Setting Up A Global Capability Centre In India: Key Corporate Law Considerations

India's Global Capability Centre (GCC) story has changed a great deal in recent years. What began as a way to move routine back-office and support work to India has grown into something far more strategic. GCCs today work on artificial intelligence, cybersecurity, engineering, product development, research and development, finance and analytics and increasingly sit at the heart of their parent companies' global operations.

The scale is striking. India now has thousands of GCC units employing millions of professionals and generating tens of billions of dollars in revenue each year.

This growth reflects a real shift in what an Indian GCC does. It is no longer just a cost centre. It is often where products are built, technology platforms are created, intellectual property is developed and important global responsibilities are carried out.

For a multinational, setting up a GCC is therefore no longer just about hiring people in India. It calls for careful decisions on legal structure, ownership and funding, board oversight, inter-company contracts, intellectual property, tax, employment, data protection and regulatory compliance. This is where corporate law matters.

The structure chosen at the outset can matter well beyond incorporation. A GCC that starts small may soon grow into a large operation that creates valuable IP, transacts significantly with group companies and takes on work that is strategically important to the wider group. The goal should not simply be to set up an entity that can start operating. It should be a structure with strong governance and compliance foundations that can grow with the business.

What is a GCC and How Can It Be Structured?

Indian law has no fixed legal definition of a "Global Capability Centre". In practice, a GCC is an Indian operation set up by a multinational group to support or contribute to its global business, ranging from finance and HR support to software development, engineering, AI, analytics, R&D and product management.

Once the business objectives are clear, the foreign parent must decide how to legally establish the Indian operation.

An Indian wholly owned subsidiary (WOS) is usually the most practical and flexible option for a long-term presence. It is a separate Indian legal entity, fully owned and controlled by the foreign parent (subject to Indian company law and foreign investment rules) and can employ staff, hold contracts and assets, own IP and transact with group companies. This separation lets the Indian operation run its own board, contracts and compliance while remaining fully part of the global group and gives it room to grow from a small support function into a major technology or R&D centre.

An LLP is another option, permitted under the automatic route for foreign investment where the sector allows 100% FDI without performance conditions. However, an LLP may suit a GCC less well if the multinational wants conventional corporate governance, equity-based incentives or future external investment, since an LLP does not have share capital in the way a company does.

A liaison office can only act as a communication channel for the foreign parent; it cannot carry out commercial activity or earn income in India. A branch office can carry out specified activities under foreign exchange rules, but it is not a separate Indian legal entity — its activities are treated as an extension of the foreign company, which matters for tax and permanent-establishment purposes.

For a multinational building a substantial, independently managed Indian operation, a subsidiary generally offers more flexibility than a liaison or branch office, though the right choice depends on the proposed activities, foreign investment rules, tax and the group's operating model.

Build-Operate-Transfer (BOT) and similar hybrid models, where a third party sets up and runs the centre before handing it over to the multinational, can help a company enter India faster. These require careful contractual planning from day one on the transfer of employees, IP, technology, data and contracts.

For an innovation-led GCC expected to become central to the group's global operations, an Indian private limited company, typically structured as a wholly owned subsidiary, is usually the most workable starting point. The bigger question is not which structure is easiest to set up, but whether it can keep supporting the GCC as its people, IP and strategic role expand.

Key Corporate Law Considerations:

Once the structure is chosen, the company should be designed to support both current operations and future growth — covering ownership, decision-making, funding, reporting and compliance.

• Incorporation and Capitalisation

The Memorandum of Association sets out the company's objects and the Articles of Association govern its internal management. For a foreign-owned GCC, the Articles should give the foreign parent appropriate oversight over matters like director appointments, share capital, borrowing and major decisions, while leaving day-to-day operations to Indian management.

Capitalisation decisions — funding the GCC through equity, permitted debt or a mix — should be made early, as they carry implications under company law, foreign exchange rules, tax and transfer pricing. Debt funding from an overseas group entity should be checked against the External Commercial Borrowing (ECB) framework rather than assumed to be a simple inter-company loan.

