INTRODUCTION
The start of the new financial year has witnessed a brisk pace of regulatory activity, with the Reserve Bank of India ("RBI") and the Securities and Exchange Board of India ("SEBI") being particularly active. The first quarter of the financial year has also seen a respectable inflow of investments and fund acquisitions, with fintech startups in India reporting to have raised approximately USD 1.2 billion. While the investments into the fintech sector seem to be on the rise compared to the last quarter, it still falls short of the funds raised in the first quarter of 2022. Reportedly, the number of funding rounds has declined by 77% (Seventy-Seven Percent), indicating a deceleration in the sector's growth.1 The outlook for the rest of FY 2023-24 will rely heavily on how the regulatory landscape in the fintech sector evolves over the rest of the year, among other factors. Accordingly, it is imperative to track and analyse the legal and regulatory developments in the fintech space along with relevant market developments and major deals.
This newsletter highlights the key developments in the Indian fintech space from April 01, 2023 to April 30, 2023.
RECENT LEGAL & REGULATORY DEVELOPMENTS
Master Direction on Outsourcing of Information Technology Services
The RBI issued a Master Direction on Outsourcing of Information Technology Services ("Outsourcing Directions") which will come into effect on October 01, 2023.2
The Outsourcing Directions are applicable to all material outsourcing of information technology ("IT") services (collectively "IT Services") by all banking companies, primary co-operative banks, Top-layer, Upper-layer and Middle layer Non-Banking Financial Companies ("NBFC"), and Core Investment Companies ("CICs"), (collectively "REs"). Material outsourcing of IT Services refers to outsourcing of activities which if disrupted or compromised would have the potential to significantly impact the RE's business operations or which may have material impact on the RE's customers in the event of any unauthorized access, loss or theft of customer information. The Outsourcing Directions, inter alia, (i) lay down the statutory and regulatory requirements applicable to REs for material outsourcing of IT Services; (ii) provide for the requirement to assess the need for outsourcing and attendant risks, along with availability of processes to manage those risks; (iii) stipulate the requirement for a comprehensive board approved IT outsourcing policy, which also incorporates the roles and responsibilities of the board, its committees (if any) and senior management, as well as monitoring, disaster recovery, business continuity and third party services termination contingency plans; (iv) prescribe the need to conduct due diligence on service providers; (v) provide for a risk management framework and; (vi) require REs to execute comprehensive outsourcing agreement with service providers, which should factor in the criticality of the outsourced task and associated risks.
The Outsourcing Directions allow REs to outsource IT activities/ IT enabled services within their business group/ conglomerate with a board-approved policy and appropriate service level agreements. The selection of a group entity should be based on objective reasons, and conflicts of interest should be appropriately dealt with. With regards to cross-border outsourcing, the RE must monitor government policies, political, social, economic, and legal conditions and establish exit strategies to mitigate the risk. The RE and the RBI should have the right to direct and conduct an audit or inspection of the service provider based in a foreign jurisdiction and the governing law of the arrangement should be clearly specified.
The Outsourcing Directions also state that the services obtained by an RE as a sub-member of Centralised Payment Systems from another RE, business correspondent services, payroll processing and statement printing etc. are not considered to be IT Services and accordingly do not fall under its ambit. Likewise, the payment system operators, vendors providing business services using IT, telecom service providers, partnership based fintech firms such as those offering co-branded products or services and audit related to IT infrastructure, IT services, information security services in their role as an independent third-party auditor, consultant or lead implementer are also not considered to be providing IT Services and are hence kept outside the ambit of the Outsourcing Directions.
IndusLaw's detailed article on the Outsourcing Directions can be found here.
On April 06, 2023, the RBI, among other things, decided to develop a secured web based centralized portal named as 'PRAVAAH' (Platform for Regulatory Application, Validation and Authorization) which will gradually extend to all types of applications submitted with the RBI across all functions. It has also hinted at new developments in the Unified Payments Interface ("UPI") space wherein the RBI is contemplating the UPI network facilitating transfers to / from pre-sanctioned credit lines from banks.
In addition to the above, the RBI has also proposed the setting up of a committee to examine and review the state of customer service provided by entities regulated by it. The said committee is also expected to review the adequacy of extant customer service regulations and suggest measures to improve the same.
Amendment to the RBI Master Directions on Know Your Customer
On April 28, 2023, the RBI amended its Master Directions on Know Your Customer ("KYC") ("KYC MD").3 The said amendments bring about the following key changes.
- The shareholding threshold for REs to identify beneficial owners, has been lowered from 25% (Twenty Five Percent) of shares or capital or profit of the company, to 10% (Ten Percent). Companies listed on notified stock exchanges, or subsidiaries of such listed companies are exempted from having to identify any shareholder or beneficial owner.
