Safe Harbour Rules for IT, ITES and Captives: Opting in and the Margins

India’s transfer pricing safe harbour framework has been overhauled under the Income Tax Act, 2025 and Income Tax Rules, 2026, effective 01 April 2026. For the first time since 2013, the rules are commercially realistic: a single uniform margin, a dramatically wider transaction cap, and an automated approval mechanism that replaces manual officer scrutiny. For Indian IT entities, GCCs, and captive service providers billing their overseas group, this represents a genuine decision point rather than a formality to decline.

The choice is not as simple as comparing 15.5% against your current billing margin, however. The opt-in carries a 5-year lock-in, forfeits Mutual Agreement Procedure (MAP) relief, and hinges on a conduct-over-contract risk test that the tax department can revisit. Understanding those constraints before filing Form 49 is what separates a clean compliance outcome from an expensive reversal.

What is the safe harbour margin for IT services in India under the new rules?

Under Rule 89(2) read with Section 167 of the Income Tax Act, 2025, the safe harbour margin for the consolidated “Information Technology Services” category is 15.5% of operating expenses, applicable from Tax Year 2026-27. This covers software development, ITeS, KPO, and contract R&D relating to software under a single unified bucket. Aggregate transaction revenue from the eligible international transaction must not exceed ₹2,000 crore in the first tax year of the 5-year block.

What the 2026 safe harbour framework actually does

Safe harbour under Section 167 of the Income Tax Act, 2025 is a binding acceptance mechanism. If an eligible assessee satisfies the prescribed conditions, the income-tax authorities shall accept the declared transfer price or income without scrutiny. The word “shall” is not discretionary. Once the conditions are met and the option is validly exercised, the Transfer Pricing Officer (TPO) has no power to reopen, adjust, or substitute a different arm’s length price for the covered transaction.

The framework under Rules 86 to 102 of the Income Tax Rules, 2026 covers three distinct streams. Stream 1 (Rules 86 to 93) governs international transactions, which is where IT services, data centres, intra-group loans, corporate guarantees, pharma R&D, and auto components sit. Stream 2 (Rules 94 to 98) covers specified domestic transactions, limited to regulated electricity companies and dairy cooperatives. Stream 3 (Rules 99 to 102) handles income attribution for non-resident foreign companies running bonded warehouse operations or diamond trading in India. For most IT captives and GCCs, Stream 1 is the operative regime.

The practical shift in the 2026 rules is threefold. First, the margin has been reset to a commercially realistic level. The previous structure set software development at 17%, ITeS at 17-18%, KPO at 18%, and contract R&D at 24%. The margins consistently sat above what Indian IT entities were actually earning and above what APAs were settling at, which made the old safe harbour effectively punitive for anyone who took it seriously. The new 15.5% uniform rate is below the floor that most TPOs were targeting in scrutiny. Second, the ₹2,000 crore aggregate revenue threshold opens the regime to mid-sized and large IT entities that were previously locked out. Third, the approval for IT services under Rule 91 is system-driven through DGIT(Systems), bypassing officer discretion entirely.

Safe harbour margin evolution for IT services

Period	Software development	ITeS	KPO	Contract R&D (software)	Threshold
2013-2016	20%	20-22%	25%	24-29%	₹100-200 Cr
2017-2025	17%	17-18%	18%	24%	₹300 Cr
From 01/04/2026	15.5% (consolidated)	15.5% (consolidated)	15.5% (consolidated)	15.5% (consolidated)	₹2,000 Cr

Who qualifies: the eligible assessee and the insignificant-risk test

The foundational eligibility condition for the IT services safe harbour is that the assessee must provide software development services, ITeS, KPO services, or contract R&D relating to software “with insignificant risk” to a foreign principal. This phrase is the single most scrutinised word in the entire framework.

