FININ2MIN · BUSINESS PLAYBOOKS · PCJ-05
Fintech Startup
Practical India guide to Fintech Startup: approvals, setup, operating controls, taxes, cash flow, risks, closure, 28 FAQs and editable tools.
General business education. Use the activity, location and transaction facts for legal and tax decisions; illustrative figures are not promised returns.
The two-minute answer
First decision — Software vendor with no funds custody. May differ from regulated payment operator; record what payment instruction or data is processed and the precise contractual allocation. Second decision — Offer loans through another bank/NBFC. A lending service provider is not itself authorised to lend from own book merely because of a bank partnership. Digital lending rules and outsourcing contracts may apply. Then execute — Draw every funds flow before selecting a business label. Trace payer, beneficiary, settlement account, escrow/nodal account where appropriate, money custody, credit underwriting and customer-facing contracts. Regulatory classification follows what the firm actually does, not words like aggregator, technology partner or marketplace. Know the first escalation — Unapproved funds pooling. Freeze expansion, map balances and legal ownership, seek qualified regulatory advice and a remediation path; do not silently route customer money through personal accounts. Save a dated licence/authority determination, responsible owner, signed contract, evidence reference and next review date at every material step. This is the minimum practical answer before committing capital or promising a customer outcome.
Choose your exact model before applying
| Operating model | How it changes compliance | Minimum evidence |
|---|---|---|
| Software-only provider | Supplying APIs to a regulated entity need not itself make the provider a payment aggregator, but outsourcing controls may flow down contractually. | Funds-flow diagram, outsourcing contract |
| Payment aggregation | Pooling/settlement of merchant funds may trigger RBI payment-aggregator authorisation; not cured by calling service a gateway. | Authorisation status, escrow design, merchant due diligence |
| Lending/credit marketplace | LSP and RE roles, APR/KFS disclosure, lending service agreements and consent vary by structure. | Bank/NBFC contract, customer journey and disclosures |
Six practical steps — registration to operation
Draw a regulator-facing funds and data map
Mark every time money moves, who holds it, who is creditor, who sets price/APR, whether investments are recommended and who executes refunds. Convert the map into a permissions matrix: RBI payments, lending/NBFC, PPI; SEBI securities advice/broking; IRDAI insurance where relevant.
Confirm authorisation perimeter before processing
For payments, check PA versus PG/PA-CB and current RBI Directions. A technology vendor must not hold customer funds as an unauthorised intermediary. For advice or credit, identify regulated entity ownership and contracts; do not promise “RBI approved” without an exact official registration.
Build compliant customer onboarding
Design truthful product disclosures, eligibility, complaints, recurring mandates, mandate revocation, refund routes and merchant screening. Credit products need accurate KFS/APR presentation and customer choice; never pre-tick optional or paid add-ons.
Engineer privacy and outsourced-risk controls
Maintain a data inventory covering identity, transaction histories, financial profiles, bank account numbers, device identifiers and vendor processors. Apply RBI instructions where contractually or directly required; map DPDP 2025 Rules by their staggered dates and maintain incident escalation records.
Reconcile settlements and operational losses daily
Create immutable ledgers for customer payment, merchant settlement, fees, chargebacks, reversals and failed transfers. Separate revenue from pass-through amounts. Reconcile partner bank/PSP reports, platform events and general ledger; allocate unexplained differences for investigation.
Stress-test regulatory and liquidity buffers
Run fraud scenarios, payout timing, partner termination and dispute volumes. Unit economics must include financial crime screening, payment processing fees, support, failed-transaction losses, cyber costs and regulated capital requirements if the model is itself licensed.
