A fintech team in Bengaluru spends three months building an app for small-business loans. Customers can upload documents, compare offers and track their repayments. During a product demo, a prospective lending partner asks, “Whose bank account will receive the borrower’s instalments?” The founders had planned to collect repayments in the startup’s account and transfer them to the lender at the end of each day. That decision means they now have to redesign the payment flow, the ledger and parts of the app.

Regulatory readiness starts with decisions like this. It means knowing who is authorised to provide the service, who handles customer money, what customers must be told and who takes responsibility when something goes wrong. In India, the answers vary across lending, payments, investment advice, insurance and foreign exchange. Founders can avoid expensive rework by resolving these questions before signing partner contracts or building the product.

In this article, CA Manish Mishra talks about How to Build a Regulatory-Ready Financial Services Business.

Identify the regulated activity before choosing a licence

Start with a plain description of what the company will do. Who signs the customer agreement? Who approves the loan or recommends the investment? Who receives the money? What service does the customer pay for? The answers help identify which regulatory requirements apply. A single app can contain several activities, so each feature needs to be assessed on its own.

For example, a startup that helps a bank collect loan applications may act as a Lending Service Provider (LSP). If it later decides to lend its own money as its principal business, it should assess whether it requires registration as a Non-Banking Financial Company (NBFC). Similarly, a business that supplies checkout software should reassess its regulatory position if it starts collecting customer payments and settling them to merchants.

Decide whether to obtain your own authorisation or work with a regulated partner

The choice depends on who will perform the regulated activity. A company that intends to lend independently may need its own registration. A startup that supports a bank’s digital lending operations may be able to work under an LSP agreement. In the second model, the bank remains responsible for its regulatory obligations and oversight of the startup. The agreement should define the startup’s role, and the app, advertisements and customer support messages should identify the actual lender clearly.

A similar distinction applies to foreign exchange. Under the Foreign Exchange Management (Authorised Persons) Regulations, 2026, an eligible AD Category-I or AD Category-II provider can appoint a business as a Forex Correspondent for permitted money-changing activities. The appointing dealer issues permission for each outlet. The RBI considers fresh Full Fledged Money Changer applications only if they were already under process on 6 May 2026, so a business planning a new forex counter should assess the Forex Correspondent route early.

Check the legal structure, ownership and funding requirements

Before incorporating the company or closing an investment round, check whether the chosen regulatory category has requirements for the type of entity, business objects, capital, net worth, ownership or management. For example, the RBI’s principal business test for NBFCs considers both financial assets and income from financial assets. The applicable Net Owned Funds requirement depends on the NBFC category. A financial estimate prepared for investors may therefore need a separate calculation for regulatory purposes.

Keep a clear record of who owns, controls and funds the business. Depending on the applicable rules, this may include a shareholding chart, details of ultimate beneficial owners, promoter and director profiles, audited accounts, source-of-funds records and board approvals. If a foreign investor is involved, review the applicable FEMA and sector-specific conditions before agreeing to the transaction. A later change in control can also trigger an approval or reporting requirement, even if the business already holds a licence.

Map where customer money will go

Draw the route that money takes from initiation to settlement. Identify each bank account, its legal owner and who can move funds. Then map what happens if a transaction fails, arrives twice or needs to be refunded. The product and finance teams should both be able to follow this flow, including how the company records the transaction and reconciles it with the bank statement.

In digital lending, disbursements and repayments generally flow directly between the regulated lender and the borrower’s bank account, subject to specified exceptions. An LSP’s account generally cannot serve as a pass-through for borrower repayments. Under the RBI’s separate rules for eligible online outward remittances facilitated by a third party, the remitter’s funds must also stay out of the third party’s account in India. These details should be settled before the engineering team builds the payment flow.

Imagine a borrower pays an instalment on Friday evening, but the app still shows it as overdue on Monday. The team should be able to trace the payment reference, identify the receiving account, reconcile the payment and explain the status to the borrower. If the system cannot do that for one payment, the problem will become harder to manage as volumes increase.

Build KYC and data protection into onboarding

Know Your Customer (KYC) requirements depend on the entity and the activity. Where a bank or NBFC is the regulated entity, agree on who collects customer information, who verifies it, who makes the final onboarding decision and who retains the records. The relevant regulated entity may also have obligations for ongoing monitoring and reporting to Financial Intelligence Unit–India (FIU-IND). Staff should know how to escalate a case when a document is incomplete or the information provided does not match.

Review the personal data the business collects and why it needs each item. Identify where records are stored, who can access them, when they can be shared and how long they must be retained. The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 have phased commencement, and sector-specific requirements may already apply. For a lending app, a practical starting point is to check whether access to customer documents is limited to people who need it and removed when an employee leaves.

