up). The lucky-draw regime (194B) does not enter here because nothing was won by chance.
GST. The UPI payout sits outside GST as a non-supply, subject to the ITC position on the scheme. The free demo board and the voucher hamper each need a specific GST position — the board on valuation and ITC, the voucher under the voucher rules. The trip is a bought service with its own input-side treatment. Four rewards, at least three different GST conversations.
RBI. Only the voucher touches PPI rules, and only to the extent that you sourced it from an authorised issuer — which you must verify and document.
Data protection. To do all of the above you stored the dealer's PAN, bank details and travel documents. Each must be collected on notice, secured, and retained no longer than tax and audit require. One dealer, one year, four rewards — and every Indian compliance regime in scope. Multiply by 10,000 counters and the case for building compliance into the platform rather than the spreadsheet becomes obvious.
Designing a compliant-by-default program
- Capture PAN at enrolment, not at audit. Without PAN you cannot aggregate for 194R or withhold correctly. Make it part of KYC from day one, with a vernacular notice explaining why.
- Aggregate per PAN across every scheme. The ₹20,000 threshold is per recipient per deductor per year — your system must sum QR rewards, gifts, boards and trips against one identity, not per campaign.
- Reward outcomes the partner controls. Purchases, scans and verified sales stay in the clean 194R lane. Chance and recruitment mechanics invite 194B and prize-chit exposure — use them only with legal sign-off.
- Use compliant rails. RBI-authorised voucher and PPI partners for non-cash; name-and-PAN-matched UPI for cash. Document the issuer trail.
- Treat GST per reward type. Agree a position for cash, free goods and vouchers with your advisor and keep documentation that frames schemes as trade incentives.
- Protect the data. Encrypt PAN and bank details, restrict access, limit retention, and keep an audit trail — you are the data fiduciary.
A platform earns its keep here: serialised QR for verified activity, per-PAN aggregation and automatic 194R withholding, compliant voucher and UPI rails, and encrypted KYC with audit logs. The TDS calculator and cost calculator let you model the gross-up and the true program cost before you commit. The platform executes and evidences compliance; the brand stays legally accountable. Pair this with a real relationship program — see the retailer loyalty and influencer loyalty approaches — so compliance protects a program worth protecting.
Frequently asked questions
What are the main laws a trade loyalty program in India must respect?
Five areas matter most: income-tax withholding (Section 194R on business benefits at 10%, and 194B on lottery-style winnings at 30%), GST treatment of rewards and vouchers, RBI rules where prepaid instruments or gift cards are used, the Prize Chits and Money Circulation Schemes (Banning) Act which constrains draw and chain-style mechanics, and the Digital Personal Data Protection Act for the KYC data you collect. The exact application depends on your reward structure, so treat this as a map, not legal advice.
Is GST payable on loyalty rewards given to dealers and retailers?
It depends on the form. Cash and UPI payouts are not a supply of goods or services, so GST is generally not charged on the payout itself, though input-tax-credit questions arise on the underlying scheme. Free goods, gifts and vouchers have their own treatment, and vouchers in particular have specific timing-of-supply and valuation rules. Because positions have shifted through circulars and rulings, confirm the current treatment for your reward mix with your GST advisor.
Are lucky draws in loyalty programs legal in India?
Skill-linked or purchase-linked rewards are generally on safe ground. Pure games of chance and lottery-style draws intersect with state gaming and lottery laws and the Prize Chits and Money Circulation Schemes (Banning) Act, and winnings attract 194B TDS at 30%. Many brands avoid free-standing lucky draws or structure engagement mechanics around verified activity rather than chance. Take legal advice before running any draw.
Do I need RBI approval to give gift vouchers or prepaid cards?
You typically do not issue the instrument yourself — you buy it from an RBI-authorised prepaid payment instrument (PPI) issuer or an aggregator that works with one. The compliance for issuance, KYC and redemption sits with that authorised issuer. Your responsibility is to use a compliant partner and to keep your own TDS and GST treatment correct on the value you distribute.
What data-protection duties apply to loyalty KYC data?
The Digital Personal Data Protection Act framework expects you to collect only the personal data you need (phone, PAN for TDS, bank or UPI for payout), use it for the stated purpose, keep it secure, and honour access and erasure expectations. Store PAN and bank details encrypted, restrict access, and have a clear notice at enrolment. Your platform should support these controls; the accountability remains with the brand as the data fiduciary.
Who is responsible for compliance — the brand or the loyalty platform?
The legal obligations — deducting TDS, correct GST treatment, being the data fiduciary — sit with the brand that funds and owns the program. A platform operationalises them: PAN capture, per-PAN aggregation and 194R withholding, using RBI-compliant voucher partners, and encrypted data handling with audit trails. The platform executes and evidences compliance; the brand remains legally accountable unless a different structure is agreed on professional advice.