Rule 87(2) sets out five factors that DGIT(Systems) will assess to determine insignificant risk:

• The foreign principal performs the economically significant functions: conceptualisation, product design, and strategic direction. The Indian entity executes assigned tasks.
• Capital, funds, and economically significant assets including intangibles are provided by the foreign principal or its affiliates. The Indian entity is remunerated only for its work.
• The Indian entity operates under direct supervision of the foreign principal, which exercises actual control through strategic decisions and regular monitoring, not merely contractual rights.
• The Indian entity does not assume or realise economically significant risks. Rule 87(2)(d) explicitly states that contractual terms are not determinative if conduct shows otherwise.
• The Indian entity has no legal or economic ownership right over intangibles generated during service delivery. All IPR vests with the foreign principal, as evident from both the contract and actual conduct.

The fifth factor and the fourth factor carry a specific warning that most advisors understate. The rules explicitly say conduct can override contract. A captive whose Master Service Agreement says the parent controls IPR but whose Indian team is filing patents, building proprietary frameworks, and licensing methodology back to the group will fail the insignificant-risk test regardless of what the contract states. Treelife has seen this pattern in GCC structures where the India entity gradually took on innovation functions without updating the intercompany agreement or the functional profile. By the time a TPO examination arrives, the facts on the ground no longer match the paper, and the safe harbour election is invalidated retrospectively.

The rule does not require that all five factors be satisfied as a conjunctive test, but the DGIT(Systems) automated system will weigh them together. A company that performs 80% of product design and holds 60% of the relevant intangibles has a weak case, irrespective of what the cost-plus agreement says.

What services are excluded from the IT services safe harbour?

Contract R&D services, KPO services, and ITeS are each defined to exclude R&D services under Rules 86(b), 86(h), and 86(j). An Indian entity that conducts genuine R&D activities where the outcome is uncertain, where it holds economic ownership of the resulting intangibles, or where it bears the commercial risk of R&D failure, does not qualify for the IT services safe harbour. Such entities would need to meet a higher 24% OPM threshold under the pharma R&D category, or demonstrate arm’s length pricing through a benchmarking study or APA. Software product companies where IP vests in India, and IT consulting entities that bear entrepreneurial risk, are also outside the eligible assessee definition.

How OPM is actually computed under Rule 86

The safe harbour margin of 15.5% is expressed as a cost-plus markup on operating expenses:

OPM = (Operating Revenue minus Operating Expenses) / Operating Expenses x 100%

For a company with ₹500 crore in operating expenses, the minimum operating revenue required for safe harbour is ₹577.5 crore (₹500 crore plus ₹77.5 crore markup).

The definitions of operating revenue and operating expense under Rules 86(o) and 86(n) matter enormously here, and the common mistakes sit in the inclusions and exclusions on both sides.

Operating expenses include: costs incurred in the tax year in relation to the international transaction during normal operations, ESOP or stock-based compensation provided by the AE to employees of the Indian entity, reimbursements to or from AEs at cost, and depreciation and amortisation on assets used in the service.

Operating expenses exclude: interest expense, provisions for unascertained liabilities, pre-operating expenses, foreign currency fluctuation losses, extraordinary expenses, losses on transfer of assets or investments (except assets on which depreciation is included in operating expense), and income tax expense.

Operating revenue excludes: interest income, foreign currency fluctuation income, income on transfer of assets or investments (except the depreciation carve-out), income tax refunds, provisions written back, and extraordinary income.

Two computation points cause the most disputes in practice:

ESOP costs. Rule 86(n) explicitly includes ESOP and stock-based compensation provided by the AE to the Indian entity’s employees in operating expenses. This was a contested area before the 2026 rules because several ITAT benches had held that ESOPs debited to the P&L under Ind AS 102 are notional costs and should be excluded from the operating cost base. Under the new safe harbour framework, they are included by statute. The consequence is that ESOP-heavy GCCs with senior talent receiving large parent-company grants will see their operating expense base swell, which pushes down the computed OPM for the same level of billing. A captive billing at a 16% markup on cash costs may find itself below 15.5% once parent ESOPs are folded into the denominator.