Regulatory applicability and authority matrix
| Statute / regulator | What triggers it | What to verify | Keep on file |
|---|---|---|---|
| Payment and Settlement Systems Act / RBI Directions | Entity handles payment aggregation, cross-border collections, PPI or other regulated payments. | Obtain and verify specific authorisation before carrying out regulated activity. | RBI authorisation, outsourcing and settlement record |
| RBI Digital Lending Directions / regulated entities | Credit decision, digital loan sourcing and LSP relationships. | Map RE/LSP responsibilities, disclosure and borrower complaint route. | Contracts, consent evidence, KFS/APR |
| SEBI/IRDAI rules if products included | Securities research/advice or insurance distribution add separate permissions. | Check intermediary registration for each offering. | Registration evidence and customer disclosures |
| DPDP, cyber and consumer rules | Financial and personal data processed by app and vendors. | Control collection, access, retention and breach response as provisions phase in. | Data flow register, processing terms, incident logs |
GST, income tax and cash-recognition decisions
| Transaction / obligation | Assessment and treatment |
|---|---|
| Payment facilitation | Distinguish own fee income from amounts held or remitted for customers. |
| Credit-related service | Determine GST treatment of platform fees and loan interest separately. |
| Foreign merchants | Check cross-border payments permissions, place of supply and FEMA boundaries. |
| Income tax | Separate capitalised tech assets, recurring costs, withholding and 2025 Act tax-year rules. |
Forms, registers and evidence checklist
| Document / record | What to include | Owner / authority |
|---|---|---|
| Funds flow | Annotated customer, merchant, partner and settlement account map | Board document |
| RBI/SEBI permissions | Official authorisation or third-party licensed partner evidence | Compliance file |
| Consumer disclosures | KFS/APR, pricing, grievance channels and cancellation terms | App UX archive |
| Security | Vendor controls, incident runbook, access governance and backups | Tech risk register |
| Reconciliation | Daily settlement, reversal and chargeback ledger | Finance operations |
Download the complete PDF guide · Explore related businesses
Financial model: revenue, profit and cash are different
| Input or result | Value | Meaning |
|---|---|---|
| Monthly volume | 65,000 billable transactions | Retained, accepted or billable output—not merely enquiries/dispatches |
| Realised price | ₹14 | Net of refunds and indirect tax |
| Variable cost per unit | ₹6 | Direct cash costs allocated to the same billable unit |
| Fixed operating cash cost | ₹420,000 | Excludes depreciation, finance charges and income tax |
| Contribution per unit | ₹8 | Price minus variable unit cost |
| Break-even volume | 52,500 billable transactions | Fixed cost ÷ contribution, rounded up |
| Capacity utilisation | 54.2% | Volume ÷ illustrative safe/saleable capacity |
Worked calculation: 65,000 × (₹14 − ₹6) = ₹520,000 contribution; less ₹420,000 fixed cash costs leaves ₹100,000 before financing, depreciation, tax and capital expenditure. A 10% fall in volume alone reduces contribution by ₹52,000. A 10% rise in unit variable cost alone reduces it by ₹39,000.
This is a technology-fee model, not a regulated lending balance-sheet model. Loan disbursements, customer funds, credit losses, prudential capital and lender yields are not included in these fee revenues.
A technology fee is not the same thing as lending revenue
A fintech pilot presents loan disbursements as business revenue even though a regulated partner funds the loans and the startup earns an implementation and servicing fee. This exaggerates both turnover and the apparent margin.
Work through the decision
Draw the actual funds flow, borrower agreement, lender responsibility and fee invoice. Separate partner funds, customer collections, pass-through amounts and earned technology fees. Identify which institution-specific directions govern the partner and which contractual duties are delegated to the service provider. Test customer consent, complaints, access controls and reconciliation using a small pilot.
What to establish before proceeding
Measure fee revenue and support cost per accepted account or contract, not principal disbursed. Keep customer money out of ordinary operating cash unless the lawful arrangement specifically provides otherwise. Obtain a perimeter assessment before adding underwriting, payment aggregation, advice or custody.
| Operating measure | Definition and use |
|---|---|
| Earned fee per active contract | Technology and servicing income actually earned under contract, excluding loan principal and client funds. |
| Reconciliation breaks | Unmatched customer/partner records by amount, cause and age, with the responsible owner identified. |
| Support cost per completed journey | Staff and vendor costs attributable to accepted onboarding or servicing, including failed attempts. |
This example is Finin2min’s operating analysis. Its commercial assumptions are not quoted market terms or a permit determination.
