India’s fintech sector offers foreign investors opportunities across digital payments, lending technology, wealth management, insurtech and financial infrastructure. However,requires more than a commercial assessment of growth, revenue and market share. Investors must understand how India’s foreign direct investment framework interacts with financial sector regulations, licensing requirements, data protection and the target company’s operating model.

Before acquiring shares in an Indian fintech business, an investor should establish whether the proposed investment is permitted, whether regulatory approvals or notifications apply, and whether the company can continue operating after the transaction. Thorough legal due diligence helps identify compliance gaps, assess liabilities and negotiate appropriate contractual protections.

1. Check Whether Foreign Investment Is Permitted in the Target’s Business

The first step is to identify the activities the fintech company actually performs. India does not have one universal foreign investment rule for every fintech business. The applicable conditions depend on the sector, the activity and the regulatory framework governing it.

For example, a software company providing technology to banks may face different requirements from a non bank payment aggregator, an NBFC or an insurance intermediary. A business describing itself as a fintech platform may undertake several regulated activities through different entities.

Investors should review the company’s revenue streams, customer contracts, product architecture, licences and partnerships to establish its true business classification. The assessment should consider applicable sectoral foreign investment limits, the automatic or government approval route, and any conditions attached to the relevant activity.

The Department for Promotion of Industry and Internal Trade publishes India’s foreign investment policy framework. Investors should review the applicable policy and subsequent amendments rather than rely on an older summary or the target’s internal interpretation.

The investor’s country of origin and ownership structure also matter. Restrictions may apply to investments involving entities or beneficial owners from countries sharing a land border with India, subject to the applicable policy and exceptions. The ownership chain should therefore be examined before the transaction structure is finalised.

2. Identify Every Regulatory Approval and Licence

A company’s incorporation certificate does not establish permission to conduct regulated financial activities. Foreign investors should determine whether the target holds the necessary authorisations and complies with the conditions attached to them.

Payment businesses require particular attention. The Reserve Bank of India regulates payment systems and payment aggregators under the applicable framework. Its Master Direction on Regulation of Payment Aggregators, issued in September 2025, consolidated relevant requirements, including provisions for cross border payment aggregators. Investors should examine the current directions and subsequent amendments to establish which obligations apply to the target.

For lending related businesses, the review should distinguish between an entity lending from its own balance sheet and a technology platform facilitating loans through regulated lenders. If the target is an NBFC, its registration, permitted activities, regulatory returns, capital position and compliance history require close examination. If it operates as a lending service provider, the investor should assess its agreements and operational arrangements with regulated lenders, including applicable digital lending requirements.

Other fintech businesses may be subject to requirements relating to securities markets, investment advice, insurance distribution, account aggregation or other regulated financial services. The relevant regulator may be the RBI, Securities and Exchange Board of India, Insurance Regulatory and Development Authority of India, or another authority, depending on the activity.

Investors should request copies of licences, registrations, approval letters, inspection findings, regulatory correspondence and remediation plans. They should also establish whether the proposed change in ownership or control triggers prior approval, an intimation or another regulatory process.

3. Assess Whether the Acquisition Triggers a Change in Control

A share acquisition can raise regulatory issues even when the target already holds the necessary licence. Certain regulated entities may need to obtain approval or comply with specific procedures before a change in ownership, management or control takes effect.

The analysis should cover direct and indirect acquisitions, voting rights, board appointment rights, shareholder agreements and arrangements giving an investor influence over key decisions. A transaction can raise control questions even where the investor does not acquire an outright majority.

For payment system operators, the RBI’s applicable framework includes requirements relevant to changes in shareholding in specified circumstances. Investors should verify the current rules for the target’s authorisation category and transaction structure. Similar activity specific checks may be necessary for other regulated businesses.

The transaction timetable should provide sufficient time for regulatory review. Completion conditions should identify the approvals or confirmations required, while the parties should agree who will prepare applications, supply information and respond to regulator queries.

An acquisition agreement should not assume regulatory permission will automatically follow from signing. Where an approval is necessary, closing before it is obtained could expose the parties to legal and operational risk.