Forex treatment. Foreign currency gains are excluded from operating revenue and forex losses are excluded from operating expense. This ring-fencing is a two-edged sword. In a year where the rupee appreciates significantly, the company cannot credit the forex gain to boost OPM. In a year of rupee depreciation, it cannot deduct forex losses either. The result is that OPM under the safe harbour definition can diverge materially from the OPM computed for statutory accounts purposes. Companies should compute safe harbour OPM separately and not rely on the P&L margin without adjustment.

OPM impact of key cost items

Cost item	Included in OPM denominator?	Impact on OPM if high
ESOP grants from foreign parent	Yes (Rule 86(n))	Reduces OPM
Depreciation on service assets	Yes	Reduces OPM
Foreign exchange losses	No (excluded)	Neutral
Interest on external debt	No (excluded)	Neutral
Provisions for contingencies	No (excluded)	Neutral
Pre-operating setup costs	No (excluded)	Neutral
Reimbursements received from AE	Included at cost	Neutral (revenue = expense)

How does the 5-year IT services block work under Rule 91?

For IT services safe harbour, Rule 91 provides a distinct and considerably more taxpayer-friendly procedure than the standard Rule 90 mechanism that applies to other transactions.

A single Form 49 filing in Year 1, submitted to DGIT(Systems) rather than the Assessing Officer, covers five consecutive tax years. There is no annual re-application. The ₹2,000 crore aggregate revenue threshold is tested only in Year 1: if the company qualifies in TY 2026-27, it does not need to retest in TY 2027-28 through TY 2029-30, even if revenues grow beyond the threshold. Form 49 for IT services must be certified by the CEO or CMD of the company, in addition to the standard return verification. This dual-layer certification is specific to IT services and places explicit responsibility on the principal officer for the accuracy of the functional profile declaration.

The DGIT(Systems) system processes the filing electronically and must issue an acceptance or rejection within two months from the end of the month in which the option is exercised. Rejection requires a written statement of reasons and an opportunity to cure defects. If the system fails to respond within the two-month window, the option is deemed valid under Rule 91.

For Years 2 through 5, the company must file a statement on or before the return due date confirming the details of eligible transactions, their quantum, and the profit margins. This annual statement is not a re-application, but it is a live declaration that the functional profile has not changed materially.

Withdrawal: the trap inside the 5-year block. Under Rule 91(9) to (12), withdrawal of the safe harbour option is permitted, but only within six months from the end of the first tax year. After that window closes, withdrawal is not available for the remainder of the block. If the option is withdrawn in that window, it ceases to apply for the year of withdrawal and all subsequent years of the 5-year block. The company cannot re-exercise the option until after the entire five-year period has elapsed.

What this means practically: a company that opts in for TY 2026-27 and has until 30 September 2027 to withdraw. If cost pressures in TY 2027-28 push OPM below 15.5%, the company is locked in, cannot withdraw, and must comply with the safe harbour margin for that year even if it results in over-billing relative to what the market would support. The AO, upon verifying that the declared transfer price does not meet the circumstances of Rule 89(2), will adopt the 15.5% OPM as the applicable price. This is a floor, not a ceiling, but it is also a price that must be charged and taxed, regardless of whether the intercompany billing in that year was lower.

What happens to MAP if you opt into safe harbour?

Rule 93 states that where a transfer price is accepted under Section 167 for an eligible international transaction, the taxpayer cannot invoke the Mutual Agreement Procedure (MAP) under any Double Taxation Avoidance Agreement (DTAA) in respect of that transaction.

This is the consequence most captives fail to model before opting in. MAP is the mechanism through which India’s competent authority negotiates with a foreign tax authority to relieve double taxation when both countries seek to tax the same income. For IT services, this typically arises when the Indian safe harbour fixes a 15.5% margin for the Indian entity, but the foreign parent’s home country taxes the residual profit as if the Indian entity should have earned more. The Indian safe harbour prevents the Indian competent authority from entering the conversation.

The MAP exclusion is transaction-level, not entity-level. The company can still invoke MAP for other transactions not covered by safe harbour. But for the core IT services billing, the election to accept safe harbour is also an election to forfeit bilateral protection for that transaction in all five years of the block.

