RBI Compliance for Fintech Startups: Key Requirements

TL;DR — the 30-second version
• RBI does not give one "fintech licence." Your product decides the licence: lending needs an NBFC, collecting payments needs a Payment Aggregator (PA), and a wallet needs a PPI.
• Net worth bars are real money: Rs 10 crore for an NBFC, Rs 15 crore for a PA (rising to Rs 25 crore by March 2028), Rs 5 crore for a PPI.
• From May 2025, all RBI licence applications go through the PRAVAAH portal. Most approvals take 12 to 24 months.
• KYC and anti-money-laundering rules, data-in-India storage, and a Key Fact Statement for every loan are non-negotiable.
• Getting the structure and filings right early is far cheaper than a penalty or a "cease operations" order later.

You built a slick app. Users love it. Then a bank asks for your RBI authorisation and the whole roadmap stalls. This is the most common trap for fintech founders in India: the product is ready, but the compliance is not. The good news is that RBI compliance for fintech startups follows a clear logic. Once you know which licence maps to your product, the rest is a checklist.

This guide breaks it down in plain English for founders and small-business owners. We cover the licences, the real rupee numbers for FY 2025-26, the filings you must not miss, and the penalties you want to avoid. If you would rather hand this off, EaseUp runs accounting and compliance for fintech teams end to end.

Why RBI Compliance Is Not Optional for Fintech

A fintech touches other people’s money. That is why the Reserve Bank of India (RBI) treats it differently from a normal software startup. The moment you move, hold, or lend money, you step into a regulated zone.

Get it wrong and the cost is not just a fine. The RBI can order an app to stop operations, freeze settlements, or block a bank partnership. For a young company, that is often fatal. You can read the RBI’s own rules and circulars on the official RBI website.

Watch out: In 2024 and 2025 the RBI told several digital lending apps to cease operations and fined Payment Aggregators for KYC and settlement lapses. Compliance is now enforced, not just published.

RBI Does Not Give One "Fintech Licence"

There is no single "fintech licence." What you need depends on what your product actually does with money. Most founders fall into one of these buckets:

• You lend money on your own books. You need a Non-Banking Financial Company (NBFC) licence.

• You collect online payments for merchants. You need a Payment Aggregator (PA) licence.

• You run a wallet or prepaid card. You need a Prepaid Payment Instrument (PPI) licence.

• You share users’ financial data with their consent. You register as an Account Aggregator (AA).

If your app does two of these, you may need two licences or a bank partner. Map your money flow first, then pick the licence. Never the other way round.

The Main RBI Licences and Net Worth Bars

Here is the part founders search for most: the actual money you must show on your balance sheet. These "net worth" or "net owned fund" numbers are the entry ticket. Save this table.

Note: These are minimums. The RBI also looks at "fit and proper" promoters, a clean tech audit, and a Board-approved security policy before it says yes.

How to Pick the Right Licence for Your Model

Use this quick logic to find your starting point. Read each line and stop at the first one that matches your product.

1. Do you give loans and earn interest? Start with an NBFC licence. If you only refer borrowers to a bank, you may avoid this, but the rules still apply to the loan journey.

2. Do you sit between a buyer and a merchant at checkout? You are a Payment Aggregator. Most "payment gateway" startups land here.

3. Do users load money into your app to spend later? That stored value makes you a PPI issuer.

4. Do you only pull bank data with consent to show or analyse it? You are an Account Aggregator, not a lender.

Still unsure? A short call with a finance partner saves months. EaseUp’s virtual CFO team helps founders map the money flow and choose the right path before they spend on a licence.

KYC and Anti-Money-Laundering: The Core Duty

Whatever licence you hold, "Know Your Customer" (KYC) and anti-money-laundering rules apply. They come from the Prevention of Money Laundering Act (PMLA) and RBI Master Directions.

• Verify every user. Use Aadhaar-based or video KYC and keep an audit trail.

• Watch transactions. Flag and report suspicious activity to the authorities.

• Keep records for five years. Store customer and transaction records for at least five years.

• Name an officer. Appoint a compliance officer who owns this process.

Digital Lending Guidelines You Cannot Skip

If you lend, the RBI Digital Lending Guidelines (from 2022, tightened since) are strict and very specific. Three rules trip up most apps.

• Money flows direct. The loan must go straight from the lender to the borrower’s bank account. No routing through a third-party pool.