Common mistakes and how to avoid them
- Calling a payment aggregator a gateway. Actual custody/settlement functionality decides regulatory scope.
- Unauthorised lending or advice. Licensing is activity-specific, even when delivered via software.
- Recording customer float as income. Pass-through money must be segregated from fee revenue.
- Unmanaged partner data access. Vendor security and DPDP phases require documented controls.
Practical 30/60/90-day implementation plan
| Period | Specific milestone |
|---|---|
| Days 1–30 | Choose the regulated partner and map funds, data, risk and complaints before building the live journey. |
| Days 31–60 | Test consent, reconciliation, exception handling, service levels and partner approval on a restricted pilot. |
| Days 61–90 | Scale only when fee collection, dispute resolution and operational resilience meet the signed partner requirements. |
Your launch readiness checklist
0 of 10 launch tasks marked done (this page only)
Which business model changes the legal answer?
| Situation | Exact action and proof of decision |
|---|---|
| Software vendor with no funds custody | May differ from regulated payment operator; record what payment instruction or data is processed and the precise contractual allocation. |
| Offer loans through another bank/NBFC | A lending service provider is not itself authorised to lend from own book merely because of a bank partnership. Digital lending rules and outsourcing contracts may apply. |
| Offer personal investment recommendations | Assess SEBI investment adviser/research analyst registration perimeter; generic financial content differs from personalised regulated activity. |
| Issue stored-value wallets | Prepaid payment instrument activities can require RBI permission depending on design and exceptions; do not label deposits as loyalty points to evade law. |
| Cross-border payment app | Check RBI/FEMA, authorised dealer, PSS/payment aggregator and sector restrictions before showing FX or collecting overseas payments. |
| Use account information via AA | Verify Account Aggregator ecosystem roles, customer consent artefacts and data recipient obligations before plugging into APIs. |
Complete execution SOP: what to do, in order
Draw every funds flow before selecting a business label
Trace payer, beneficiary, settlement account, escrow/nodal account where appropriate, money custody, credit underwriting and customer-facing contracts. Regulatory classification follows what the firm actually does, not words like aggregator, technology partner or marketplace.
Obtain a written permission-perimeter decision
Split software-only SaaS, regulated payment activities, lending service provider, own-book lending, investment research/advice, securities broking and account aggregation. Map RBI, SEBI, PSS Act, NBFC and other authorisations as applicable; do not launch regulated services before approval.
Document bank/RE and vendor responsibilities
Execute detailed agreements with the RBI-regulated lender or payment entity where relevant, including oversight, complaint handling, audits, funds handling and exit. Outsourcing does not transfer the regulated entity’s liability.
Design customer disclosures and consent
Show actual lender/service provider, pricing/APR/KFS where digital lending rules apply, fees, refund/chargeback process, grievance contact, data collection purpose and permissioned data use; log versions and click-through evidence.
Implement cybersecurity and reconciliation before scale
Run customer KYC scope check, transaction monitoring, access control, device/API logs, incident response, secure storage, settlement reconciliation and independent penetration testing proportionate to the regulated activity.
Test edge cases and complaint redress
Simulate failed credit disbursal, duplicate payment, repayment misallocation, lender withdrawal, fraud, wrongly triggered recovery, erroneous bureau reporting and regulator request; document who contacts customer and how quickly.
Maintain continuous regulatory change inventory
Monthly review RBI Directions and SEBI instruments by product, amendments to KYC/outsourcing/digital lending, consent/DPDP commencement stages and partner compliance reports.
