Fintech startup due diligence in India: whose licence is it?

In fintech, the licence is the product. Before you read the growth chart, check whose licence the company is really running on.

A lending app, a payments startup or a card product can look like a technology company in the deck. Under the hood, someone regulated by the Reserve Bank of India is carrying the risk. Sometimes it's the startup. Often it's a bank or an NBFC the startup works for as an agent. You need to know which, because the answer decides what you're buying. Start with the six checks in our guide to evaluating early-stage startups; this post adds what fintech needs on top.

Why does the licence come first in fintech diligence?

In Indian fintech, the right to lend money, hold customer funds or settle payments comes from the RBI, under laws like the Reserve Bank of India Act, 1934 and the Payment and Settlement Systems Act, 2007. A startup either holds that permission, works under a regulated partner who holds it, or is still waiting. Each position carries a different risk, a different margin and a different exit. So you check it before anything else.

Diligence on regulated businesses also takes longer. In a survey of 885 venture capitalists, Gompers, Gornall, Kaplan and Strebulaev found the average firm spent 118 hours on due diligence per deal, according to their full paper. Those firms were mostly American, and that's an average across sectors. Don't read it as an Indian fintech number. Read it as a floor. You'll spend longer on a company whose product depends on a regulator's permission.

What licence positions can an Indian fintech be in?

Every Indian fintech you'll see sits in one of three positions: it holds its own RBI licence or registration, it runs on a partner's licence as a service provider, or it has applied and is waiting. Ask the founder which one, in writing. Then you verify it yourself on the RBI website, where the Reserve Bank lists the entities it has authorised and registered. Don't take a logo slide as proof. A bank's logo on your screen can mean very little.

1. Its own licence

A company with its own licence controls its product. It also carries the capital rules. Take payments. The RBI's Master Direction on Regulation of Payment Aggregator, dated 15 September 2025, requires a non-bank aggregator to have a minimum net worth of ₹15 crore when it applies, and ₹25 crore by the end of the third financial year after authorisation. That's money locked in the balance sheet. Lending is similar. Under the RBI's NBFC registration and scale based regulation directions, an NBFC-ICC needs ₹10 crore of net owned fund to carry on business. Ask how your money will be split between growth and regulatory capital.

2. A partner's licence

This is a common early-stage model. The startup acts as a lending service provider, an agent of a bank or NBFC, and the regulated lender books the loans. The startup's whole business sits inside one contract. So read it. What's the term? Can the partner end it at short notice? Is it exclusive? Who owns the customer relationship once the contract ends?

Then find the default loss cover. Some partnerships ask the startup to absorb part of the losses, called DLG. The RBI's NBFC Credit Facilities Directions, 2025 cap DLG cover at five per cent of the amount disbursed from that loan portfolio. Check the startup's arrangement against that cap. Then check whether the cash backing it sits in the startup's books as a liability. Sometimes it doesn't, at first glance.

3. A licence still pending

Some startups raise while their application sits with the RBI. That's allowed. It's also a bet on a regulator's timing, and you can't diligence a decision that hasn't been made. Ask for the application date, every letter from the RBI since and the plan if the answer is no. Price the wait.

What goes on a fintech due diligence checklist?

Fintech checks add four layers to normal diligence: the licence, the partner contract, RBI reporting and customer protection. Ask for the documents below before your first meeting. A founder who has them in one folder runs a compliance function. A founder who doesn't, doesn't.

• Licence: the RBI certificate or authorisation letter, and your own check on the RBI website.
• Partner: every agreement with a bank or NBFC, including DLG terms, exit clauses and fee splits.
• Reporting: proof the lending partner has reported the app on the RBI's CIMS portal, as the Credit Facilities Directions require for digital lending apps.
• Customers: the grievance officer, complaint volumes, any cases under the RBI's Integrated Ombudsman Scheme and how long refunds take.
• Data: where payment data is stored, and the outsourcing agreement that gives the regulator a right to audit.

The wider list of filings every Indian startup needs, from ROC returns to GST, is in our post on compliance checks before investing.

A fintech without its own licence is one notice period away from being a different company.

What should you ask the founder about the licence partner?

A partner-led fintech's value depends on how replaceable the partner is. You want to know how many regulated partners the startup has, how long it took to sign each one and what would happen to live loans or merchants if one left. Those three answers tell you more about durability than the growth chart does.

Ask the founder to walk you through a partner exit, step by step, on a whiteboard if you're meeting in Bengaluru or Mumbai, or on a call if you're not. Who services the existing book? Where do repayments go? Who answers the customer's call? If the founder hasn't thought about it, that's your answer. If they have a written plan, ask to see it. And check your own term sheet, too: our note on term sheet clauses Indian angels should read covers the information rights you'll want for a regulated business.

Where should you start before the partner meeting?

Start with one line in your notes, before Monday's partner meeting: whose licence? Then the partner contract, then the capital. Everything else in fintech diligence follows from those three.

In fintech, compliance decides whether the business is allowed to exist at all.

Questions

What is the first thing to check in a fintech startup in India?

Check whose licence the product runs on. A lender needs an NBFC registration or a regulated partner; a payments business needs RBI authorisation as a payment aggregator or a partner that holds one. Ask for the certificate or the partner agreement, then confirm it on the RBI website yourself.

What net worth does a payment aggregator need in India?

Under RBI's Master Direction on Regulation of Payment Aggregator dated 15 September 2025, a non-bank entity needs a minimum net worth of ₹15 crore when it applies for authorisation and ₹25 crore by the end of the third financial year after authorisation, maintained on an ongoing basis.

What is DLG in digital lending?

DLG is default loss cover: a lending service provider or another party agrees to bear part of the losses on loans a regulated lender makes. RBI's NBFC Credit Facilities Directions, 2025 cap DLG cover at five per cent of the amount disbursed from that loan portfolio.

How long does fintech due diligence take?

Longer than for other early-stage companies, because licences, partner contracts and RBI reporting all need checking. Global survey data on venture capitalists, mostly in the US, puts average diligence at 118 hours per deal across sectors. Plan extra time for regulated businesses.

Sources: Reserve Bank of India, Master Direction on Regulation of Payment Aggregator (PA), 15 Sep 2025 · Reserve Bank of India, Non-Banking Financial Companies: Credit Facilities Directions, 2025, 28 Nov 2025 · Reserve Bank of India, Non-Banking Financial Companies: Registration, Exemptions and Framework for Scale Based Regulation Directions, 2025, 28 Nov 2025 · Gompers, Gornall, Kaplan and Strebulaev, How Do Venture Capitalists Make Decisions?, NBER Working Paper 22587, 2016

For more on how startup funding works in India, read the MyStartupValley blog or visit mystartupvalley.com.