Explain the costs and terms before the customer agrees

A customer should understand what they are accepting before they commit. A borrower should be able to see the cost of the loan. A merchant should know when payments will settle and what fees apply. A remittance customer should be able to see the exchange rate, charges and expected amount credited to the recipient. Putting this information at the point of decision makes it easier for customers to compare options and raise questions.

In digital lending, applicable requirements include the Key Facts Statement (KFS), disclosure of the Annual Percentage Rate (APR), a cooling-off period and a grievance redressal process. The RBI also prescribes how matching offers are displayed when an LSP works with multiple lenders. Review the app, advertisements, emails and sales scripts together so they communicate consistent terms and identify the actual service provider.

Put partner responsibilities in writing and test them

A partner agreement should cover what happens on an ordinary day and who takes over when a transaction fails. Set out who handles customer records, reconciliations, refunds, complaints and incident reporting. Where applicable, address audit rights, data handling, subcontracting and how the parties will transfer records or support customers if the relationship ends.

Before launch, test cases that require both parties to act. Simulate a failed identity check, a duplicate payment, a disputed charge and a partner outage. In each case, record who received the alert, who was able to make a correction and how the customer was informed. For example, if the bank is responsible for issuing a refund, the startup’s support team still needs a way to request it, track it and give the customer an accurate update.

Create a compliance calendar for day-to-day operations

A compliance calendar should identify what is due, when it is due, who owns it and where the supporting evidence is kept. Include periodic filings and audits, as well as events that may require review before they take effect. Examples include a change in ownership, a new product feature, a new vendor or a change to the way customer money moves. Assign a specific person to review each item so responsibility stays clear as the business grows.

Conclusion

A regulatory-ready financial services business can explain who provides each service, where customer funds go, what the customer agrees to and who resolves a problem. The answers should be consistent across the product, contracts, bank accounts and internal procedures. Before launch, the founders should be able to trace a payment, retrieve the disclosure shown to a customer and identify who is responsible for resolving a complaint.

The same checks apply when the business expands. Adding a loan, payment, insurance or investment feature can change the permissions and controls the company needs. Before releasing the feature, review who will perform the activity, whose money or data the business will handle, and whether the existing authorisation or partner arrangement covers it.

Frequently Asked Questions (FAQ’s)

Q1. What does it mean to build a regulatory-ready financial services business?

Ans. It means designing the business around the rules that apply to its services before it launches. The company should be able to explain who is authorised to provide each service, how customer money and data are handled, and who resolves complaints.

Q2. Is company registration enough to launch a financial services business in India?

Ans. Company registration establishes the legal entity. Depending on what the business plans to do, it may also need authorisation from the RBI, SEBI or IRDAI, or a permitted arrangement with a regulated institution.

Q3. How do I determine which licence my fintech business needs?

Ans. Start by identifying who contracts with the customer, makes the financial decision, receives the money and provides the service. Assess each activity separately, especially if the same app offers loans, payments, investments or insurance.

Q4. Can a fintech startup work with a bank or NBFC without holding its own lending licence?

Ans. Yes, a fintech can work as a Lending Service Provider (LSP) for a regulated lender and perform functions covered by their agreement and applicable rules. The bank or NBFC remains the lender and retains responsibility for its regulatory obligations and oversight of the LSP.

Q5. Can a lending app collect borrowers’ repayments in its own account?

Ans. In digital lending, repayments generally go directly from the borrower to the regulated lender, subject to specified exceptions. A lending app operated by an LSP generally cannot use its own bank account as a pass-through for repayments.

Q6. When does a payment platform need to review whether it is a Payment Aggregator?

Ans. A platform should review its classification before it starts collecting customer payments and settling them to merchants. The analysis should follow the actual fund flow, including which entity receives or controls the money and how merchants are paid.

Q7. What KYC and data protection controls should a fintech have before launch?

Ans. The business should identify who collects and verifies customer information, who makes the onboarding decision and who retains the records. It should also document why it collects each type of personal data, who can access it and how it handles security incidents under the applicable rules.

Q8. What should a digital lending business disclose to borrowers?

Ans. Applicable disclosures include the lender’s identity, the Key Facts Statement (KFS), the Annual Percentage Rate (APR) and the process for raising complaints. The customer should be able to review the applicable terms and costs before accepting the loan.

Q9. Can a new product feature trigger fresh regulatory requirements?

Ans. Yes. A new feature can change the business’s regulatory position if it adds personalised investment advice, allows the platform to collect payments or introduces a new regulated service. Review the proposed activity and fund flow before releasing the feature.

Q10. What should a financial services compliance calendar include?

Ans. Include applicable filings, audits, reporting deadlines and reviews triggered by events such as a change in ownership, a new product or a revised payment flow. Assign each item a responsible person and keep supporting records, submission acknowledgements and corrective actions in one place.