• Board Composition and Residency

A foreign-owned Indian company is still an Indian company for governance purposes under the Companies Act, 2013. Every company must have at least one director who has stayed in India for at least 182 days in the financial year (applied proportionately for newly incorporated companies). The foreign parent may nominate directors from its global team, but this does not shift the Indian board's statutory responsibilities to the overseas parent. The Indian board must still comply with Indian law and exercise real oversight — supported by a clear delegation of authority, proper board procedures, statutory records, conflict-of-interest controls and appropriate director liability cover. Board composition should be reviewed periodically as the GCC grows and statutory thresholds change.

• Significant Beneficial Ownership (SBO)

Under Section 90 of the Companies Act and the SBO Rules, companies must identify and report individuals who ultimately hold a 10% or more beneficial interest, voting rights or dividend entitlement or who exercise significant influence or control. Where the Indian company is held through multiple overseas holding companies or investment vehicles, tracing ownership to the relevant natural persons can require detailed analysis.

An ownership chart tracing the chain up to the relevant individuals should be prepared at incorporation and kept updated whenever the group's ownership changes. SBO compliance is not just a filing exercise — it means genuinely understanding who owns or controls the Indian company.

• Inter-Company Loans and Investments

As a GCC grows, its financial dealings with group companies — funding, guarantees, security, investments — become more complex. These need to be checked under both the Companies Act (Sections 185 and 186, which govern loans, guarantees and investments) and FEMA. Borrowing from an overseas group entity should be examined under FEMA and ECB rules and outbound investment under the Overseas Investment framework. Being part of the same multinational group does not exempt a transaction from these requirements.

• Related-Party Transactions

Transactions with the overseas parent and group entities — technology services, management fees, cost reimbursements, IP licensing, secondments, guarantees — often form the core of a GCC's business model and may fall within the related-party rules under Section 188 of the Companies Act. The company should identify its related parties, keep proper records and obtain the necessary approvals and disclosures. Where a transaction is also an international transaction between associated enterprises, separate transfer-pricing rules apply.

• Foreign Investment and Corporate Filings

A foreign-owned GCC has ongoing reporting duties beyond incorporation. Foreign investment must be reported under FEMA — for example, an issue of equity instruments to a non-resident that qualifies as FDI is generally reported via Form FC-GPR within 30 days of issue and companies with FDI generally file the Annual Return on Foreign Liabilities and Assets (FLA) with the RBI by 15 July each year. These requirements become especially relevant on fresh capital infusions, share issues or ownership restructuring. Alongside this, the usual Companies Act obligations continue — statutory registers, board and shareholder meetings, financial statements, annual filings and audits.

• Corporate Social Responsibility (CSR)

Under Section 135 of the Companies Act, CSR obligations apply if the company met any of these thresholds in the preceding financial year: net worth of ₹500 crore or more, turnover of ₹1,000 crore or more or net profit of ₹5 crore or more. Once applicable, the company must generally spend at least 2% of average net profits from the preceding three financial years (or a shorter period for newer companies) on Schedule VII activities.

CSR applicability is assessed company by company — the parent's CSR obligations do not automatically apply to the Indian GCC. Where the required CSR spend does not exceed ₹50 lakh, the Board itself can perform the CSR Committee's functions, so a separate committee is not always needed. GCCs expected to scale quickly should plan for CSR as part of their long-term governance framework, not just once a threshold is crossed.

Foreign Investment and FEMA Considerations:

Incorporating an Indian company is often the easy part. The real complexity begins once money starts moving between the overseas parent and the Indian GCC — capital inflows, share issues, funding, dividends and eventual repatriation are all governed by India's foreign exchange framework (FEMA).

Where the GCC's activities fall under sectors permitting 100% FDI via the automatic route, investment generally does not need prior government approval, though this should always be verified against the GCC's actual activities, especially in regulated sectors.

Share issue price to the foreign parent cannot be set arbitrarily — it must follow FEMA pricing and valuation rules alongside Companies Act requirements. Shares must be issued within the prescribed time after funds are remitted and the issue must be reported through Form FC-GPR within 30 days. Ongoing obligations include the Annual FLA Return and the company should keep proper records of its foreign shareholders and related transactions. Delayed or incorrect reporting can attract late fees or other regulatory consequences, so FEMA reporting should be part of the GCC's regular compliance calendar.

