Financial regulation

Regulatory bodies

Which bodies regulate the provision of fintech products and services?

There is no universal regulatory body for fintech entities in India. Depending on the product or service offered by the entity, the regulatory body governing such vertical would regulate those specific entities. By and large fintech products and services can be considered to fall under the purview of the following regulators:

  • the RBI;
  • the Securities Exchange Board of India (SEBI);
  • the Ministry of Electronics and Information Technology (MEITY);
  • the Ministry of Corporate Affairs; and
  • the Insurance Regulatory and Development Authority of India (IRDAI).

However, the RBI currently regulates the majority of fintech companies dealing with account aggregation, peer-to-peer (P2P) lending, cryto­currencies, payments, etc.

Regulated activities

Which activities trigger a licensing requirement in your jurisdiction?

Indian law regulates various types of financial services. Advisory work relating to investments in Indian securities requires a licence as an investment adviser. Certain types of investment banking, such as assisting private companies in obtaining funding, are considered to be outside the scope of the licence. There are also licensed merchant bankers - for example, making a public issue on the stock exchanges or a public offer under the Takeover Code would need the support of a registered merchant banker. There are different categories of merchant bankers and the functions of each level of category vary. There are other categories of agencies that require a licence, such as custodians, stock brokers, underwriters, portfolio managers, credit rating agencies, foreign institutional investors, venture capital funds, depositories and stock exchanges.

There are various categories of institutions that can engage in lending. These are banks that include scheduled commercial banks and non-scheduled commercial banks, cooperative society banks, small finance banks, non-banking financial companies (NBFCs) and money lenders. As regards deposits, there are various categories of institutions that can receive deposits. These are banks that include scheduled commercial banks and non-scheduled commercial banks, cooperative society banks, small finance banks, NBFCs that are authorised to receive deposits and payment banks. There is also the concept of a chit fund, which receives contributions from members and periodically conducts a lottery to pay the winner. Post offices can also receive deposits. There is a provident fund that is a pension scheme operated by the government. Mutual funds are also regulated.

Factoring can be undertaken by banks, NBFCs registered as factors with the RBI and certain other government entities.

Invoice discounting can be undertaken by banks, NBFCs and corporates.

Bonds and debentures can be listed on stock exchanges as public offerings. Syndications of loans are generally not regulated unless they are converted into securitised instruments.

Payment services are also regulated and are particularly relevant to fintech (see question 12).

Entities in India can deal in foreign exchange trading only with permitted stock exchanges and banks in India. Other entities such as fully fledged money changers are also permitted to deal with foreign exchange. Note that Indian residents are not permitted to trade in foreign exchange through overseas trading platforms.

Consumer lending

Is consumer lending regulated in your jurisdiction?

Yes, consumer lending is regulated. There are various types of institutions that are entitled to engage in consumer lending. These are banks that include scheduled commercial banks and non-scheduled commercial banks, NBFCs, cooperative society banks, small finance banks, microfinance institutions and moneylenders. Regulations require lending agencies to maintain standards relating to capital adequacy, prudential norms, cash reserve ratio, statutory liquidity ratio, credit ceiling, KYC guidelines, etc, although each of these norms would apply to each category of lending agency in a different manner. Each agency plays a different role in terms of the type of lending and the kind of borrower. For example, infrastructure NBFCs can extend credit facilities to entities in the transport, energy, water and sanitation, and communication sectors. Loans and advances of up to 2.5 million rupees are required to constitute at least 50 per cent of the loan portfolio of small finance banks.

Secondary market loan trading

Are there restrictions on trading loans in the secondary market in your jurisdiction?

Issuance and listing of debt securities and public offer and listing of securitised debt instruments are regulated in India. Trading of debt securities and securitised debt instruments in the secondary market is permitted after the debt securities or securitised debt instruments are listed on a recognised stock exchange.

Asset reconstruction companies or securitisation companies are permitted to securitise the acquired debt and sell the securitised debt only to qualified institutional buyers, which include banks, insurance companies and foreign institutional investors.

Risk participation, either funded or unfunded, is unregulated in India, and banks and NBFCs rarely enter into domestic risk participation transactions.

Collective investment schemes

Describe the regulatory regime for collective investment schemes and whether fintech companies providing alternative finance products or services would fall within its scope.

There are several categories of collective investment schemes. These are broadly mutual funds, alternative investment funds (AIFs) and collective investment schemes, all of which are required to be registered with SEBI. Mutual funds are primarily focused on listed equity and debt instruments and anyone can participate in a mutual fund. AIFs are primarily focused on unlisted instruments and primarily institutional investors invest in AIFs due to a significant minimum investment by an investor. The regulations on collective investment schemes cover all other forms of collective investment schemes. The regulations are extremely stringent on collective investment management companies; for example, there are requirements for rating, insurance, appraisal, schemes to be closed-ended, no guaranteed returns and restrictions on advertising material. Units subscribed to collective investment schemes are freely transferable. A fintech company would need to be registered as a collective investment management company to deal with collective investment schemes. However, alternative finance services such as P2P or marketplace lenders would not fall under the ambit of collective investment schemes. There are separate regulations governing these services, which a fintech company would have to comply with, as further explained in questions 9 and 10.

Alternative investment funds

Are managers of alternative investment funds regulated?

Yes, managers of AIFs are regulated. There are requirements as to their qualifications and minimum years of experience. The manager or sponsor of an AIF is also required to have a minimum investment in the fund of not less than 2.5 per cent or 50 million rupees, whichever is lower. There are requirements relating to disclosure of their investments.

Peer-to-peer and marketplace lending

Describe any specific regulation of peer-to-peer or marketplace lending in your jurisdiction.

