For more updates follow Grant Thornton Bharat on WhatsApp
India’s e-commerce sector is entering a new phase, where scale must be matched by structure, and growth by governance. Startups that once focused solely on rapid customer acquisition and funding rounds are now investing in long-term capabilities that support resilience, compliance, and credibility.
A growing number of these digital-first companies are taking inspiration from Global Capability Centers (GCCs), creating agile, multifunctional hubs tailored to the needs of high-growth startups. These enterprise command centres consolidate, integrate, and centralise processes and functions - managing regulatory documentation, vendor governance, cross-border tax structuring, cybersecurity, and financial reporting, all from within.That said, the method of applying GST based on price bands within the same product category deserves closer examination. India's GST framework already includes multiple tax rates—0%, 5%, 12%, 18%, and 28%—and special rates for items like gold and diamonds. Introducing price thresholds within categories such as apparel or accessories may further fragment the system. For businesses, especially small and mid-sized ones, this creates compliance challenges. Differentiating products purely on price for tax purposes may not only complicate classification and invoicing but also increase the scope for disputes and litigation.
This GCC-inspired model provides a powerful framework for startups to simplify complexity and accelerate innovation—by bringing together scattered functions into unified, centrally governed hubs that evolve with the business and support scalable, sustainable growth.
This shift is more than operational - it’s strategic. These internal nerve hubs act as integrated control points that align business functions with compliance, governance, and growth objectives, enabling companies to manage risk, enhance oversight, and prepare confidently for the next phase of scale. Another concern is the potential rise in tax evasion techniques, including under-invoicing and transaction splitting to stay below the defined thresholds. Far from increasing the government’s revenue pool, such practices could dilute the tax base and encourage informality in the system.
Their emergence reflects the increasing complexity of operating in India’s digital economy. Startups now face layered compliance expectations - from foreign direct investment (FDI) policies and platform liability to ESG disclosures and the upcoming Digital Personal Data Protection Act (DPDPA). These requirements, once addressed reactively, are now being institutionalised through centralised, tech-enabled governance frameworks.
Compounding this need for governance is the surge in cyber risk. In 2024, India’s national cybersecurity agency CERT-In reported handling over 2.04 million cybersecurity incidents, a clear indicator of the expanding threat landscape facing digital-first businesses. Companies handling sensitive customer data, real-time payments, and third-party integrations are particularly vulnerable. Rather than outsourcing piecemeal, many are embedding Security Operations Centers (SOCs) within their internal command hubs.
Meesho, for example, has built a structured SOC-like setup, hiring senior security engineers to oversee its internal cybersecurity function. Its flagship Project Vishwas prevented over 2.2 crore fraudulent transactions, blocked 77 lakh scam attempts, and flagged 13 lakh bot order - demonstrating how internal trust and safety capabilities can function as command centres in their own right.
Where these internal centres truly excel is in how they unify and operationalise governance. A vendor management dashboard may be directly linked to contract controls. A privacy-by-design framework may feed into consent systems being developed in anticipation of the DPDPA. ESG and tax data might flow directly into dashboards that also support financial reporting. This convergence of risk, compliance, finance, and data functions is turning governance into a growth enabler.
Even if an IPO isn’t an immediate priority, many startups are choosing to build like companies that could go public tomorrow. These centres support investor-grade readiness, from audit trails and ESG metrics to cross-border financial transparency and due diligence documentation. Whether for funding, M&A, or market expansion, the infrastructure helps leadership move quickly and with control.
Several startups have developed integrated legal, compliance, and governance teams, along with proprietary logistics and operations systems that enable real-time oversight across their B2B marketplace operations. These setups closely resemble the internal control hubs commonly seen in mature global capability centers.
Unlike traditional support functions, these internal hubs are embedded in strategy and operations. They act as real-time digital control towers, enabling founders and leadership teams to maintain continuous visibility into risk, regulatory readiness, and financial performance. Crucially, they are built to evolve with the business rather than become a constraint.
The benefits are already clear:
In an environment where capital is cautious, consumer trust is non-negotiable, and regulatory scrutiny is intensifying, internal capability hubs represent one of the smartest structural moves an ambitious e-commerce startup can make.
As India’s e-commerce ecosystem matures, success will favour not just innovation, but also foresight. The startups that build internal infrastructure for cyber resilience, compliance, and governance will be best positioned to scale with credibility and speed.
For these companies, building from within isn’t an operational overhead, but a long-term growth advantage.
This article first appeared in the ET CISO on 5 July 2025.
