1 The Fintech Landscape

1.1 Please describe the types of fintech businesses that are active in your jurisdiction and the state of the development of the market.  Are there any notable fintech innovation trends of the past year within particular sub-sectors (e.g. payments, asset management, peer-to-peer lending or investment, insurance and blockchain applications)?

Since India’s economic liberalisation, the information technology industry has shown significant growth and prominence in both domestic and offshore markets.  As a natural progression, this sector has challenged traditional financial systems and has created a sub-financial sector, commonly referred to as the “Fintech” market.  In the last decade, the financial regulator, i.e., the Reserve Bank of India (“RBI”) has also showed promise to back this market by providing regulatory recognition to this innovation.  Notably, in 2007, the RBI enacted the Payment and Settlement Systems Act, 2007 (“PSSA”) to provide legal sanctity to payment systems and recognised activities involving payment, settlement and clearing, including setting up a separate department, i.e., the Department of Payment Settlement Systems to implement the provisions of the PSSA.

Pursuant to the PSSA, various “non banking”/“non financial” institutions, including global players, obtained necessary registrations to operate payment networks in India, resulting in the creation of the National Payment Corporation of India (“NPCI”), the launch of the RuPay card network, the National Financial Switch, etc.  In addition to these systems, consumers in India more regularly interact with pre-paid payment instruments that affect the cashless/cardless transfer of funds between peers and merchants via an “e-wallet”, “tokens”, “points”, etc.  This burgeoning pre-paid market, presently, provides an alternative to traditional payment modes, whilst guaranteeing security and handling both small and voluminous transactions for a service provider/merchant.

The regulator noting the aforementioned developments, in 2015, also issued the Guidelines for Online Payment Gateway Service Providers (“OPGSP”) in order to regulate cross border payment processing for cross border sale of goods and services (i.e., settlement of import/export related payments affected over websites/apps).

In addition to the above, artificial intelligence and Blockchain applications have increasingly been incorporated in financial services.  In the Budget Speech 2018–19, the erstwhile Finance Minister had specifically noted the benefit of Blockchain technology and the Government has since sanctioned several schemes/programs to explore the use of this technology.  Similarly, several banks/financial institutions have entered into partnerships with technology firms to incorporate artificial intelligence (“AI”) and Blockchain applications in their products/services and internal systems.  Most popularly, use of AI is evidenced by banks such as State Bank of India, HDFC, etc. launching “SIA”/“Eva”, their flagship AI bots to address consumer queries.  Similarly, today the most common use of Blockchain by the financial sector is to undertake know your customer (“KYC”) verifications.

1.2 Are there any types of fintech business that are at present prohibited or restricted in your jurisdiction (for example cryptocurrency-based businesses)?

Whilst there is no fintech business that is per se prohibited, it is understood that the Government has prepared a draft legislation, i.e., the ‘Banning of Cryptocurrency and Regulation of Official Digital Currency Act, 2019’, which seeks to ban any person from mining, generating, holding, selling, dealing in, issuing, transferring, disposing of or using cryptocurrency in the territory of India.  Given that the draft legislation is yet to be enacted by Parliament, in light of the Supreme Court decision on March 4, 2020 striking down RBI’s ban on cryptocurrency, it is probable for Parliament to reassess the present draft legislation.

2  Funding For Fintech

2.1 Broadly, what types of funding are available for new and growing businesses in your jurisdiction (covering both equity and debt)?

In order to raise financing, typically, most entities within India source their funds privately through angel investors or private equity funds, and in limited cases, through crowd funding.  Alternatively, depending on the stage of growth or size of the organisation, funds may also be raised pursuant to an initial public offering.  In light of the revised foreign exchange regulations, today, most sectors permit 100% foreign investments without obtaining any approvals.  Recently, there have also been relaxations introduced for foreign portfolio investors, such as an increase in the short term investment limits in central government securities (including treasury bills), state development loans, and corporate bonds from 20% to 30% of the total investments and an increase in the cap on investment under the voluntary retention route to INR 75,000 crores.

