I will write a SDK for a company and they will use it in their application.
Our code will open a new activity and user will enter credit card information. We will withdraw money from our virtual pos.
Can i understand the developer's doing reverse engineering and changing my code to get credit card informations of user.
Is there any way to check if my jar is changed or not in runtime? Can i be pci-compliance with this system?
No. In fact, it is pretty much guaranteed that your code is changed in the APK compared to what you delivered in your SDK (e.g., ProGuard obfuscation).
Ask your attorney.