4. Review FEMA Compliance, Share Pricing and Reporting

Foreign investment in Indian companies is governed by the Foreign Exchange Management Act, 1999, the Foreign Exchange Management (Non Debt Instruments) Rules, 2019 and the applicable RBI directions, as amended from time to time.

Investors should determine whether the proposed acquisition is a primary investment, a secondary share purchase or a combination of both. A primary investment involves the company issuing shares to the foreign investor. A secondary transaction involves the transfer of existing shares from a seller.

The distinction affects documentation, valuation, payment flows and reporting. The parties should verify applicable pricing requirements, permitted payment methods, remittance records and reporting obligations. Relevant filings may include Form FC GPR for an issue of equity instruments to a non resident and Form FC TRS for a qualifying transfer, depending on the transaction and applicable rules.

The company’s historical compliance should also be examined. Review prior foreign investment filings, allotment records, transfer documents, valuation reports and evidence of remittances. Unresolved reporting delays or inconsistencies in shareholding records may complicate completion or future fundraising.

Where government approval is required, the parties should account for the applicable application process and conditions. A transaction should not proceed on the assumption that an approval can be obtained retrospectively.

5. Examine the Capital Structure and Shareholder Rights

A fintech company may have several funding rounds, preference shares, convertible instruments, employee stock options and investor agreements. Before acquiring a stake, the buyer should reconcile the statutory registers with the company’s cap table and review the rights attached to each class of security.

Key issues include liquidation preferences, anti dilution provisions, pre emption rights, transfer restrictions, tag along rights, drag along rights and reserved matters. Existing investors may hold consent rights over a new share issue, a transfer of shares or a change in control.

The investor should also assess whether any convertible instruments or outstanding options could materially dilute its ownership. Founder vesting arrangements, employee incentive plans and promises of equity to advisers or employees should be checked for completeness and enforceability.

For investors seeking to invest in startups, the review should extend beyond the proposed share price to the rights and obligations attached to the investment. A low valuation may not represent an attractive deal if the investor receives limited governance rights or inherits significant liabilities.

The transaction documents should clearly establish board representation, access to financial information, reserved matters, exit mechanisms and procedures for resolving deadlocks. These rights should be consistent with the company’s articles of association and applicable law.

6. Investigate Data Protection, Cybersecurity and Technology Risks

Fintech businesses often process financial information, identity documents, transaction histories and other sensitive customer data. Weak data governance can expose the company to regulatory action, customer claims, reputational damage and operational disruption.

Investors should review the target’s privacy notices, consent practices, data sharing agreements, retention policies, security controls and incident response procedures. The review should establish which entities collect and process personal data, where data is stored, who can access it and whether information is shared with overseas group companies or service providers.

India’s Digital Personal Data Protection Act, 2023 and the applicable rules and commencement notifications should be assessed in light of their relevant effective dates. Investors should avoid assuming every obligation commenced at the same time. The company’s compliance plan should reflect the provisions in force and those scheduled to take effect.

Cybersecurity due diligence should cover previous breaches, fraud incidents, penetration testing, vulnerability management, access controls, business continuity and disaster recovery. Where the target relies on cloud platforms or external technology vendors, assess contractual protections, service continuity and exit arrangements.

Intellectual property also deserves attention. Confirm ownership of source code, software, trademarks and proprietary algorithms. Employment and contractor agreements should adequately address intellectual property assignment, confidentiality and access to company systems.

7. Assess Financial Health, AML Controls and Consumer Protection

Fintech growth figures can conceal weaknesses in revenue quality, credit performance or regulatory compliance. Investors should examine audited financial statements, management accounts, cash flow, customer concentration, outstanding litigation and related party transactions.

For lending businesses, assess loan performance, collections, delinquencies, provisioning, lender concentration and the allocation of credit risk. For payment companies, review settlement processes, merchant onboarding, chargebacks, fraud losses and reconciliation controls. Customer funds must be handled in accordance with the rules applicable to the particular business model.

Anti money laundering and know your customer obligations are also important where the company falls within the relevant regulatory framework. Review customer verification procedures, sanctions screening, suspicious transaction escalation, record keeping and staff training. Identify any regulatory findings, unresolved complaints or control failures.

Consumer protection should form part of the review. Examine pricing disclosures, grievance handling, marketing claims, recovery practices and complaint trends. A pattern of customer harm may indicate wider weaknesses in governance or regulatory compliance.