2.2 Are there any special incentive schemes for investment in tech/fintech businesses, or in small/medium-sized businesses more generally, in your jurisdiction, e.g. tax incentive schemes for enterprise investment or venture capital investment?

Along with tax relaxations/deductions available to start-ups, the RBI and the Central Government has undertaken significant steps to specifically incentivise tech/fintech firms.  This has been illustrated by moves such as demonetisation, tax rebates, reduction in transaction costs, or by subsidising the merchant discount rates on all low value payments (i.e., below INR 1,000) thereby accelerating a shift from paper to electronic payment.

Similarly, initiatives such as Trade Receivables Discounting System, has promoted online bill discounting platforms such that small and medium enterprises may raise funds by facilitating an online sale of their trade receivables.  Despite only three entities obtaining a licence to operate this platform, per public sources, these licensed entities have projected a turnover of over INR 25,000 to INR 30,000 crore for the coming financial year.

Bodies such as the National Payment Corporation of India (“NPCI”) have further expanded the network system by floating the unified payment interface that has inadvertently resulted in the top technology service providers integrating payment functionalities into their platforms, thereby further boosting peer-to-peer payment modes.  Taking note of the success of NPCI, the Government has remained proactive to ensure healthy competition and, in light of the same, is considering authorising a pan India umbrella entity to regulate retail payment systems.  Unlike NPCI, whose members primarily include banks (i.e., large financial institutions), the proposed umbrella entity can be an Indian incorporated private company.

2.3 In brief, what conditions need to be satisfied for a business to IPO in your jurisdiction?

In order to undertake an IPO, a company is required to meet the eligibility criteria set out under the SEBI (Issue of Capital and Disclosure Requirements) Regulations, 2018. This includes meeting prescribed financial thresholds through its own sources or undertaking a book building process.  Additionally, the business has to ensure that its directors/promoters are not debarred from accessing capital markets or are wilful defaulters/economic fugitives, no outstanding convertible securities exist that would provide the holder an option to receive equity shares (unless such option is through an employee stock option or are securities to be converted before the day of filing of the red herring prospectus) and the minimum prescribed number of securities is offered to the public.

2.4 Have there been any notable exits (sale of business or IPO) by the founders of fintech businesses in your jurisdiction?

Some notable exits include the exit of the founders of PayU, an online payment service provider, through its brand ‘LazyPay’.  This entity received an approximate investment of INR 900 crore from Naspers in 2016, however in 2019, its founders have left to explore new opportunities within the fintech segment.  One of its founders is also floating a new venture, Jupiter.money, to provide banking services as a “neobank” to commence operations in 2020.  NestAway, a leading business in the rental home segment also saw the exit of two cofounders within three months of its incorporation. Similarly, Lendingkart, a company that offers loans to small and medium sized enterprises, which has received investors from several private equity firms including Temasek Holdings, saw an exit of its key founders, who have launched Optimus Capital, a capital markets analytics company.  Sachin Bansal’s exit from Flipkart, an online marketplace, to set up Navi, a digital banking and financial services is a testament to the burgeoning growth of fintech.  The last year has also seen significant moves from the tech industry to private equity funds, such as the exit of Google’s South East Asia’s vice president to join Sequoia Capital India, as its managing director.

3 Fintech Regulation

3.1 Please briefly describe the regulatory framework(s) for fintech businesses operating in your jurisdiction, and the type of fintech activities that are regulated.

Whilst there is no one ombudsman regulator for fintech businesses, most fintech businesses would fall under the purview of the RBI.  In addition to the RBI, depending on the nature of activity sought to be regulated, or, on the third party of which a fintech entity would interact with, regulators such as the Securities Exchange Board of India, Ministry of Electronics and Information Technology, the Insurance Regulatory and Development Authority of India (“IRDAI”) and the Ministry of Corporate Affairs would also have oversight.