- The customer due diligence documentation requirements for companies, partnership firms and trusts now include the submission of additional details such as names of persons holding senior management positions in the company, and names of beneficiaries, trustees, settlors, authors of the trust.
- Aadhaar OTP based e-KYC in non-face to face mode has been permitted to be used for periodic updation. If the current address and the address in the Aadhaar of the customer is not the same, the RE should not require positive confirmation in this case, however, it would be required for the mobile number authentication.
- The list of enhanced due diligence measures now also requires: (i) verification of the current address through positive confirmation; (ii) collection and verification of permanent account number (PAN); (iii) customers whose address cannot be positively confirmed are to be categorised as high-risk customers; and (iv) accounts opened in non-face to face mode to be subject to enhanced monitoring until the identity of the customer is verified in a face to face manner or through Video-Customer Identification Process ("V-CIP"), etc.
- KYC documents downloaded from the Central Know Your Customer Registry, whose validity has lapsed, should not be used for KYC purposes.
- REs are now required to identify and assess the money laundering / terrorist financing risks that may arise in relation to the development of new products and new business practices and undertake appropriate measures to mitigate such risks.
- The Customer Acceptance Policy shall now also state that any additional information not specified in the RE's internal KYC policy should be obtained only with the explicit consent of its customer. Further, where the Goods and Services Tax (GST) number of the customer is available, it should be verified through the search / verification facility provided by the issuing authority.
- The indicative list of parameters for Risk Categorisation has been expanded to include geographical risk covering customers as well as transactions, type of products/services, delivery channels used for delivery of products/services, types of transactions undertaken etc., which must be treated as confidential.
- All REs should register the details of its non-profit clients, on the DARPAN Portal of NITI Aayog, if not already registered, and maintain such registration records for a period of 5 (Five) years after the business relationship between such clients and the RE has ended or the account has been closed, whichever is later.
- 'Registration certificate' as proof of business for sole proprietary firms now includes the Udyam Registration Certificate issued by the Government as well.
- REs are now required to ensure compliance with Weapons of Mass Destruction and their delivery systems (Prohibition of Unlawful Activities) Act, 2005 in relation to monitoring, freezing /unfreezing of accounts, financial assets, etc. of individuals / entities designated under the list as specified under Annex III to the KYC MD.
Guidelines on excusing or excluding an investor from investing in AIF
The SEBI has observed from the information disclosed in Pre-Placement Memorandums ("PPMs"), that there is inconsistency and lack of adequate disclosure with respect to certain industry practices.
In light of the above, the SEBI issued a circular4 on April 10, 2023, and decided that an Alternative Investment Fund ("AIF") may excuse its investor from participating in a particular investment only in the following circumstances: (i) if the investor, based on the opinion of a legal professional confirms that its participation in the investment opportunity would be in violation of an applicable law or regulation; (ii) if the investor of an AIF is also an AIF or any other investment vehicle, such investor may be partially excused or excluded from participation in an investment opportunity, to the extent of the contribution of the said fund/investment vehicle's underlying investors who are to be excused or excluded from such investment opportunity; or (iii) if the investor, as part of the contribution agreement or any other agreement signed with the AIF, had disclosed to the manager that, participation of the investor in such investment opportunity would contravene the internal policy of the investor. The AIF manager shall ensure that the terms of such agreement with the investor include reporting of any change in the disclosed internal policy, to the AIF, within 15 (Fifteen) days of such change.
Further, an AIF may exclude an investor from participating in a particular investment opportunity, if the manager of the AIF is satisfied that the participation of such investor in the investment opportunity would lead to the scheme of the AIF being in violation of applicable law or regulation or would result in a material adverse effect on the scheme of the AIF. The manager must record the rationale for such exclusion, along with the documents relied upon.
While AIFs generally had the flexibility to exclude or excuse investors from an investment opportunity, the said guidelines issued by SEBI standardizes the causes that can be invoked by AIFs for the same. This, in turn, reduces the possibility for discrimination and arbitrariness among investors.
Advertisement Code for Investment Advisers and Research Analysts
The SEBI, on April 05, 2023 issued an advertisement code for Investment Advisers ("IA") and Research Analysts ("RA") registered with it (the "Advertisement Code")5, which applies to all forms of advertisements including brochures, notices, research reports or any other literature, document, information or material published, or designed for use in any publication or displays in any electronic, wired or wireless communication, social media platforms etc., and all communications issued by or on behalf of an IA or an RA that may influence investment decisions of any investor or prospective investor.
