Acquiring an Indian bank, non banking financial company, insurer, securities intermediary or other regulated financial institution can provide a foreign investor with access to a growing market. However, foreign investment in regulated financial institutions involves risks beyond ordinary corporate due diligence. The investor must assess whether foreign ownership is permitted, whether the target holds valid regulatory authorisations, and whether the proposed acquisition requires approval from the relevant Indian regulator.

Regulatory risk can affect the transaction's valuation, completion timetable and ability to operate after acquisition. A target may appear financially sound but still face restrictions because of past non compliance, unresolved regulatory observations or an unapproved change in control. A structured review of the applicable foreign investment rules, sectoral regulations and the target's compliance history is therefore essential before signing or completing the transaction.

Confirm Whether Foreign Ownership Is Permitted

The first step is to identify the target's precise regulated activity and the applicable foreign direct investment entry route. India's FDI Policy permits foreign investment in several financial services sectors, but the permitted ownership level and conditions differ between banking, insurance, NBFCs, asset management, securities services and payment activities. Some activities permit investment under the automatic route, while others require government approval or compliance with additional sector specific conditions.

The investor should examine the Foreign Exchange Management Act, 1999, the Non Debt Instruments Rules and the current FDI Policy. It should also review the investor's nationality, ownership chain and beneficial ownership. Restrictions relating to entities or beneficial owners from countries sharing a land border with India may affect the proposed structure. An investment should not be assumed eligible merely because the immediate investor is incorporated outside a restricted jurisdiction.

Identify the Target's Principal Regulator and Licence Conditions

Every regulated financial institution should be assessed against the legal framework governing its activities. Banks and NBFCs are generally regulated by the Reserve Bank of India (RBI), insurers by the Insurance Regulatory and Development Authority of India (IRDAI), and securities market intermediaries by the Securities and Exchange Board of India (SEBI). Certain payment activities and other financial services may also require specific authorisation or registration.

The investor should obtain and verify the target's licences, certificates, registrations and regulatory correspondence. It should confirm whether the permissions remain valid, whether they cover the target's actual business and whether they contain conditions affecting ownership, management or operations. A company registration certificate is not a substitute for a sectoral licence. Any gap between the target's permitted activities and its actual business should be treated as a material acquisition risk.

Assess Change in Control and Prior Approval Requirements

A transaction can trigger regulatory approval even where the proposed foreign shareholding is permitted under the FDI Policy. The RBI, SEBI or IRDAI may impose separate requirements for a takeover, acquisition of control, change in promoters, specified shareholding changes or changes in key management. The applicable threshold and approval process depend on the regulator and the category of institution.

The investor should examine both direct and indirect control. Board nomination rights, veto rights, shareholder agreements and management arrangements can influence the regulatory assessment. The parties should identify every approval or notification required before signing and completion. Where prior approval is necessary, the transaction documents should make it a condition precedent and restrict implementation of the relevant control rights until the approval is obtained.

Review Regulatory Inspection History and Enforcement Exposure

Regulatory correspondence can reveal risks not apparent from the target's financial statements. Investors should review inspection reports, supervisory observations, show cause notices, enforcement orders, directions, restrictions and remediation plans. They should also examine whether the target has received repeated warnings about governance, capital, customer treatment, reporting or risk management.

An unresolved regulatory issue may lead to financial penalties, restrictions on business, additional reporting obligations or reputational damage. The investor should assess the seriousness of each issue, whether corrective action has been completed and whether the regulator has formally accepted the response. Past non compliance should not automatically be treated as resolved simply because the target has changed its internal procedures.

Examine Capital Adequacy, Liquidity and Financial Soundness

A regulated institution must maintain the capital, liquidity and other financial resources prescribed for its category. The investor should assess regulatory capital, leverage, liquidity, asset quality, provisioning, concentration risk and exposure to connected parties. For lenders, this includes reviewing non performing assets, overdue accounts, restructuring, write offs, recovery practices and the reliability of collateral.

Financial weakness can become a regulatory problem if the institution breaches prudential requirements or requires urgent capital support. Investors should model the amount of capital needed after completion, including any regulatory shortfall, expected credit losses and planned business expansion. The valuation should reflect the cost of remediation and the possibility of additional capital requirements after the acquisition.

Evaluate Governance, Management and Fit and Proper Standards

Regulators expect financial institutions to maintain suitable governance arrangements and appoint individuals who meet applicable eligibility and fit and proper standards. The investor should review the experience, reputation, financial integrity and regulatory history of directors, promoters and senior management. It should also examine board composition, committee structures, internal audit, compliance oversight and the independence of control functions.

The acquisition may require changes to the board or senior management. These changes should be planned around the relevant regulator's approval or notification requirements. The investor should also consider whether the proposed management structure preserves effective risk oversight. Weak governance can create regulatory exposure even where the institution has adequate capital and a valid licence.

Assess Customer Protection, AML and Data Compliance

Customer facing financial institutions must comply with applicable customer protection requirements. Depending on the activity, these may include fair practices, grievance redressal, transparent pricing, responsible lending, disclosure obligations and restrictions on recovery practices. Investors should examine complaints, ombudsman matters, customer litigation and evidence of recurring service failures.