As stated above, businesses engaged in peer-to-peer lending, or cross border payment processing for current account transactions would require businesses to obtain specific licences from the RBI.  Whilst there may not be formal legislation addressing certain fintech activities, certain aspects may be regulated or proposed to be regulated.  For instance, in case of open banking, whilst there is no formal regulation, the RBI Master Directions on Account Aggregator dated September 2, 2016, regulate activities such as account aggregation, which is a key facet of open banking.  Similarly, the RBI has also sought industry views on the potential regulation of payment service providers.  Alternatively, if the activity is not itself regulated, some fintech businesses, such as consumer lending, invoice discounting or foreign exchange trading can only be undertaken by regulated entities such as non-banking financial institutions.

3.2 Is there any regulation in your jurisdiction specifically directed at cryptocurrencies or cryptoassets?

The Government has prepared a draft legislation, i.e., the ‘Banning of Cryptocurrency and Regulation of Official Digital Currency Act, 2019’, which seeks to ban any person from mining, generating, holding, selling, dealing in, issuing, transferring, disposing of or using cryptocurrency in the territory of India, however this legislation is yet to be tabled and enacted by Parliament.  Between 2018–19, the RBI had temporarily created a block on any dealing in cryptocurrency by banning all financial institutions from dealing in cryptocurrency.  However, this directive has subsequently been quashed by the Indian Supreme Court.  Therefore, in the current scenario there exists a vacuum in legislation and businesses/private entities may continue dealing in cryptocurrency until further clarity is provided on its legality by either the Government or the RBI.

3.3 Are financial regulators and policy-makers in your jurisdiction receptive to fintech innovation and technology-driven new entrants to regulated financial services markets, and if so how is this manifested? Are there any regulatory ‘sandbox’ options for fintechs in your jurisdiction?

The rapid growth of the fintech industry in India is a testament of the encouragement provided to industry participants by regulators.  Every key regulator, i.e., the RBI, SEBI, IRDAI and the Pension Fund Regulatory and Development Authority (“PFRDA”) has issued draft guidelines and, in the case of RBI and SEBI, operationalised regulatory sandboxes in order for fintech businesses to live test their innovations in a controlled regulatory environment, whilst providing exemptions of liquidity requirements, corporate compliances, credit record, financial soundness, management experience, etc.  Some key identified themes include retail payments, money transfer services, marketplace lending, digital KYC, financial advisory services, wealth management, digital identification, smart contracts, etc. These sandboxes have been designed to be short term (i.e., between six to seven months) such that multiple sandboxes under various themes may be operationalised. In addition to sandboxes, it is evident from the Government’s budget policies and the regulator’s policy decisions that it seeks to support innovation. Nascent technologies, such as Blockchain is one such example.  Currently, not only are private parties being invited by the Government/financial institutions to operationalise authentication services by deploying Blockchain, but the Government itself has set up working groups to test potential applications on the technology.

3.4 What, if any, regulatory hurdles must fintech businesses (or financial services businesses offering fintech products and services) which are established outside your jurisdiction overcome in order to access new customers in your jurisdiction?

In light of the Government’s initiative to incentivise businesses locally, a key barrier for most offshore fintech businesses is undertaking steps to localise their business/operations.  This measure can often include significant costs on the offshore entity.  Despite localisation measures, the Government has ensured that foreign investors can completely own and control locally-incorporated companies and therefore, an investor can penetrate the Indian market with ease.

4 Other Regulatory Regimes / Non-Financial Regulation

4.1 Does your jurisdiction regulate the collection/use/transmission of personal data, and if yes, what is the legal basis for such regulation and how does this apply to fintech businesses operating in your jurisdiction?

Pursuant to the (Indian) Information Technology Act, 2000 (“IT Act”), any collection, disclosure or transfer of personal data, which would include details such as an email address, password or financial data such as bank account details, would require the owner’s consent.  Irrespective of the nature of the entity or the operations it undertakes, in the event such information is either, collected, disclosed or transferred, every entity undertaking this activity would be required to do so with consent which may be obtained pursuant to a legally binding contract.