What to do when something goes wrong
| Real-world problem | Action, evidence and remedy |
|---|---|
| Unapproved funds pooling | Freeze expansion, map balances and legal ownership, seek qualified regulatory advice and a remediation path; do not silently route customer money through personal accounts. |
| Customer charged twice | Trace gateway transaction and ledger, refund within contractual/statutory timelines as applicable, maintain transparent customer updates and detect duplicate idempotency failure. |
| Unauthorised loan recovery conduct | Stop harmful collection practice, notify regulated lender partner, preserve scripts and call logs, compensate/remediate as required and retrain vendors. |
| Data/API compromise | Revoke affected credentials, contain access, log incidents, assess CERT-In and DPDP/sectoral requirements by effective date and take partner/regulatory action as applicable. |
| Regulated partner exits | Activate BCP and portability or run-off arrangement, inform customers, preserve client records and execute orderly settlement without unauthorised fresh business. |
Contract clauses and counterparty safeguards
- Specify role: technology vendor, LSP, payment facilitator or authorised provider, no implied licence
- Regulated partner remains accountable for required customer-protection controls
- Restrict collection and possession of customer funds to legally authorised accounts
- Define audit rights, cybersecurity incident response and business continuity
- Allocate lender-specific disclosures, collections conduct and grievance escalation
Operational templates, registers and checklists
- Licence/approval applicability and filing tracker (CSV)
- Business-specific operational register (CSV)
- Incident response and corrective actions (CSV)
- Commercial terms and contract negotiation checklist (CSV)
- 12-month compliance review calendar (CSV)
- Question/answer and evidence bank (CSV)
- Official forms and documents vault index (CSV)
Stress tests, funding and month-end finance
| Stress / funding item | Illustrative result | Decision |
|---|---|---|
| Volume −20% and unit cost +10% | ₹-35,200 monthly operating result | Reduce avoidable fixed costs, reprice or improve retained volume before adding debt |
| An extra 30 days of collection delay | ₹910,000 additional receivables | Profit is unchanged initially, but cash is locked up |
| Startup equipment cash | ₹1,200,000 | Separate capital expenditure from operating cost |
| Refundable lease deposit | ₹150,000 | Not an ordinary monthly expense |
| Opening liquidity buffer | ₹1,500,000 | A planning assumption—not proof the business is adequately funded |
Financing decision
Law, effective date and applicable authority
Direct tax: use the correct year and law
Official reading: CBDT — Income-tax Act, 2025 commencement
Labour: commencement and operating rules are separate checks
Official reading: Ministry of Labour — four Labour Codes commencement
GST: classification, notification and date
Official reading: CBIC tax-information repository · Ministry of Finance — 56th GST Council FAQ
Personal data: staged commencement
Official reading: Gazette — DPDP Act phased commencement, G.S.R. 843(E)
Commercial and legal decisions before spending
Draw the money and responsibility map
Show who lends, holds funds, performs KYC, approves credit, services complaints and bears default losses. A software vendor, Lending Service Provider, NBFC, payment aggregator, PPI issuer, account aggregator and investment adviser are different regulated positions. Branding the product as a technology platform does not settle its legal status. Do not collect customer money or originate regulated products until the applicable authorisation/partner arrangement is established.
Use the partner’s current consolidated directions
The RBI NBFC Credit Facilities Directions include a dedicated digital-lending chapter; commercial banks have their own directions. For an NBFC partnership, document enhanced LSP due diligence, roles, monitoring, disclosures and grievance responsibilities. The regulated entity remains accountable for outsourced activity. When showing multiple lenders, use transparent comparisons and avoid manipulative rankings; keep the actual matching/ranking rules and offer evidence.
Make customer protection a product specification
Include a Key Fact Statement and understandable cost disclosures in the relevant loan journey; keep delivery and consent evidence. Design disbursement and repayment routes around the applicable regulated-entity rules, not a convenient pooled LSP account. Build an accessible grievance route, data access controls, incident response and vendor oversight. Separate permission needed for service delivery from optional marketing or broad device access.
Measure economics on earned fees, not loan value
A loan disbursed through the platform is not normally the LSP’s revenue. Separate net earned fees, cloud/API costs, acquisition incentives, servicing, fraud/chargebacks, partner clawbacks and any permitted risk-sharing exposure. Delayed partner settlement and contingent clawbacks can make a profitable month cash-negative. The model here is for a fee-based service business, not NBFC capital adequacy, credit provisioning or a lending balance sheet.