For GCCs headquartered in high-tax jurisdictions where the parent is already subject to Pillar Two top-up taxes, this interaction deserves explicit modelling. If the Indian 15.5% margin results in a residual group profit that another jurisdiction taxes at a rate that triggers a qualified domestic minimum top-up tax, the Indian safe harbour could create irresolvable double taxation with no available remedy. Pillar Two and safe harbour interact in ways that the 2026 rules do not address, and this is an area where human verification with an international tax specialist before filing is not optional.

Safe harbour vs APA vs benchmarking: which route suits your entity?

The 2026 rules make safe harbour the lowest-friction option for routine captive IT service providers. For more complex profiles, APA and benchmarking remain relevant.

Safe harbour suits entities with: a clean insignificant-risk functional profile, transaction revenues under ₹2,000 crore, consistent OPM above 15.5% across the 5-year planning horizon, and no existing MAP or APA positions that safe harbour would disrupt.

APA (Advance Pricing Agreement under Section 168 of the Income Tax Act, 2025) suits entities with: complex or bespoke transfer pricing methodologies, high transaction values above the safe harbour threshold, bilateral tax risk that requires MAP protection, or atypical risk profiles that would fail the insignificant-risk test. Budget 2026 introduced a fast-track unilateral APA mechanism for IT services with a two-year target timeline. An APA preserves MAP rights, covers up to nine years with rollback, and allows a negotiated margin below 15.5% if the company’s functional profile justifies it.

Benchmarking study (annual comparable company analysis) suits entities transitioning between profiles, testing new service lines not covered by safe harbour categories, or those whose OPM is structurally above 17% and who want to demonstrate arm’s length pricing at a higher rate without fixing it at 15.5%.

Safe harbour vs APA vs benchmarking comparison

Parameter	Safe harbour	APA	Benchmarking study
Margin	15.5% fixed (IT)	Negotiated	Market-determined
Validity	5 years (IT), 3 years (others)	Up to 9 years with rollback	Annual
Cost	CA certificate, Form 49	Statutory filing fee (scales with transaction value) + advisory	Annual benchmarking study + advisory
TPO scrutiny	None on eligible transaction	None during validity	Full scrutiny risk
MAP rights	Forfeited for covered transaction	Preserved	Preserved
Approval mechanism	Automated, DGIT(Systems)	Negotiated with CBDT	N/A
Best for	Routine captives, GCCs up to ₹2,000 Cr	Complex, high-value, bilateral risk	Transitional or high-margin entities

Common mistakes that cost captives their safe harbour election

Mistake 1: Not auditing the functional profile before filing. The insignificant-risk test under Rule 87(2) is verified at the time of filing, but the conduct-over-contract principle means the actual facts on the ground are what count. Captives that have quietly expanded from pure execution roles into product roadmap ownership, local sales support, or client-facing functions over the past three years may no longer satisfy the five-factor test. Filing Form 49 with a functional profile that does not match reality exposes the company to an invalid option declaration by the DGIT(Systems), which voids safe harbour for the entire 5-year block.

Mistake 2: Computing OPM from statutory accounts without adjustment. The Rule 86 definitions of operating revenue and operating expense are not the same as the Ind AS P&L. ESOP costs must be included; forex gains and losses must be stripped out; pre-operating costs and provisions for contingencies must be excluded. A company whose statutory OPM is 16.8% may find its Rule 86 OPM is 14.9% after these adjustments, which is below the safe harbour floor.

Mistake 3: Missing the CEO/CMD certification. Under Rule 91(16), the Form 49 for IT services requires certification by the CEO or CMD in addition to the return verification. Treating this as a standard Form 3CEB filing signed by the CFO or by the authorised signatory will result in a defective Form 49 that the DGIT(Systems) system will reject.

Mistake 4: Ignoring the withdrawal window. The six-month withdrawal window closes at the end of 30 September of Year 1 (i.e., 30 September 2027 for a TY 2026-27 opt-in). Once it closes, the entity is committed for the remainder of the 5-year block. Captives that plan a significant shift in service lines, a transfer of operations to a different entity, or a change in intercompany billing model during the block period should model the impact of being locked into safe harbour before that window shuts.