The objective is not simply to identify historical breaches. Investors need to understand whether the company has corrected the underlying problem and whether the proposed business plan can operate within the applicable regulatory framework.

8. Structure the Transaction to Protect the Investor

Due diligence findings should inform the purchase price, completion conditions and risk allocation. If the target has unresolved licensing issues, incomplete filings or material cybersecurity weaknesses, the investor should assess whether these can be remedied before completion or require specific protections.

The share purchase or subscription agreement should include appropriate representations and warranties covering regulatory compliance, licences, tax, financial statements, litigation, data protection and intellectual property. Specific indemnities may be appropriate for identified historical liabilities, subject to negotiation and enforceability.

Completion conditions should address necessary regulatory approvals, third party consents and agreed remediation steps. Escrow arrangements, deferred consideration or other risk allocation mechanisms may be considered where commercially appropriate and legally permissible.

The investor should also agree a realistic post completion plan for regulatory filings, governance changes, integration and remediation. Where the investment involves company registration services for a new Indian holding or operating entity, the structure should be reviewed alongside the proposed acquisition to ensure the correct entity holds the relevant assets, contracts and authorisations.

A sound transaction structure aligns the investor’s commercial objectives with the target’s regulatory obligations. It should not rely on contractual wording to cure a licensing or compliance defect which requires regulatory action.

Conclusion

Fintech Foreign Investment in India requires coordinated commercial, corporate and regulatory due diligence. Foreign investors should establish the target’s actual activities, confirm foreign investment eligibility, verify licences and change of control requirements, review FEMA compliance, and investigate data protection, cybersecurity, financial controls and shareholder rights.

The strongest acquisition strategy identifies regulatory risks early and translates them into practical transaction protections. Because the applicable requirements vary across fintech business models and may change through regulatory amendments, investors should verify the current position before signing and completing a transaction

Frequently Asked Questions

Can foreign investors acquire a stake in an Indian fintech company?

Potentially, yes. Eligibility depends on the company’s activities, applicable sectoral foreign investment rules, investor ownership and any approval or regulatory conditions. The precise business model must be assessed before signing.

Is prior RBI approval always required for fintech foreign investment?

No. RBI approval is not universally required for every fintech investment. However, the target’s regulated activity and the proposed ownership or control changes may trigger specific approval or notification requirements. These should be checked against the current rules.

What documents should investors review before acquiring shares?

Key documents include incorporation records, the cap table, shareholder agreements, licences, regulatory correspondence, financial statements, tax records, customer contracts, data protection policies, cybersecurity reports and historical foreign investment filings.

What are the main risks in acquiring an Indian fintech company?

Common risks include foreign investment non compliance, missing or conditional licences, undisclosed regulatory findings, weak AML controls, data breaches, unclear intellectual property ownership, consumer complaints and unexpected dilution or shareholder rights.

Can an investor complete the acquisition before regulatory approval?

Where prior approval is legally required, the parties should not complete the relevant transaction before obtaining it. The acquisition agreement should allocate responsibility for approvals and make necessary permissions a completion condition.

This update was released on 25 Nov 2026.

The views expressed in this update are personal and should not be construed as any legal advice. Please contact us directly on +91 22 40565252 or contact@mhcolaw.com for any assistance.

Legal Update Team
MANSUKHLAL HIRALAL & COMPANY
Advocates, Solicitors and Notaries
T: +91 22 40565252
Mumbai Office: Surya Mahal, 2nd Floor, 5, Burjorji Bharucha Marg, Fort, Mumbai-400 023, India
Delhi Office: Block C-9, Lower Ground Floor, Jangpura Extension, New Delhi - 110 014, India
www.mhcolaw.com

"Noted lawyer in the Real Estate practitioner from India" - Chambers & Partners

Please consider the environment before printing this email

The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorized to receive it. This communication may contain confidential or legally privileged information. If you are not the intended recipient, any disclosure, copying, distribution or action taken relying on the contents is prohibited and may be unlawful. If you have received this communication in error, or if you or your employer does not consent to email messages of this kind, please notify the sender immediately by responding to this email and then delete it from your system. No liability is accepted for any harm that may be caused to your systems or data by this message.