Official reading: RBI — NBFC Credit Facilities Directions, 2025, updated 15 July 2026 · RBI — Commercial Banks Credit Facilities Directions, 2025 · RBI — consolidated Master Directions index · Securities and Exchange Board of India · Gazette — DPDP Act phased commencement, G.S.R. 843(E) · CBIC tax-information repository
Approvals: authority, process and completion evidence
Regulatory perimeter
Authority: RBI / SEBI / other activity regulator
Process: Map every product, entity, contract and money flow; identify whether registration/authorisation is required or a permitted outsourced role is used. Obtain legal assessment before launch.
Completion evidence: Signed perimeter memo, authorisation/partner validation and prohibited-activity list.
NBFC digital-lending partnership
Authority: Regulated NBFC; RBI directions
Process: Complete contractual due diligence, customer disclosure, funds-flow, data, audit and grievance controls under the NBFC’s applicable consolidated directions.
Completion evidence: Executed agreement, control evidence, KFS journey tests and partner approval.
Bank partnership
Authority: Regulated bank; RBI directions
Process: Use the bank’s applicable direction set and outsourcing/security policies instead of mechanically adopting NBFC provisions. Agree responsibility and incident escalation in writing.
Completion evidence: Bank approval, contractual obligations and operational control matrix.
Data and technology
Authority: Regulated partner, applicable privacy/cyber authorities
Process: Inventory data by purpose, access, retention, location and processor; implement security and incident controls. Map DPDP provisions to their commencement dates and separately comply with already applicable sectoral rules.
Completion evidence: Data map, permissions, audit logs, retention schedule and tested incident runbook.
Application passport: from eligibility to approval
Permissions, prescribed forms, fees and professional review
Regulatory perimeter
Facts that determine applicability: Draw the actual funds, credit, data and customer-contract flows.
Competent authority: RBI or other activity-specific regulator
Application and prescribed form: Select bank/NBFC/payment/other applicable directions; separate own authorisation from a service-provider agreement.
Fees and funding: Regulatory capital, security, application fees and professional fees are distinct; obtain the applicable current instrument.
Completion evidence: Funds-flow map, contracts, authorisations, ownership, product screens and compliance allocation.
Question for the relevant professional: Does the company conduct a regulated activity, or only provide technology to an authorised institution?
Investment-content and distribution branch
Facts that determine applicability: Identify personalised advice, paid research, execution, broking, distribution and financial promotion.
Competent authority: SEBI and other competent market authorities
Application and prescribed form: Assess each actual service and applicable registration before using labels such as educational or technology-only.
Fees and funding: Do not treat one registration fee or capital test as universal across intermediary categories.
Completion evidence: Service scope, remuneration, customer communications, registration and suitability/disclosure records.
Question for the relevant professional: Do advice, research or transaction activities require a separate registration or a prohibition on the proposed model?
Partner and customer evidence
Facts that determine applicability: Identify whose licence, account and grievance system each customer actually relies on.
Competent authority: Applicable regulated entity and regulator; consumer authorities
Application and prescribed form: Create an evidence-backed responsibility schedule and customer complaint/cancellation route.
Fees and funding: Pass-through collections, deposits and customer balances are not fee income or freely available working capital.
Completion evidence: Partner due diligence, approvals, settlement reconciliation, KFS/disclosures where applicable and incident logs.
Question for the relevant professional: Are product claims, data sharing and money flows consistent with the authorised partner arrangement?
Prepare the decision file
Daily controls, review rhythm and escalation
Daily: transaction-to-partner reconciliation, failed settlements, customer complaints, access anomalies and fraud queues.
Weekly: cohort contribution, clawback ageing, uptime incidents, model/ranking changes and vendor exceptions.
Monthly: compliance attestations to partners, independent reconciliation, cash runway, security review and customer-outcome metrics.
