Engineering a regulatory-compliant card payment simulator for India

The Indian payments landscape is defined by specific regulatory requirements, including card-on-file, tokenization, and recurring mandates. The Reserve Bank of India (RBI) has strict requirements on card data handling in India, prohibiting merchants and payment processors from storing sensitive card details such as the full card number, CVV, and expiry date. To address this, ecosystem players rely on card tokenization, where actual card details are replaced with network-generated tokens (ALT IDs in case of one off flow and Network token in case of CardOnFile and Subscription flows) provided by card networks schemes. While tokenization enhances security, it introduces complexities in integration, token lifecycle management, and system migration, as well as potential friction in the user experience due to additional consent and token-generation steps.

While we currently assist merchants in processing payments across various global markets, the regulatory landscape in India necessitates a specialized approach. To scale effectively within this ecosystem, comprehensive testing of these intricate processes, including tokenization and mandate management, is essential for ensuring operational reliability and compliance.

Our primary engineering challenge was to simulate all the flows involved in authorizing a card-based payment, including mandate creation (via SiHub), alt ID creation, and tokenization. This extensive simulation was necessary because third-party providers often don't offer a usable sandbox environment, and Adyen is committed to not relying on external environments for testing our critical payment flows.

Delivering this solution required deep, cross-functional collaboration, a hallmark of Adyen's engineering culture. Multiple teams pooled their expertise to build a robust, simulator-based environment.  While the landscape in India necessitated a specialized approach, we applied the `we build to benefit all customers’ formula to view this as an opportunity. This solution was strategically designed as an extension of our global testing framework, not merely a localized fix for India. Comprehensive, deterministic testing of these intricate processes is essential to ensure operational reliability. This strengthens and extends our global testing capabilities, enabling all merchants to benefit from a more reliable, efficient testing environment and accelerate time-to-market across international markets.

The core of the solution lies in using and enhancing Adyen's existing payment simulator.  The payment simulator integrates with various protocols, including REST and the IS08583 socket-based protocol (the international standard for financial transaction card-originated messages). This integration enables deep simulation of use cases such as refunds, cancellations, and technical reversals, as well as successful payments and various authorization scenarios. We further extended this payment simulator to incorporate mandate management (creation, update, and verification) functionality, providing SiHub capabilities in our test environments and enabling us to deliver end-to-end payment solution capabilities.

We also expanded the test capabilities of the ThreeDS2 simulator, specifically making the User challenge flow (OTP) mandatory to align with security standards in India. Furthermore, the Tokenization simulator was significantly enhanced to support the creation of alt IDs, a critical requirement in India for guest checkout transactions, while also refining network token management to support seamless CardOnFile and recurring payment flows.

All three simulators rely on a single source of truth for test data: the Test Cards Management Service.

We mirrored our live configurations for payment method setups, merchant accounts, and associated processes within the test environment, and we have streamlined the experience for both internal teams and merchants. This consistency ensures that stakeholders are well-acquainted with the necessary prerequisites, ultimately facilitating a more efficient transition and faster time-to-market in live production environments.

To facilitate reliable end-to-end testing for merchants, we provide a curated set of predefined test card numbers. The Test Cards Management Service is essential as the central source of truth for these card mappings.

Each card number is mapped to a specific payment outcome.

This mechanism ensures merchants can accurately test various use cases, including successful mandates and different failure codes. To maintain test environment integrity, any transactions using card details other than those provided will be blocked, and no shopper/transaction details will be stored in these scenarios.

To enable the testing of Indian card-based payment scenarios, we provide merchants with specific test card numbers. While these card numbers are intended strictly for testing, a mechanism is required to prevent the accidental use of live card data. To address this, we have designed and implemented an interceptor designed to monitor all card-based payment requests.

This interceptor validates every card against the Test Card Management Service. If a merchant initiates a payment in a TEST environment with a card not on our predefined list, the system will block the transaction. This mechanism of limiting successful transactions to Adyen's predefined cards ensures that real card data is blocked from entering our test environment.

Adyen’s engineering-led solution, built around our dedicated payment simulator, helps you maintain operational stability and speeds up your time-to-market. Merchants can now begin using the test capabilities to enable deterministic test scenarios for all Indian card flows.