The target's anti money laundering and customer due diligence framework also requires careful review. This includes compliance with the Prevention of Money Laundering Act, 2002, related rules and applicable regulator directions on know your customer requirements. Data privacy and cybersecurity should also be assessed, including access controls, incident reporting, outsourcing arrangements and compliance with applicable data protection law. Weaknesses in these areas can result in enforcement action and loss of customer trust.

Review Outsourcing, Technology and Third Party Dependencies

Financial institutions often rely on external service providers for cloud hosting, customer onboarding, loan processing, payment infrastructure, data storage and other critical functions. The investor should identify key vendors, review contracts and assess whether outsourcing arrangements comply with the applicable regulator's directions. The review should cover audit rights, data access, business continuity, subcontracting and termination rights.

Technology risk can become a regulatory concern where systems fail, customer information is exposed or essential services are disrupted. Investors should examine cybersecurity audits, incident logs, disaster recovery arrangements and unresolved technology findings. A change of ownership may also affect important vendor contracts or require consent. The acquisition plan should include a realistic technology integration and remediation programme.

Assess FEMA, Reporting and Transaction Documentation

The proposed acquisition must comply with FEMA pricing and payment requirements, the applicable foreign investment rules and prescribed reporting obligations. The parties should determine whether the transaction involves a fresh issue of shares, a transfer from an existing shareholder or another permitted structure. They should obtain an appropriate valuation and identify the applicable filings, such as Form FC GPR or Form FC TRS, where relevant.

The share purchase agreement and shareholders' agreement should address regulatory approvals, warranties, indemnities, completion conditions and post completion obligations. Specific protection may be required for undisclosed regulatory breaches, inaccurate reporting, tax exposure and pending enforcement proceedings. The investor should also consider whether the target has historical FEMA defaults requiring regularisation. Professional advice on foreign investment can help coordinate the cross border and sectoral requirements, but the transaction must be assessed on its own facts.

Build a Regulatory Risk and Remediation Plan Before Completion

Due diligence should produce a prioritised risk register rather than simply a collection of documents. Each issue should be classified by its legal significance, financial impact, likelihood of enforcement and ability to remedy. The investor should distinguish between matters requiring approval before completion, matters which can be corrected before closing and ongoing obligations which need post acquisition monitoring.

The remediation plan should assign responsibility, budgets and deadlines. Where the acquisition involves a new Indian subsidiary or holding structure, foreign firm registration and corporate structuring should be aligned with the regulated activity and proposed ownership model. The investor should avoid implementing management or control arrangements before the necessary approvals are secured. A well documented regulatory plan can reduce execution risk and support a smoother transition.

Conclusion

Assessing regulatory risk is a central part of acquiring a regulated Indian financial institution. Foreign investors should verify ownership eligibility, licences, change in control requirements, regulatory history, financial soundness, governance, customer protection and FEMA compliance. The objective is not merely to establish whether the acquisition is legally possible, but whether the target can continue operating lawfully and sustainably after completion.

Frequently Asked Questions

Can a foreign investor acquire a controlling stake in an Indian financial institution?

A controlling stake may be permitted in some financial services sectors, subject to the applicable FDI cap, entry route, investor eligibility and sectoral regulations. Separate approval may be required for a change in control.

Does automatic route FDI mean no regulatory approval is needed?

No. The automatic route generally removes the need for prior government approval under the FDI Policy. It does not remove separate RBI, SEBI, IRDAI or other regulatory registration and approval requirements.

What regulatory documents should an investor review before an acquisition?

The investor should review licences, registration certificates, regulatory correspondence, inspection reports, enforcement orders, compliance returns, capital adequacy records, audit reports and details of pending proceedings.

Can a regulated financial institution lose its licence after an acquisition?

A change in ownership does not automatically cancel a licence. However, failure to obtain required approvals or comply with regulatory conditions can expose the institution to enforcement action, including restrictions on operations or cancellation where legally justified.

How does a change in control affect an NBFC acquisition?

Certain NBFC acquisitions and changes in shareholding, control or management may require prior RBI approval under the applicable directions. The precise requirement depends on the NBFC's category and the proposed transaction.

Should regulatory risk affect the acquisition price?

Yes. Capital shortfalls, unresolved compliance issues, litigation, enforcement exposure and required remediation can affect the target's value. Investors should quantify these risks and reflect them in valuation, transaction protections and completion conditions.

This update was released on 11 Jan 2027.

The views expressed in this update are personal and should not be construed as any legal advice. Please contact us directly on +91 22 40565252 or contact@mhcolaw.com for any assistance.

Legal Update Team
MANSUKHLAL HIRALAL & COMPANY
Advocates, Solicitors and Notaries
T: +91 22 40565252
Mumbai Office: Surya Mahal, 2nd Floor, 5, Burjorji Bharucha Marg, Fort, Mumbai-400 023, India
Delhi Office: Block C-9, Lower Ground Floor, Jangpura Extension, New Delhi - 110 014, India
www.mhcolaw.com

"Noted lawyer in the Real Estate practitioner from India" - Chambers & Partners

Please consider the environment before printing this email

The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorized to receive it. This communication may contain confidential or legally privileged information. If you are not the intended recipient, any disclosure, copying, distribution or action taken relying on the contents is prohibited and may be unlawful. If you have received this communication in error, or if you or your employer does not consent to email messages of this kind, please notify the sender immediately by responding to this email and then delete it from your system. No liability is accepted for any harm that may be caused to your systems or data by this message.