Respond to an incident without destroying evidence
Exit, sale, closure and continuing liabilities
Before exiting a product, stop onboarding, agree servicing continuity with the regulated partner and inform affected customers. Reconcile all funds and fees, retain mandatory evidence, revoke credentials, delete/return data only where permitted and complete any regulator/partner notification. Customer loans and complaints do not disappear when the app is taken down.
Closing evidence and liabilities
Business-specific questions answered
Does an RBI-regulated bank partner automatically license my startup?
No. A partner’s licence does not automatically authorise activities performed by your entity.
Is “payment gateway” a safe legal classification?
Only if actual money movement and contractual role fit the relevant directions.
Can a lender avoid KFS/APR duties via its app vendor?
Regulated-entity responsibilities are not erased by outsourcing.
Should DPDP obligations be treated as fully effective in October 2026?
No. Check the gazetted staged commencement for each section and Rule.
The answers below address common real-world situations. Each must still be matched to the operator’s actual facts, current tax notification and State/local rules.
Can I launch a fintech app first and seek RBI approval later?
Not for activities requiring prior authorisation. First classify services and funds flows, obtain the required licence or structure a permissible technology-only relationship with an authorised entity.
Does an NBFC partnership let me lend my own capital?
No. Partner registration does not automatically authorise independent lending or deposit-taking. The legal lender, contract, ownership of loan and risk must be identified.
What makes a digital lending service provider different from a lender?
An LSP performs contracted origination, servicing or other functions for a regulated entity; it is not necessarily the creditor. Follow applicable RBI Digital Lending Directions and the RE’s oversight obligations.
Can my app hold customer money temporarily?
Custody and settlement can engage payment-system regulatory requirements. Record each settlement account and legally permitted path; do not assume a startup can hold third-party funds as float.
Can we advertise guaranteed investment returns?
Unsupported return guarantees may be misleading and may engage securities and consumer protections. Only state validated product terms within the firm’s authorisation.
What should a Key Fact Statement cover?
For applicable digital loans, consult RBI Digital Lending Directions for total cost/APR, fees, grievance and other specified disclosures; the exact RE product dictates KFS content.
Do we need independent information-security testing?
Testing and governance requirements differ by regulator, activity, system importance and outsourcing agreement. Build a risk-based vulnerability and partner-assurance programme from the start.
Can KYC data from one product be reused in another?
Only if current law, permitted purpose, valid data-sharing basis and sector-specific rules allow it. Maintain data minimisation, role separation and consent artefacts.
Who answers customer complaints when the lender is another company?
The regulated entity retains duties for the regulated service even when an LSP operates the interface. Display clear grievance escalation and ownership to the customer.
How should we handle failed payment settlements?
Maintain transaction reference, payer and beneficiary bank, success/failure/reversal codes, applicable TAT, exception queue, suspense ledger and final customer confirmation.
How do we prevent an app becoming a mis-selling channel?
Separate advice from advertising, display clear pricing and product comparison where required, test dark-pattern risks, record consent and audit sales incentives.
What is our first regulator-facing document?
Prepare a regulatory-perimeter memo: services, user journey, entities, funds and data flow, applicable enactments/Directions, licences required or why not, and signed legal/partner signoff.
Can an LSP describe itself as the lender?
It should accurately identify the regulated lender and its own role. Product pages, KFS, sanction documents and customer support must not obscure who extends credit. A technology or sourcing contract is not an NBFC licence.
May I use one RBI rulebook for bank and NBFC partners?
No. Use the directions applicable to the partner’s regulated category and activity. The NBFC Credit Facilities Directions and Commercial Banks Credit Facilities Directions are distinct consolidated instruments; contractual controls may also differ.
What is the correct contribution in the sample transaction model?
At 65,000 billable transactions, a ₹14 earned fee and ₹6 variable cost give ₹520,000 contribution. After ₹420,000 fixed cost, operating surplus is ₹100,000 before finance and income tax. Break-even is 52,500 transactions; loan principal processed is not included as revenue.
Can repayments pass through the LSP’s ordinary bank account?
