TL;DR: A fintech startup in India needs two layers of legal documentation most other startups don’t: the standard founding, employment, and IP documents every company needs, and a distinct set of RBI-mandated compliance documents, KYC/AML policies, data localisation compliance, Fair Practices Code, and, depending on your specific model, Payment Aggregator or NBFC licensing documentation, that become legally mandatory the moment you touch customer money or lending data. Getting these documents wrong, or missing them entirely, doesn’t just create legal exposure, it can block your RBI authorisation outright or halt operations. This guide covers every document, organised by when it actually becomes required.
Quick overview: This is an India-specific checklist, not a general startup document list. For the broader, non-fintech-specific version of this kind of checklist, our complete guide to legal documents every SaaS startup needs covers that separately. Where a template already exists in our library, it’s linked directly below.
Foundational documents every fintech startup needs
These aren’t fintech-specific, but they matter just as much here as anywhere else, and skipping them causes the same problems it always does.
Certificate of Incorporation, MOA and AOA. Registered as a Private Limited Company, with an object clause specifically covering fintech and financial services activities, not a generic commercial object clause that RBI reviewers will flag during licensing.
Founders’ Agreement. Covering equity split, vesting, IP ownership, and decision-making authority between co-founders. Our free Founders’ Agreement template covers exactly this.
IP Assignment Agreements. Covering any code, algorithms, or proprietary models built before incorporation, and ongoing assignment for everyone who writes code or builds IP afterward. Our complete IP assignment guide covers what this needs to contain, and why leaving it to default rules is a genuinely avoidable risk.
NDAs, Employment, and Contractor Agreements. Standard protective and engagement documents, our NDA and non-compete template covers the confidentiality side of this.
Customer-facing documents required from day one, regardless of your specific model
Privacy Policy, aligned with the DPDP Act. Not a generic privacy policy, one that reflects the DPDP Act, 2025’s notice and consent requirements specifically. Our complete DPDP Act guide covers what this actually requires.
Terms of Service. Governing use of your platform, app, or website.
KYC/AML Policy, board-approved. Every RBI-regulated fintech entity, and this covers a much broader set of business models than founders often assume, must implement a Know Your Customer and Anti-Money Laundering framework aligned with the Prevention of Money Laundering Act, 2002 and RBI’s Master Direction on KYC, most recently updated in August 2025. This policy needs formal board approval, not just an internal document, before you begin onboarding customers.
Appointment of a Principal Officer. A specifically designated management-level individual responsible for AML compliance and reporting to the Director, Financial Intelligence Unit India. Their appointment, and any subsequent change, must be formally communicated to the RBI.
If you’re building a payment platform: Payment Aggregator documentation
Any non-bank entity collecting payments from customers on behalf of merchants, this includes far more business models than founders often realise: marketplaces, subscription platforms, ticketing platforms, and bill aggregators, not just obvious payment companies, needs RBI Payment Aggregator authorisation.
Form PA application, with supporting documents. Filed with RBI’s Department of Payment and Settlement Systems, accompanied by your Certificate of Incorporation, MOA/AOA, a detailed business plan, IT infrastructure documentation, your KYC/AML policies, escrow account details, and board-approved security policies. The process typically takes four to six months.
Board-approved Information Security Policy. A specific, formal document, not an informal internal practice, covering your technology infrastructure and security posture.
PCI-DSS certification documentation. Required as part of demonstrating your platform meets payment card industry security standards.
Escrow account agreement with a scheduled commercial bank. A mandatory structural requirement for holding merchant funds.
Data localisation compliance documentation. RBI mandates that all payment data be stored exclusively within India. This needs to be demonstrable, not just assumed, and it applies to your infrastructure choices from day one, not something to retrofit once you’re operational.
If you’re building a lending platform: digital lending and NBFC documentation
This is where the document requirements become genuinely extensive, and where the distinction between your specific business model matters most.
If you’re a Lending Service Provider (LSP) rather than the lender itself, you don’t need a separate RBI licence, but you must be engaged by a regulated entity, a bank or NBFC, through a formal written agreement. This LSP Agreement is itself a mandatory legal document, and it needs to clearly allocate compliance responsibilities between you and the regulated entity you’re partnering with, not leave this ambiguous.
Key Facts Statement (KFS) template. A standardised, mandatory disclosure document given to borrowers before loan disbursal, covering the effective interest rate, all fees, and the total cost of the loan in a defined, board-approved format.
Fair Practices Code. A board-approved policy governing lending conduct, disclosure standards, and borrower treatment.
Data privacy policy specific to lending data, addressing both RBI’s localisation mandate and DPDP Act consent and notice obligations simultaneously, this dual-compliance requirement has become genuinely more demanding in 2026 as DPDP obligations layer on top of pre-existing RBI requirements, particularly where you use third-party Video KYC (V-CIP) vendors.