Money moving out of India — dividends, buybacks, capital reduction, share transfers by non-residents — needs equal care, involving corporate approvals, valuation, tax and FEMA reporting; these should not be treated as simple substitutes for one another. If the Indian GCC itself invests in another Indian entity or overseas, downstream investment or Overseas Investment rules may apply.

The key principle: capital moving within the group is not just an internal accounting entry. Each movement should be checked against corporate, foreign-exchange, tax and reporting requirements.

Inter-Company Arrangements and Corporate Governance:

A GCC may be legally separate from its parent, but commercially the two work as one organisation — sharing funding, technology, IP and global policies. This makes the contracts between them especially important.

A Master Services Agreement (MSA), while not legally mandatory, is the usual way to document the commercial relationship — covering scope of services, pricing, IP, confidentiality, data protection, liability, dispute resolution and termination. It should reflect how the business actually operates, not just serve as a compliance document. If a GCC is described as providing routine support but its staff are really building core software or valuable IP, this mismatch can create problems for transfer pricing, tax exposure and IP ownership.

Pricing under the MSA should follow transfer-pricing rules that match the GCC's actual functions, assets and risks — and should be reviewed whenever the GCC's role changes.

Employee secondments from the parent need clear documentation covering the employment relationship, remuneration, reporting lines, duration and who exercises day-to-day control. Secondments can also raise Permanent Establishment (PE) questions depending on the facts, though a secondment does not automatically create a PE.

On governance, the foreign parent can retain oversight of major matters through shareholder rights, board appointments and defined reserved matters, but the Indian board must still perform its statutory duties and not act as a rubber stamp for decisions made entirely abroad. A clear delegation of authority, defined approval thresholds and proper board records help maintain this balance — and should be revisited as the GCC's role evolves from routine support into R&D, product development or global technology functions.

Tax and Transfer Pricing Developments:

Once an Indian GCC starts serving overseas group companies, a basic tax question arises: how should it be paid and how much profit should stay in India? This is the domain of transfer pricing.

Many GCCs use a cost-plus model — charging the group company their operating costs plus an agreed margin (for example, ₹100 crore in costs plus a 15% margin means a ₹115 crore charge), determined in line with transfer-pricing rules and the GCC's actual functions, assets and risks. This model suits routine, low-risk services well, but becomes harder to apply as GCCs move into software development, product design, R&D and AI, where the real value created must be assessed, not just the cost of running the centre.

A notable recent development is the Union Budget 2026 proposal to overhaul the safe-harbour regime for IT services. It proposes grouping software development, IT-enabled services, KPO services and software-related contract R&D under one "Information Technology Services" category with a 15.5% safe-harbour margin, raising the eligibility threshold from ₹300 crore to ₹2,000 crore in transaction value, introducing automated approval and allowing the same treatment to be locked in for five years. A safe harbour gives taxpayers who meet the conditions greater certainty on their transfer-pricing position — but eligibility, the nature of services and the final enacted provisions still need to be checked before any GCC relies on the 15.5% margin.

The second major area is GST. Services provided by an Indian GCC to an overseas group company may qualify as a zero-rated export of services if statutory conditions on supplier/recipient location, place of supply and payment are met — but not every service to a group company automatically qualifies. Particular care is needed around the "intermediary" classification under GST law, which applies to a person who arranges or facilitates a supply rather than providing it directly, since this carries a different place-of-supply rule that can affect export status. The MSA should accurately describe the services actually provided rather than being copied from a global template, since the contractual description and actual functions performed both affect the GST analysis.

The broader lesson: as a GCC moves from routine support towards technology development, R&D and high-value functions, its transfer-pricing model, inter-company agreements and GST treatment should be reviewed regularly.

Location Strategy: SEZs, STPIs and State-Level Policies:

Choosing a GCC location is no longer just about rent. It affects access to talent, infrastructure, costs, government incentives and future expansion.

A Special Economic Zone (SEZ) remains relevant for certain technology-focused GCCs, offering customs, GST and other indirect-tax benefits, though the direct income-tax holiday once available to new SEZ units has largely ended. Updated SEZ Rules have also given IT and ITeS units more flexibility in using office space, including in non-processing areas.

Outside an SEZ, the Software Technology Parks of India (STPI) framework offers a dedicated route for software and IT/ITeS export-oriented units, with certain customs and regulatory facilities depending on the applicable scheme.

