Cybersecurity firms that sell penetration tests, managed detection and response, audits or incident response to foreign clients must declare those invoices on a monthly EDF filed with their AD bank. Most cybersecurity work is delivered remotely, so mode of delivery is Internet, and software-related services can be filed with either the AD bank or STPI. The real decisions are which codes fit your work and how to handle urgent incident-response billing.
Key takeaways
- Every export invoice for security services, from one-off pen tests to monthly SOC fees, goes on the EDF for the month it was raised.
- Typical SAC codes are 998313 (IT consulting and support) and 998319 (other IT services); confirm with your CA.
- Purpose code P0802 (software consultancy and implementation) often fits; other codes may suit, so confirm with your bank.
- If your services count as software exports, you may file with the AD bank or STPI; otherwise, the AD bank.
- Incident-response engagements often start before a contract is signed; keep the paper trail tight for matching.
Where cybersecurity fits under the 2026 Regulations
The Foreign Exchange Management (Export and Import of Goods and Services) Regulations, 2026 brought software and all other services onto a single EDF, replacing SOFTEX. For filing purposes, the question is only where your unit sits and whether your exports are software:
| Your unit | What you export | EDF goes to |
|---|---|---|
| Outside an SEZ | Software-related services | AD bank or STPI |
| Outside an SEZ | Other services (audit, advisory, training) | AD bank |
| Inside an SEZ | Any services | SEZ Development Commissioner |
Many security firms do a mix: a managed service that runs on their own platform, consulting and audits, and occasional training. If you are unsure whether to treat part of your work as software, the simplest route is to file everything with your AD bank, which accepts both.
Mapping security services to codes
The EDF asks for a SAC code on every invoice row, and your FIRA will carry an RBI purpose code. Here is a starting map. Treat it as a conversation starter with your CA and bank, not a ruling.
| Service | Possible SAC | Possible purpose code |
|---|---|---|
| Penetration testing, vulnerability assessment | 998313 | P0802 |
| Security architecture and advisory | 998313 or 998311 | P0802 or P1006 |
| Managed SOC / MDR delivered from India | 998319 or 998313 | P0807 or P0802 |
| Security tool implementation | 998313 or 998314 | P0802 |
| Compliance audits and readiness | 998313 or 998311 | P1006 or P0802 |
| Security awareness training (online) | Confirm with CA | Confirm with bank |
P0807 covers off-site software exports, P0802 software consultancy and implementation, and P1006 business and management consultancy. The right choice depends on what you actually deliver. Our purpose code finder and SAC code finder help shortlist.
Describing the work without exposing the client
Security clients are protective of findings, and rightly so. Your EDF description should identify the service type and scope without saying what you found.
- Good: "External penetration test, web application, report dated 18-11-2026"
- Good: "Managed detection and response, November 2026, 1,200 endpoints"
- Avoid: "Critical SQL injection remediation for payments portal"
A neutral description also keeps the invoice usable for GST and audit without passing sensitive detail around your bank.
Worked example: a month at Bastion Shield
Bastion Shield Technologies Pvt Ltd, a Pune security firm outside any SEZ, raises these invoices in February 2027:
| Invoice | Client | Country | Service | Currency | Amount |
|---|---|---|---|---|---|
| BST/26-27/510 | Fintech | Singapore | MDR service, February | SGD | 9,800 |
| BST/26-27/511 | Healthcare SaaS | USA | Web app pen test, report dated 12-02-2027 | USD | 7,500 |
| BST/26-27/512 | Retailer | UK | ISO 27001 readiness, phase 2 | GBP | 5,200 |
| BST/26-27/513 | Logistics firm | Netherlands | Incident response, 6–9 February 2027 | EUR | 16,400 |
All four go on one EDF for February 2027, due by 30 March 2027. Bastion files with its AD bank, ticking Software or Services according to what its CA has advised for its mix of work, with Internet as mode of delivery and Others as mode of realisation.
The incident-response invoice is the large one, above ₹10 lakh in rupee terms, so when it is paid Bastion will send the bank the invoice, payment evidence and matching instructions. The others can be closed through a periodic realisation declaration if each stays within ₹10 lakh.
Incident response: billing under pressure
Incident response often starts at 2 a.m. with a phone call and a verbal go-ahead. The paperwork follows days later. For the EDF and for realisation, that creates three risks:
- No contract reference. Get at least an email authorisation or a signed engagement letter, and enter its date in the contract column.
- Payment before invoice. Some clients wire a retainer immediately. Tell your bank what it relates to and invoice promptly, so the advance can be matched.
- Insurer or broker pays. If a cyber insurer or the client's parent pays, the payer differs from the recipient. Use the third-party fields (1.15–1.16) and remarks, and keep the supporting letter.
Our article on third-party payments in the EDF covers that last case.
GST and the managed-service question
Export of services is zero-rated. Most security firms invoice under an LUT with the wording "Supply meant for export under LUT without payment of IGST". One area to review with your CA is whether any part of a managed service is performed on equipment or sites in India in a way that affects place of supply. The EDF does not change GST outcomes; it is a FEMA declaration. This article is general information, not legal or tax advice.
Monthly routine for a security firm
- Export invoices from your PSA or billing tool at month-end.
- Check each row has a neutral description, SAC code, contract reference and currency.
- File the EDF in the first two weeks of the next month.
- Match FIRAs as payments arrive; check purpose codes immediately.
- Review open invoices older than six months; chase or request an extension well before nine months.
Frequently asked questions
Do cybersecurity firms file with the AD bank or STPI?
If your exports are software-related and your unit is outside an SEZ, you may file with either. Other services go to the AD bank. Firms with mixed work often file everything with the AD bank for simplicity.
Which purpose code is right for penetration testing?
P0802, software consultancy and implementation, is a common fit, but practice varies. Agree the code with your bank and ask your client to describe the payment consistently.
How should a managed SOC retainer appear on the EDF?
Each monthly invoice is one row in the EDF for the month it was raised. Note the service period in the description or remarks, such as "MDR service, February 2027".
What if a cyber insurer pays the incident-response invoice?
The payer is then a third party. Fill the third-party and relationship fields, add a remark, and keep the insurer's payment letter. Ask your bank how it wants this documented before the money arrives.
Do I have to disclose findings in the EDF description?
No. Describe the type and scope of service only. A neutral description such as "external penetration test, report dated 18-11-2026" is enough for matching.
Bottom line
For security firms, the EDF is less about the form and more about clean descriptions, sensible codes and documented engagements. Settle your code map once with your CA and bank, then file monthly with the free EDF form generator.
This guide is general information for Indian businesses, not legal or tax advice. Rules and bank processes change — confirm specifics with your AD bank or chartered accountant.