The RBI is the authority that regulates P2P lending in India. All P2P lending platforms are required to be registered with the RBI as an NBFC. The eligibility requirements for a company to register as a P2P lending platform include, among other things:

  • a minimum capital of 20 million rupees;
  • that the company applying for registration is incorporated in India;
  • a robust and secure information technology system must be in place;
  • there must be a viable business plan; and
  • promoters and directors must fulfil the fit and proper criteria laid down by the RBI.

While many analysts have cheered the step taken by the RBI to regulate the P2P industry, the regulations themselves are extremely stringent with respect to the scope of activities that can be undertaken by these entities. For example:

  • P2P lending can only be done on an unsecured basis;
  • loan maturity is capped at 36 months;
  • there is a limit of 50,000 rupees regarding exposure between the same lender and borrower;
  • there is a limit of 1 million rupees regarding exposure of a lender or borrower across all P2P lending platforms; and
  • there must be quarterly reporting to the RBI.

Describe any specific regulation of crowdfunding in your jurisdiction.

To the extent that crowdfunding involves investments in equity or debt instruments, these would be regulated by company or securities law. A private company cannot access capital from the public and cannot have more than 200 shareholders. It also cannot accept deposits from the public. A public company would need to follow primary market processes for equity or debt funding. There are no regulations that deal directly with crowdfunding. For other types of funding, that is, those that are not debt or equity based, the law is not settled at the moment as all kinds of crowdfunding could be considered ‘deposits’. We believe that crowdfunding that can be justified as an advance against purchase of a product would be permitted in India. For P2P lending to the extent that it is a type of crowdfunding, see question 9.

Invoice trading

Describe any specific regulation of invoice trading in your jurisdiction.

To enhance the ease of financing micro, small and medium-sized enterprises in India, the RBI has provided its approval to three companies to set up invoice discounting platforms. The Trade Receivables Discounting System (TReDS) is a fintech platform where financers discount invoices due by corporates, government entities, etc. TReDS would need to have a minimum paid-up capital of 250 million rupees and entities, other than the promoters, are not permitted to maintain shareholding in excess of 10 per cent in TReDS.

Payment services

Are payment services regulated in your jurisdiction?

Yes, payment services are regulated under the Payment and Settlement Systems Act 2007. A payment system is defined as ‘a system that enables payment to be effected between a payer and a beneficiary, involving clearing, payment or settlement service or all of them, but does not include a stock exchange’. These include credit cards, debit cards, smart cards and money transfers. Any entity interested in commencing a payment system is required to obtain authorisation from the RBI.

The categories of payment providers are prepaid payment instruments, financial market infrastructure (clearing houses), retail payment organisations, card payment networks (Visa, MasterCard, etc), cross-border money transfers, ATM networks, white-label ATM operators, instant money transfer and prepaid payment instruments. There are three types of prepaid payment instruments:

  • open payment instruments, which are payment instruments that can be used to make a payment to any merchant;
  • semi-closed, which are payment instruments that can be used to make payment to a defined set of merchants; and
  • closed, which are payment instruments of a merchant for payment only to that merchant.

Open payment instruments can be issued only by banks. Cash withdrawal is permitted only in the case of open payment instruments. Only closed payment instruments do not require registration under the regulations.

After the overnight demonetisation of the 500 rupee and 1,000 rupee notes in circulation on 8 November 2016, digital payments have seen huge traction in the country. At the forefront of this traction are e-wallets, where it is believed that e-wallet transactions have increased 40 times in the past five years. E-wallets are frequently used for online purchase of goods and services. E-wallets have also gained popularity because of the requirement of a second authentication (such as Visa Verify or MasterCard Secure Code) for ‘card not present’ credit card and debit card transactions. This is difficult for services such as Uber. Accordingly, customers use payment wallets that allow for automatic debit without the need for a second authentication.

Open banking

Are there any laws or regulations introduced to promote competition that require financial institutions to make customer or product data available to third parties?

The laws regarding disclosure of customer data to third parties are not very well established in India. Banks are required to adhere to the guidelines on information security, electronic banking, technology risk management and cyber fraud issued by the RBI to ensure data protection of customers. Under normal circumstances, disclosure of customer data requires prior written approval from the customer. This is usually obtained in the account opening forms or provided for in the terms and conditions. As per the current legal framework, financial institutions are only obligated to share this information where the disclosure is required by a court of law or where the disclosure is necessary for government agencies mandated under law to procure such information.

Insurance products

Do fintech companies that sell or market insurance products in your jurisdiction need to be regulated?

Selling and marketing of insurance products is regulated in India. The statutory authority regulating insurance products in India is IRDAI. An insurer is required to justify the premium amount and terms and conditions of the insurance policy to be offered to customers to IRDAI. A fintech company cannot offer any insurance product for sale unless the fintech company is duly certified by IRDAI.

IRDAI has also issued guidelines on advertisement, promotion and publicity of insurance companies and insurance intermediaries. Fintech companies would need to comply with these guidelines with respect to marketing insurance products.

Credit references

Are there any restrictions on providing credit references or credit information services in your jurisdiction?

Companies carrying on the business of credit information services are regulated under the Credit Information Companies (Regulation) Act 2005. As per the provisions of the Act, every such company must obtain a certificate of registration from the RBI. Credit information companies are required to have a minimum issued capital of 200 million rupees. The RBI has set up a Central Repository of Information Large Credits to collect, store and disseminate credit data to lenders. Under the Insolvency and Bankruptcy Code 2016, information utilities have been set up where all credit information is required to be reported by lenders and borrowers.