4.2 Do your data privacy laws apply to organisations established outside of your jurisdiction? Do your data privacy laws restrict international transfers of data?

Given that the IT Act has extra-territorial jurisdiction, it is possible for its provisions to be made applicable to offshore entities, including in case of a data breach.  Further, whilst the IT Act does not restrict international transfer of personal data, in case of financial data, payment system providers are required to store such data of domestic transactions within India only.  In case of cross border transactions, a copy of the transaction may be stored overseas, however, a domestic copy must also be stored.  Parliament has also proposed a specific data protection law (“Bill”) that is presently under review by the joint parliamentary committee.  In its present form, sensitive personal data, i.e., health data, or other data including financial data, that identifies a person, will be required to be stored in India by all entities and not just financial institutions.

4.3 Please briefly describe the sanctions that apply for failing to comply with your data privacy laws.

The IT Act has provided for both civil and criminal consequences for breach of its provisions and underlying rules as well as failure to undertake specific prescribed actions.  For instance, in the event of a data breach, a failure to report such breach to the Indian Computer Emergency Response Team (“CERT”) would attract a penalty of INR 5,000 (approx. USD 68) per day of such violation.  Similarly, in case CERT requires the entity to provide requisite information and the entity fails to do so, such entity could attract a penalty of INR 100,000 (approx. USD 1,343).  In addition to monetary penalties imposed, in the event that a case of negligence in maintaining reasonable security practices is proved, the entity would also be required to compensate any persons affected by such negligence.  Similarly, any person who has received personal data, pursuant to a contract, with the intent to cause or knowing it could likely cause wrongful gain/loss, and discloses such information without consent or in breach of the contract would be punished with imprisonment for a term that may extend to three years or a maximum fine of INR 500,000 (approx. USD 6,717).  The proposed Bill has in fact prescribed a higher penalty for offences such as processing or transferring personal data in violation of the Bill, being punishable with a fine of the higher of INR 150,000,000 or 4% of the annual turnover.  Similarly, a fine of the higher of INR 50,000,000 or 2% of the annual turnover will be imposed in case of failure to conduct a data audit.  In fact, processing any de-identified data without consent is punishable with a three years imprisonment term with/without fine.

4.4 Does your jurisdiction have cyber security laws or regulations that may apply to fintech businesses operating in your jurisdiction?

In India, cyber security, i.e., data protection, is specifically regulated under the IT Act.  Accordingly, every body corporate, including fintech businesses, is required to adopt appropriate data protection measures, such as adopting international security standards to ensure that there is no data breach.  Further, in the event of a data breach, every body corporate is required to report such data breach to the CERT and take necessary corrective measures to resolve the same.

4.5 Please describe any AML and other financial crime requirements that may apply to fintech businesses in your jurisdiction.

The Prevention of Money Laundering Act, 2002 (“PMLA”) is the primary legislation that prohibits money laundering/financial crimes. All reporting entities are required to maintain necessary records to furnish the same to authorities periodically to ensure that their systems are not being used for such prohibited activities.  In addition to the PMLA, most entities dealing with financial information are required to undertake KYC checks.

4.6 Are there any other regulatory regimes that may apply to fintech businesses operating in your jurisdiction?

In addition to the IT Act, every organisation, including those undertaking fintech operations, will be required to comply with entity specific legislation, such as the (Indian) Companies Act, 2013 and foreign exchange regulations in case such an organisation has received foreign investment.

5 Accessing Talent

5.1 In broad terms, what is the legal framework around the hiring and dismissal of staff in your jurisdiction?  Are there any particularly onerous requirements or restrictions that are frequently encountered by businesses?

Typically, whilst appointment is based on criteria set out by the recruiting entity, subject to meeting prescribed thresholds of minimum wage and age, Indian employment laws regarding termination vary depending upon the nature of employee, i.e., workmen/non-workmen.  Additionally, specific legislations such as the Equal Remuneration Act, 1976 or the Right to Disability Act, 2016 have been enacted to ensure that there is no discrimination made on the basis of gender or disability.  Legislations such as the Industrial Disputes Act, 1947 and state specific shops and commercial establishments act also ensure that adequate notice and compensation is provided at the time of termination and require that the employer provides notice or compensation in lieu of notice prior to termination.