• Show the full cost. Give every borrower a Key Fact Statement (KFS) with the annual percentage rate, all fees, and the repayment schedule before they sign.

• Respect privacy. You may not access contacts, photos, or the camera roll. A cooling-off period to cancel the loan is mandatory.

:check_mark_button: Founder tip: Build the Key Fact Statement and the direct-disbursal flow into your product from day one. Retrofitting them after launch is painful and is exactly what regulators inspect first.

Data Localisation: Keep It in India

The RBI requires that all payment system data be stored only in India. If you process card or payment data, the full transaction details must sit on servers within the country.

Card details cannot be stored by merchants or aggregators. You must use tokenisation through the card networks instead. On top of this, the Digital Personal Data Protection Act, 2023 governs how you collect and use personal data, with penalties up to Rs 250 crore for serious breaches.

Cybersecurity and Audit Requirements

The RBI expects a real security posture, not a checkbox. The baseline for a regulated fintech looks like this:

• Board-approved security policy. Written, owned by the Board, and reviewed every year.

• Annual VAPT. Run vulnerability assessment and penetration testing each year.

• Multi-factor login. Require more than a password for any financial action.

• Fast incident reporting. Report cyber incidents to CERT-In within six hours.

Registration and the New PRAVAAH Portal

The journey has two tracks that run together. First, incorporate a private limited company under the Companies Act, 2013 through the Ministry of Corporate Affairs. Second, apply to the RBI for your specific licence.

Since May 2025, all RBI licence and approval applications go through the PRAVAAH portal. Budget 12 to 24 months from application to approval, plus three to six months of prep before that. It also helps to claim startup benefits via Startup India while you wait.

:check_mark_button: Founder tip: Use the RBI Regulatory Sandbox to test a live product legally before the full licence lands. It buys you time and proof for the application.

Grievance Redressal You Must Set Up

Every regulated fintech needs a real complaint system, not just a support inbox. The RBI mandates a clear, time-bound process.

• Appoint a Nodal Officer. Name a person responsible for complaints and publish their details.

• Acknowledge in 24 hours. Confirm receipt of every complaint within one day.

• Resolve in 30 days. Close complaints within a month and keep a record.

• Show it on your site. Display the full grievance process publicly.

Your Annual Compliance Calendar and Costs

Compliance is not a one-time event. Beyond your RBI duties, a registered company has a yearly rhythm of filings. Miss them and the late fees stack up fast. Here is a snapshot for a fintech private limited company, with the kind of numbers founders ask about.

Handling the income tax piece well also matters; see the official Income Tax portal for due dates. Many founders outsource this whole calendar to a bookkeeping and accounting partner so nothing slips through the cracks.

Penalties: What Non-Compliance Really Costs

The downside is steep, and the RBI has shown it will act. Keep these numbers in mind:

• Running a payment system without RBI authorisation: imprisonment of up to 10 years and/or a fine of up to Rs 1 crore, plus a further daily fine while the violation continues.

• Lending as an NBFC without registration: jail up to five years.

• PMLA and KYC failures: penalties up to Rs 2 lakh per month.

• Serious data breaches: penalties up to Rs 250 crore under the data protection law.

Compared with these, the cost of doing compliance right is small. If your team is stretched, EaseUp’s accounting and compliance service keeps your fintech audit-ready and on time.

A Simple Compliance Roadmap for Founders

Feeling overwhelmed? Do not be. Work through it in order:

1. Map your money flow. Write down exactly how money moves through your app.

2. Pick your licence. Match that flow to an NBFC, PA, PPI, or AA.

3. Build compliance into the product. KYC, KFS, direct disbursal, and India-only data from day one.

4. Incorporate and apply via PRAVAAH. Get the company set up, then file with the RBI.

5. Run the annual calendar. GST, income tax, ROC, and security audits on schedule.

When to Bring In a Finance Partner

You can do early-stage compliance yourself. But once you raise money, add users, or chase a licence, the load grows fast. A finance partner saves you from costly mistakes and frees you to build.

EaseUp acts as the finance and compliance backbone for Indian fintech startups and SMEs. From accounting and compliance to CFO-level strategy, we keep you audit-ready while you grow. Book a free call and we will map your exact compliance path.

This article is for general information only and is not legal, tax, or regulatory advice. RBI rules and net worth thresholds change; please verify current requirements with the RBI and a qualified professional before acting.