FLDG Policy, where applicable, a First Loss Default Guarantee arrangement governing risk-sharing between the lending platform and its partner.
Grievance redressal mechanism documentation. Must be genuinely operational, not merely a written policy, RBI’s current guidance is explicit that documented policies without functioning systems don’t satisfy the requirement.
If you’re registering as an NBFC directly, your documentation needs extend further: a detailed business plan, three-year financial projections addressing capital adequacy and provisioning, Net Owned Funds (NOF) certification, and, for peer-to-peer lending platforms specifically, compliance with the Master Direction on NBFC-P2P Lending Platforms, 2017, including documented exposure limits and mandatory escrow arrangements between lenders and borrowers.
Vendor and partner agreements: the documents founders consistently underweight
Data Processing Agreements with every KYC and data vendor. Where you use a third-party Video KYC provider, your DPA with that vendor needs to reflect both RBI’s data localisation requirement and DPDP Act consent and notice obligations at the same time, a single generic vendor DPA template is genuinely insufficient here.
Sponsor bank and payment infrastructure agreements. Where you depend on a partner bank, a card network, or UPI infrastructure providers for settlement, these agreements need to clearly allocate responsibility for authentication, transaction logging, and fraud loss compensation. RBI’s current guidance specifically expects fintechs to review these relationships and flag any contract where responsibility is ambiguous for renegotiation, not leave it unresolved.
Credit bureau integration agreements. Where you report to or pull from credit bureaus, formal data-sharing agreements need to be in place.
When each document actually becomes required
Treat this as a rough sequence, not a rigid rule, since your specific model changes the order:
- Before incorporation: IP Assignment, Founders’ Agreement, NDAs for early conversations.
- At incorporation: MOA/AOA with the correct object clause, Shareholders’ Agreement, employment agreements.
- Before any customer data is collected: Privacy Policy, Terms of Service, board-approved KYC/AML Policy, Principal Officer appointment.
- Before applying for RBI authorisation: the full licence-specific documentation set above, business plan, security policies, escrow arrangements, depending on whether you’re pursuing Payment Aggregator or NBFC status.
- Before onboarding your first lending customer: LSP Agreement or NBFC registration as applicable, Key Facts Statement, Fair Practices Code.
- Ongoing, as you scale: updated DPAs with every new vendor, periodic review of partner agreements as RBI’s rules evolve, since 2026 alone has already brought new authentication and operational compliance deadlines fintechs need to track actively, not treat as a one-time filing exercise.
Frequently asked questions
Does every fintech startup in India need RBI authorisation?
Not automatically. It depends on your specific activity. Payment aggregators need RBI authorisation, lending platforms must comply with the digital lending guidelines, and NBFCs need RBI registration. Some fintech models, financial SaaS tools, accounting software, or comparison platforms, don’t require a financial sector licence, but still need to comply with data protection and general business law.
What is an LSP Agreement, and do I need one?
If your platform assists a bank or NBFC with lending activities without being the lender itself, you’re classified as a Lending Service Provider, and RBI’s digital lending guidelines require you to be engaged through a formal written agreement with the regulated entity. This agreement needs to clearly allocate compliance responsibilities, including customer disclosure and data handling obligations.
Does the DPDP Act change what a fintech’s KYC vendor agreements need to cover?
Yes. As of 2026, vendor agreements for services like Video KYC need to satisfy both RBI’s data localisation mandate and the DPDP Act’s consent and notice requirements simultaneously. A generic data processing agreement that only addresses one of these is no longer sufficient.
How long does it take to get RBI Payment Aggregator authorisation?
The process, from filing Form PA with supporting documentation to receiving authorisation, typically takes four to six months, alongside meeting the net worth requirement currently set between Rs 15 crore and Rs 25 crore.
What happens if a fintech startup operates without the required RBI documentation?
This depends on the specific activity, but operating a regulated payment or lending business without proper authorisation or documented compliance policies exposes the business to regulatory action, potential suspension of operations, and can permanently damage the prospects of obtaining authorisation later. RBI’s current enforcement posture treats documented-but-non-operational compliance as insufficient, not just missing documentation entirely.
This article is general information, not legal advice. RBI regulations and compliance deadlines for fintech businesses change frequently and depend heavily on your specific business model. For advice on your specific fintech venture, speak to a qualified fintech lawyer.
Authored and reviewed by Prakhar Rai, Advocate, founder of My Legal Pal, enrolled with the Bar Council of India. Connect on LinkedIn.
Building a fintech startup in India involves genuinely more legal documentation than most other business models, and getting it right the first time protects both your RBI authorisation and your business. Our team drafts and reviews the complete fintech legal document stack, founding documents, compliance policies, and partner agreements. Speak to our contract lawyers in India about your specific fintech venture.