Mistake 5: Assuming safe harbour removes documentation obligations. Sections 171 (TP documentation) and 172 (accountant’s report in Form 48) continue to apply irrespective of the safe harbour election. The company must maintain a master file, local file, and Form 48, and must produce these if called upon during verification. Safe harbour removes TPO scrutiny of the eligible transaction, not documentation maintenance obligations.

Treelife practitioner note

In the transfer pricing engagements we have run at Treelife for GCCs and captive IT entities, the 2026 safe harbour reset changes the risk calculus meaningfully, but the decision to opt in is rarely straightforward once you examine the entity’s actual functional profile.

The pattern we see most often: an Indian captive was incorporated five years ago as a pure cost-plus service provider. Over time, the Indian team built delivery frameworks, hired senior architects who take technical decisions independently, and started onboarding clients in the APAC region with minimal oversight from the foreign principal. The intercompany agreement was never updated. The company still bills at a cost-plus margin and files Form 3CEB as a low-risk service provider. Under the old rules, this was a TPO risk that could be managed through benchmarking. Under Rule 87(2), the conduct-over-contract principle means the same entity may now fail the insignificant-risk test for safe harbour, even though the margin and the revenue cap would otherwise qualify it.

The five-factor test in Rule 87(2)(d) and (e) is particularly pointed: contractual terms are explicitly stated to be not determinative where conduct shows the Indian entity assumes economically significant risks or holds IPR. We recommend that any GCC planning to opt in conducts a functional analysis refresh before filing Form 49, comparing the entity’s actual 2024-26 activities against each of the five factors and documenting the factual basis for each conclusion. The CEO/CMD who certifies the Form 49 is personally attesting to the entity’s eligible status. That certification should be backed by written functional analysis, not informal assurance.

The OPM computation under Rule 86 also requires specific attention to ESOP treatment. For large GCCs where the foreign parent grants RSUs to senior Indian employees, the ESOP inclusion can compress the Rule 86 OPM by 1.5 to 3 percentage points relative to the statutory margin. Companies sitting at a statutory OPM of 16-17% may find themselves below the 15.5% safe harbour floor after this adjustment, which changes the entire decision.

Frequently asked questions

Q: What is the safe harbour margin for IT services under the Income Tax Rules, 2026?
A: 15.5% of operating expenses, as a single uniform rate across all IT service subcategories: software development, ITeS, KPO, and contract R&D relating to software. This replaces the previous category-specific range of 17-24% under the old rules. (Rule 89(2), Income Tax Rules, 2026.)

Q: What is the transaction threshold for IT services safe harbour?
A: ₹2,000 crore aggregate operating revenue from the eligible international transaction in the first tax year of the 5-year block. The threshold is tested only once, in Year 1. If satisfied then, revenues may exceed ₹2,000 crore in subsequent years without disqualifying the entity.

Q: Does safe harbour apply automatically?
A: No. Safe harbour is an election. The entity must file Form 49 with DGIT(Systems) for IT services under Rule 91, within the due date for filing the return of income for TY 2026-27. The system verifies eligibility and issues acceptance or rejection within two months.

Q: What transactions does safe harbour not cover?
A: Safe harbour is categorically unavailable for transactions with associated enterprises in Notified Jurisdictional Areas (countries notified under Section 176 for lack of effective information exchange) or in countries with a maximum income tax rate below 15%, defined as “no tax or low tax” jurisdictions under Rule 86(m). (Rule 92, Income Tax Rules, 2026.)

Q: Can a captive withdraw from safe harbour if its margins fall below 15.5% in Year 2?
A: Withdrawal is only possible within six months from the end of Year 1 of the block (i.e., by 30 September 2027 for a TY 2026-27 election). After that window, withdrawal is not permitted for the remaining years. An entity whose OPM falls below 15.5% in Year 2 cannot withdraw; the AO will apply 15.5% as the required price. (Rule 91(9)-(12).)