5.2 What, if any, mandatory employment benefits must be provided to staff?

Mandatory employment benefits include payment of gratuity, contributions to state employee benefit funds such as the provident fund or state insurance, earned leave, prescribed working hours and overtime pay, maternity leave, etc.

5.3 What, if any, hurdles must businesses overcome to bring employees from outside your jurisdiction into your jurisdiction? Is there a special route for obtaining permission for individuals who wish to work for fintech businesses?

Transfer of employees is typically undertaken contractually subject to ensuring that such transfer is in accordance with immigration and taxation laws. Commonly, the biggest hurdle lies in ensuring necessary work permits/visas are obtained for such employees.  In order to receive an Indian employment work visa, the applicant should be a highly skilled and/or qualified professional being engaged at a senior/skilled position and therefore a work visa will not be granted for routine, ordinary or clerical positions.  In the event that an employer seeks to appoint such employee, he must also ensure that the employee’s salary is in excess of USD 25,000 per year, unless the position is specifically exempted from meeting this requirement.

6. Technology

6.1 Please briefly describe how innovations and inventions are protected in your jurisdiction.

India being a signatory to the Agreement on Trade-Related Aspects of Intellectual Property Rights has established a robust intellectual property rights (“IP”) regime pursuant to the Patents Act, 1970, Copyright Act, 1957, Designs Act, 2000 and Trademark Act, 1999, along with recognition being provided under the creator’s moral/common law rights.  Each of these legislations seeks to identify the true creator/author of the product and thereafter provides protection depending upon the uniqueness of the innovation.  Specifically vis-à-vis technology, ordinarily protection under copyright, trademark and design laws is provided.  However, a patent protection is often difficult to obtain since an algorithm, mathematical or business method, or computer program is not per se considered patentable subject matter in India.

6.2 Please briefly describe how ownership of IP operates in your jurisdiction.

In addition to the specific rights provided to the IP owner, pursuant to its copyright, patent or trademark, etc., moral rights and contractual ownership rights are also protected.  For instance, an author/inventor can transfer its ownership rights of a product to a third party.  Similarly, any invention created through the course of employment automatically bestows the IP rights in favour of the employer subject to the absence of a contract to the contrary.  In transactions involving copyright, it is critical to ensure that the original author has waived all his/her moral or special rights, ensuring that any rights transferred via the contract does not automatically revert to such author and prevents such author from disturbing the enjoyment of the transferred intellectual property.

6.3 In order to protect or enforce IP rights in your jurisdiction, do you need to own local/national rights or are you able to enforce other rights (for example, do any treaties or multi-jurisdictional rights apply)?

National rights obtained pursuant to registrations with appropriate government authorities are robust in itself to protect IP.  In India, pursuant to the Intellectual Property Rights (Imported Goods) Enforcement Rules, 2007, the Government has set up an electronic recordal system by its customs authority to ensure that local IP rights are further protected.  Pursuant to this system, no imported goods that infringe on the owner’s copyright, trademark or design rights will be imported.  Therefore, to a large extent, the IP owner remains protected without having to undertake active prosecutions against imported infringing products.

6.4  How do you exploit/monetise IP in your jurisdiction and are there any particular rules or restrictions regarding such exploitation/monetisation?

Depending upon the extent to which the IP owner is looking to transfer/share its rights, as such IP may be monetised pursuant to an outright sale or limited licence/sub-licence right provided to a third party.  A licence is beneficial in that the holder can retain its primary rights to the IP, whilst still creating a lucrative revenue stream by means of royalties or other profit sharing arrangements.  Additionally, the holder may also use its IP as collateral to obtain financing or similar return.

Authors:

Srinath Dasari, Senior Partner
Anu Tiwari, Partner
Rachana Rautray, Associate