State-level incentives have become an increasingly important part of the location decision, as states compete to attract GCCs with support for employment, infrastructure, R&D and operating costs — though the value of these incentives varies widely by state, location and GCC size. Karnataka's GCC Policy 2024–2029, for instance, promotes GCC growth beyond Bengaluru with support for rent, employment costs, R&D infrastructure and connectivity; eligible GCCs in identified "Beyond Bengaluru" locations can get up to 50% rent reimbursement in the first year, capped at ₹2 crore for GCCs with 500 or more employees, subject to conditions.

Before relying on any such incentive, a company should check eligibility, investment or employment conditions, the claim process and how long the benefit lasts. Location strategy should therefore be assessed alongside legal, tax, employment and financial structure — the best location is not the one with the highest subsidy, but the one offering the best overall mix of talent, infrastructure, cost and long-term flexibility.

Employment Law and the Evolving Labour Codes:

A GCC's most important asset is its people — engineers, data scientists, researchers, finance professionals and management — making employment law central to its operating framework.

India's employment law changed significantly with the four Labour Codes — the Code on Wages, 2019, Industrial Relations Code, 2020, Code on Social Security, 2020 and Occupational Safety, Health and Working Conditions Code, 2020 — which took effect on 21 November 2025, consolidating a number of earlier central labour laws.

One key change is the revised definition of "wages": where specified allowances exceed 50% of total remuneration, the excess is added back to wages for statutory calculations, though components like annual performance incentives, ESOPs and specified reimbursements are excluded. This can affect gratuity, provident fund and other statutory costs, so GCCs should factor the new wage rules into salary design and long-term cost planning.

The Codes also cover minimum wages, social security, industrial relations, working conditions, safety, hours, leave and record-keeping and these need to be built into HR and compliance processes for large workforces. Detailed rules under the Codes are still being implemented and the Ministry of Labour has clarified that existing rules remain relevant, to the extent consistent with the Codes, until new rules are finally notified — so GCCs should monitor this transition closely.

Employment agreements should clearly cover remuneration, duties, confidentiality, IP, information security, use of company systems and termination and should be reviewed for consistency with Indian law rather than relying solely on a global template. IP ownership deserves particular attention, since employees may create software, designs or inventions during their work — these arrangements should be spelled out rather than left to a generic policy.

The POSH framework is another key requirement: establishments with 10 or more workers must set up an Internal Committee to handle sexual harassment complaints, with defined responsibilities for prevention, awareness and reporting, including an annual report.

As a GCC grows from a handful of employees to a workforce of thousands across multiple locations handling sensitive technology, its HR and compliance framework — onboarding, payroll, safety, grievance handling, POSH, records and exits — needs to scale accordingly, since employment compliance directly affects cost, retention, IP protection and regulatory risk.

Intellectual Property and Proprietary Data

As a GCC takes on more sophisticated work, IP becomes central to its structure. A centre doing routine finance work creates little IP; one where engineers build software, algorithms or new technology may be creating some of the group's most valuable assets. The starting question is not just who owns the IP, but what is being created, by whom, where and under what contract.

Indian law has no single rule making all employee-created IP automatically belong to the employer — the position differs for copyright and patents and depends on the terms of employment. Employment and consultancy agreements should therefore expressly address IP ownership and assignment: copyright assignments must be in writing and specify the rights assigned and patent assignments must be properly documented.

The MSA between the Indian GCC and the overseas group should set out how IP created in India will be handled within the group — whether assigned or licensed to another entity — and should distinguish IP that existed before the GCC's engagement from IP created during it, to avoid disputes later.

Confidential information and trade secrets need separate protection through confidentiality agreements and internal controls, since India has no standalone trade secrets statute. Open-source software also needs an internal approval and tracking process, since different licences carry different attribution, disclosure or licensing obligations. The same discipline applies to proprietary data such as source code, customer information and product roadmaps — contracts and policies should clearly define who can access it, how it can be used and what happens when an employee leaves or a contract ends.

As a GCC moves from routine support into product development and R&D, IP and confidentiality provisions should be treated as a core part of its legal and commercial framework, not boilerplate.

Data Protection, Cybersecurity and the DPDP Act 2023

The Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (notified 13 November 2025) together set out India's framework for processing digital personal data. Not all provisions took effect immediately — some are phased in over the next one to eighteen months — so GCCs should treat compliance as a staged process rather than a single event.