Do not design a pooled-account route merely for convenience. Apply the RBI funds-flow requirements and their stated exceptions to the actual lending arrangement; the regulated lender should approve and monitor the documented disbursement/repayment flow.
Can the comparison page rank the highest-commission lender first?
A multi-lender digital-lending journey must comply with applicable RBI requirements on fair comparison, disclosed metrics and avoidance of deceptive practices. Keep commission incentives separate from claims that a recommendation is best for the borrower.
Is a checkbox enough evidence of informed consent?
No. Preserve the exact notice/version, purpose, choices, timestamp and user action, and make withdrawal or grievance routes workable where required. A preselected or bundled checkbox does not demonstrate that optional uses were meaningfully chosen.
What belongs in a partner-reconciliation file?
Transaction ID, borrower/product reference, approved fee, reversal/clawback, settlement due date, actual payment and exception owner. Reconcile operating revenue separately from customer principal and any safeguarded balances.
Can I market guaranteed loan approval?
Avoid a claim that misrepresents lender underwriting or regulatory approval. Describe eligibility and actual process without a guarantee that the lender has not made. Preserve approved marketing copy and make paid/influencer relationships transparent where required.
How should a data breach be handled?
Contain access, preserve logs, assess affected systems/data and follow the applicable regulator, partner and statutory notification process. Use a named incident lead and counsel/security specialists; do not invent a universal deadline across every type of incident and entity.
Is regulatory capital part of the fee-business workbook?
No. Its inputs represent a non-lending fee business. An NBFC, payment system operator or other regulated entity needs a separate model for applicable net-owned-fund/capital, liquidity, safeguarding and provisioning obligations.
How should partner concentration be measured?
Track fee revenue, cash receivables, customer dependence and technical integration by partner. Stress-test the largest partner pausing onboarding or delaying payment; another prospective partner is not contracted replacement income.
What should be handed over when an app closes?
Customer servicing route, complaint log, transaction reconciliation, audit/consent evidence, data-retention responsibilities and revoked access. Agree continuity with the regulated partner before app removal; closure is not permission to delete legally required records.
State/UT and city-level applicability test
- Is the chosen premises permitted for this exact business and capacity?
- Which State, city and sector permit applies to each activity and each operating location?
- Are there fire, building, waste, signage, labour or medical safety conditions for this site?
- Do thresholds, professional qualifications, inspection dates or renewals differ here?
- Has any 2026 amendment commenced, been notified or changed the relevant form/fee?
- Who is legally responsible for each filing, complaint, accident and customer refund?
What to check when a law or business model changes
Official sources and prescribed-form routes
Use the instrument applicable to the actual activity, jurisdiction and date. A directory is a route to the competent authority, not an individual licence determination.
RBI — NBFC Credit Facilities Directions, 2025, updated 15 July 2026
Chapter III digital lending; NBFC applicability. Bank directions are separate.
RBI — Commercial Banks Credit Facilities Directions, 2025
Use the partner institution’s own applicable consolidated directions, not the NBFC text indiscriminately.
RBI — consolidated Master Directions index
Choose the regulated entity and activity: NBFC, bank, payment system, PPI, account aggregator, outsourcing or KYC.
Securities and Exchange Board of India
Investment advice, research, broking and distribution require separate regulatory-perimeter analysis.
Gazette — DPDP Act phased commencement, G.S.R. 843(E)
13 November 2025; immediate, one-year and eighteen-month provision groups. Do not treat every substantive duty as already commenced.
GST Council — official Central GST repository routes
Choose the exact operative Act, rule, classification and dated notification; a directory or Council recommendation is not the tax entry itself.
National Single Window System — Know Your Approvals and State portals
Navigation framework; not a substitute for municipal or sector permissions.
CBDT — Income-tax Act, 2025 commencement
Act effective 1 April 2026; Rules notified 20 March 2026. Match the tax year before using earlier section/form numbers.
Ministry of Labour — four Labour Codes commencement
21 November 2025 commencement; applicable Central/State rules and transition must be considered.
Continue your business planning
Compare all 28 business playbooks · Search the questions and answers