Q: Does opting into safe harbour remove the need for TP documentation?
A: No. Sections 171 (TP documentation maintenance) and 172 (Form 48 accountant’s report) continue to apply. The documentation obligation is not waived; only the TPO’s power to adjust the transfer price for the eligible transaction is removed.

Q: What happens to MAP rights after opting into safe harbour?
A: MAP under any DTAA (Section 159 of the Income Tax Act, 2025) cannot be invoked for a transaction for which safe harbour has been accepted. This is transaction-level, not entity-level, so MAP remains available for other non-safe-harbour transactions of the same entity. (Rule 93.)

Q: Is KPO covered under the consolidated IT services category?
A: Yes. Knowledge Process Outsourcing (KPO) services are defined under Rule 86(j) as BPO services requiring application of knowledge and advanced analytical or technical skills. KPO is merged into the “Information Technology Services” consolidated category at 15.5%, subject to the insignificant-risk condition. KPO explicitly excludes R&D services.

Q: What is the block period for safe harbour under the 2026 rules?
A: For IT services under Rule 91, the block is five consecutive tax years. For all other eligible international transactions under Rule 90, the block is three consecutive tax years (TY 2026-27, TY 2027-28, TY 2028-29). The three-year block thresholds will continue for subsequent block periods unless the CBDT amends them.

Q: How does the CEO/CMD certification requirement work for IT services safe harbour?
A: Rule 91(16) requires that Form 49 for IT services be certified by the CEO or CMD of the assessee, in addition to the standard return verification. This is a specific requirement for IT services and does not apply to other safe harbour categories. The certification means the principal officer is personally attesting to the entity’s eligibility, functional profile, and margin declaration.

Q: What is the safe harbour margin for pharma contract R&D?
A: 24% of operating expenses, with aggregate revenue from such transactions not exceeding ₹300 crore. This is the only category where the margin has not been reduced from the previous rules. The higher threshold reflects the risk-and-return profile of pharmaceutical R&D. (Rule 89(2), Sl. 5.)

Q: How is the credit rating of the AE determined for intra-group loan safe harbour?
A: The credit rating must be assigned by a SEBI-registered and RBI-accredited credit rating agency, applicable for the relevant tax year. If the AE has ratings from more than one agency, the most conservative (lowest) rating is applied. (Rule 89(3)(b).)

Q: Can a company that holds part-ownership of intangibles generated during service delivery opt for safe harbour?
A: No. Rule 87(2)(e) requires that the Indian entity have no legal or economic ownership right over any intangible generated or arising during rendering of services. If the Indian entity holds any IPR, economic rights to commercialise outputs, or royalty entitlements on deliverables, it fails the insignificant-risk test and is ineligible for the IT services safe harbour.

Q: For intra-group loans in foreign currency, how is the reference rate determined?
A: The reference rate depends on the currency: 6-month Term SOFR plus 45 bps for USD; 6-month EURIBOR for EUR; 6-month Term SONIA plus 30 bps for GBP; 6-month TORF plus 10 bps for JPY; 6-month BBSW for AUD; 6-month Compounded SORA plus 45 bps for SGD. Rates are determined as on 30 September of the relevant tax year. (Rule 89(3)(a).)

Q: Is there a fast-track APA for IT services if a company does not want to use safe harbour?
A: Yes. Budget 2026 introduced a fast-track unilateral APA mechanism for IT services, with a target of conclusion within two years, extendable by two months at the taxpayer’s request. APAs preserve MAP rights, can cover up to nine years including rollback, and allow a negotiated margin below 15.5% where the functional profile justifies a lower return.

Regulatory references:

• Section 167, Income Tax Act, 2025 (safe harbour enabling provision)
• Section 163, Income Tax Act, 2025 (international transactions)
• Section 165-166, Income Tax Act, 2025 (ALP determination and TPO reference)
• Section 168, Income Tax Act, 2025 (Advance Pricing Agreements)
• Section 171-172, Income Tax Act, 2025 (TP documentation and accountant’s report)
• Section 159, Income Tax Act, 2025 (DTAA and MAP)