A typical GCC handles employee, customer and vendor data, along with personal data received from the overseas parent. Its role can vary: where the parent decides why and how data is processed, the GCC may act as a Data Processor; where the GCC itself decides the purpose and means (such as for its own employees), it may be a Data Fiduciary. This depends on the GCC's actual role, not simply on group membership.

A GCC should know what personal data it collects, why, where it is stored, who can access it, which group companies or vendors receive it, how long it is retained and what happens to it afterward. This matters especially because data often moves between India and other group locations as part of routine operations.

The DPDP Act does not ban cross-border data transfers outright, but Section 16 allows the government to restrict transfers to specified countries and other Indian laws may impose additional protections for particular data categories. GCCs should therefore maintain clear controls over international transfers, access rights, vendors and security measures rather than assuming free movement of data.

Data protection and cybersecurity are closely linked — one governs how personal data is used and shared, the other protects systems from unauthorised access or attack. Appropriate measures include access controls, strong authentication, encryption, system monitoring, employee awareness, vendor security checks, backups and incident response. For larger GCCs, responsibility for data governance should be clearly allocated across the Indian entity, the parent, employees and vendors and should evolve as the GCC's role grows rather than being treated as a purely IT matter.

Regulatory Considerations for Specialised GCCs

A GCC's compliance obligations depend not just on its parent's industry but on what the Indian entity itself actually does. A GCC supporting a bank may need to consider RBI requirements if it handles financial-sector systems or functions; one supporting an insurer may need to factor in IRDAI's information security, cybersecurity and outsourcing requirements. Similar logic applies to pharmaceutical GCCs handling clinical research or regulated product information and defence-related GCCs handling sensitive technology.

Being a captive, wholly owned GCC does not exempt it from applicable regulation, but it also does not automatically make every GCC a regulated entity — the analysis depends entirely on its actual functions. The key question is simple: what exactly will the Indian GCC do, what systems and information will it access and does any of its activity fall within a regulated category in India? Mapping the GCC's functions against applicable regulatory requirements helps identify the licences, approvals, controls and contractual protections it may need — a step that becomes especially important as GCCs move into payments, financial operations, healthcare, clinical research or cybersecurity.

Government Initiatives: The Push for a National GCC Framework

The Government has taken growing interest in expanding GCCs beyond India's traditional hubs. The Union Budget 2025–26 proposed a National Framework for GCCs to guide states in promoting GCC growth in emerging Tier-2 cities, covering areas like talent, infrastructure and industry collaboration, through a set of measures aimed at strengthening the ecosystem in these locations.

While Bengaluru, Hyderabad, Mumbai, Pune, Chennai and Delhi-NCR remain major GCC hubs, this signals a wider push to build talent and infrastructure in emerging cities, giving multinationals more choice on location, potentially lower costs and access to state-specific incentives.

However, a policy announcement is not the same as an available incentive. The National Framework does not by itself create a legal right to any subsidy or tax benefit — actual benefits depend on the specific state or central policy notified and on the GCC's location, activities, headcount and investment. Because GCC incentives are typically introduced through state-specific schemes rather than one national programme, companies should evaluate the relevant state policy, eligibility conditions and application process before factoring any incentive into their business case.

The National Framework is best seen as an enabling initiative to make emerging cities more attractive for GCC investment, rather than a standalone incentive scheme. Location selection should therefore weigh talent, infrastructure, connectivity, regulatory environment and state incentives together, not just compare office rents.

Practical Implementation Roadmap

Setting up a GCC works best as a phased project rather than a single incorporation exercise, so that the company, contracts, people, funding and compliance are all ready when operations begin.

• Phase 1: Planning and Structuring

The first step is to define what the GCC will actually do — shared services, technology, engineering, R&D, global operations or a mix — since this shapes decisions on tax and transfer pricing, PE risk, IP ownership, data protection, employment and location. By the end of this phase, the group should be able to answer: what will the GCC do, who will it serve, how will it be funded, where will it operate and what IP and information will it handle?

• Phase 2: Incorporation and Capitalisation

Once the structure is finalised, the Indian company can be incorporated and capitalised, with any foreign funding structured and reported under FEMA (for example, equity issues to non-residents generally reported via Form FC-GPR within 30 days). This phase should also cover drafting the key inter-company documents — the MSA, employment and consultancy agreements, IP arrangements, secondment terms, confidentiality provisions and delegation of authority — so the legal framework reflects how the business will actually run from day one.

• Phase 3: Operationalisation

This phase turns the legal structure into a working business: GST registration, bank accounts, payroll and accounting systems, licences, premises, employment policies, POSH compliance and data and cybersecurity controls. Where the GCC operates from an SEZ or under STPI, the relevant approvals and conditions apply. GST and FEMA treatment of services to overseas group companies should be based on the actual nature of those services — not every service automatically qualifies as an export — with supporting contracts and documentation kept consistent.

• Phase 4: Scaling and Governance

As the GCC operates and grows, its compliance framework should be monitored across related-party transactions, transfer pricing, foreign investment reporting, SBO, board governance, employment, data protection, IP and CSR. A centre that starts with 100 employees in finance may later run global technology or R&D for thousands of people — as its role changes, its inter-company agreements, pricing model, IP arrangements, delegation of authority and governance structure should be reviewed periodically, so the legal framework keeps reflecting the actual business.

In short: plan the structure, incorporate and fund the entity, build the operational framework and monitor and adapt as the GCC grows. This lets the GCC stay compliant while remaining capable of supporting a larger, more strategic role over time.

Key Risks and Common Pitfalls

The most serious problems rarely stem from incorrect incorporation. They usually arise because the business evolves while the legal and contractual framework does not. A GCC that starts as a routine shared-services centre may, years later, employ thousands of engineers building important technology — and if the contracts still describe it as a low-risk support centre, this mismatch can create real problems for transfer pricing, tax, IP ownership and risk allocation. The lesson: contracts should describe what the GCC actually does, not what it was originally meant to do.

Secondment arrangements deserve the same scrutiny — who employs the individual, who pays them, who supervises the work and how long the assignment lasts should all be clear, since these facts can also affect the group's tax position, including PE risk. IP is another common gap: global employment templates may not properly address IP ownership and assignment for work created in India, so this should be documented specifically and kept consistent with Indian law.

Regulatory blind spots are also common — a GCC supporting a regulated business (financial services, insurance, healthcare, pharmaceuticals, defence) should assess whether its own functions, systems or data trigger sector-specific requirements, even if it has no direct customer contact. That said, the parent's regulated status does not automatically make every GCC activity regulated — the analysis should follow what the GCC actually does.

More routine compliance gaps can also emerge as headcount, activities, ownership, related-party transactions, data processing, IP creation or capital structure change, each of which can trigger new requirements. The common thread: a GCC is not a static structure. As its people, functions, technology and responsibilities evolve, so should its contracts, tax position, IP arrangements, regulatory approach and governance. The real goal is not a legally compliant GCC on day one, but one whose legal structure keeps pace with its business throughout its life.

What Should Multinationals Keep in Mind?

The decision to establish a GCC in India should not end with incorporating the company and setting up an office. The more important question is whether the legal and commercial framework created at the beginning will continue to work as the GCC grows.

A GCC that starts with a small technology or support team may, within a few years, become responsible for global R&D, product development, data analytics, cybersecurity or other functions that are central to the multinational's business. As those responsibilities increase, the legal character of the Indian operation can also change.

Multinational groups should therefore periodically revisit the structure of their GCC rather than treating the original setup as permanent. The inter-company agreements, transfer pricing model, intellectual-property arrangements, delegation of authority, employment structures and data-governance framework should all be reviewed against the functions actually being performed in India.

This is particularly important where the GCC begins creating significant intellectual property or taking decisions that have a direct impact on the group's global business. In such circumstances, a structure designed for a routine support centre may no longer accurately reflect the value and responsibilities of the Indian operation.

The most effective GCC strategy is consequently one that combines legal compliance with commercial flexibility. The objective should not simply be to establish an entity that complies with Indian law on day one, but to create a structure capable of evolving with the business.

For multinational companies, India offers an increasingly mature ecosystem in which a GCC can progress from a traditional shared-services operation to a global centre for technology, innovation and strategic capabilities. The organisations that plan for that evolution from the outset will be better placed to capture the full value of the Indian GCC opportunity.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.