IAs and RAs are now required to make certain disclosures including (i) the name, address, SEBI registration number and company identification number of the IA/RA; (ii) a standard warning stating "Investment in securities market are subject to market risks. Read all the related documents carefully before investing."; (iii) a voice-over reiteration of the said warning for all audio-visual advertisements lasting at least 10 (Ten) seconds etc. IAs and RAs are required to maintain copies of all advertisements for a period of 5 (Five) years.
Akin to the Consumer Protection Act, 2019 and rules made thereunder, as well as the Code for Self-Regulation of Advertising Content in India issued by the Advertising Standards Council of India, SEBI's Advertisement Code prohibits IAs and RAs from publishing advertisements which contain (a) information which is prohibited for publication; (b) information which is false, deceptive or based on assumptions; (c) statements which exploit the lack of knowledge of the investors; (d) any promise or guarantee of risk-free returns; (e) reference to past performance, etc.
The Advertisement Code also mandates that IAs and RAs must seek prior approval for advertisements from the BSE Administration & Supervision Ltd. ("BASL") before issue of such advertisements. IAs and RAs are, inter alia, also prohibited from engaging in in games, leagues, schemes, competitions etc., which may involve distribution of prize monies, medals, gifts, etc.
Given that the Advertisement Code is extremely broad in its ambit vis-à-vis what amounts to 'advertisements', its impact on the industry will be heavily dependent on the extent and ferocity with which the same will be enforced by the SEBI and the BASL.
Pursuant to SEBI's Advertisement Code, BASL had vide a circular dated April 27, 2023, issued the Code of Advertisement for IAs ("BASL Advertisement Code").6 The BASL Advertisement Code additionally prescribes certain additional disclosures, prohibitions and other compliances. The key provisions of the BASL Advertisement Code include inter alia (i) the prescription on IAs to conduct a due diligence to ensure compliance with SEBI's Advertisement Code and the BASL Advertisement Code; (ii) requirement for IAs to formulate an internal policy to ensure compliance by itself and its authorised persons, business partners, channel partners or influencers or bloggers etc.; (iii) prohibition on providing any form of incentives, vouchers, coupons, certificates or tokens, by whatever name called, to current or prospective clients for investment advisory account opening or any kind of subscription plan or for downloading mobile application of the IA; and (iv) prohibition on sponsoring or being associated with any scheme or league, competition, quiz, game, lottery, engagement programs with general public or clients which involves distribution of money, certificates, medals, gifts, prizes, coupons or tokens etc., or any form of incentive, monetary or otherwise which has the effect of inducing the clients to promote the IA's brand or in any manner promotes/incentivises investment.
Draft Circular on Fair Lending Practice - Penal 05 of 09 Charges in Loan Accounts
On April 12, 2023, the RBI released a Draft Circular on Fair Lending Practice - Penal Charges in Loan Accounts ("Draft Circular") inviting comments from stakeholders.
The Draft Circular contemplates that REs must ensure reasonableness and transparency in disclosure of penal interest, excluding for credit cards, which are covered under the product specific directions.7 The Draft Circular also stipulates that (i) REs must adhere to relevant regulatory instructions and not introduce additional interest rate components; (ii) penalties for noncompliance with the loan contract terms shall be treated as penal charges and must not add to the interest rates; (iii) penal charges shall be proportional to the default/ non-compliance, and the threshold shall be determined by the REs; (iv) in the case of loans sanctioned to individual borrowers, for purposes other than business, the penal charges shall not be higher than the same applicable to non-individual borrowers and REs must clearly disclose the penal charges in loan agreements, most important terms and conditions, the Key Fact Statement (KFS), in communication with borrowers, and the website; (v) whenever reminders for payment of instalments are sent to borrowers, the applicable penal charges, must also be communicated; and (vi) a Board-approved policy on penal charges must be established by the REs.
The deadline for submitting stakeholder comments closed on May 15, 2023. It remains to be seen to what extent these recommendations will be considered by the RBI while implementing the revised version of the Draft Circular.
INDUSTRY CHALLENGES
Relative Reduction in RBI's Regulatory Scrutiny of REs
The month of April, 2023 was relatively affable to the fintech sector vis-à-vis regulatory scrutiny from the RBI, unlike in recent months. However, the RBI has imposed monetary penalties on a handful of NBFCs for non-compliance with the Non-Banking Financial Company - Systemically Important Non-Deposit taking Company and Deposit taking Company (Reserve Bank) Directions, 2016 and the Monitoring of Frauds in NBFCs (Reserve Bank) Directions, 2016.8
RBI Rejects Proposal for a Self-Regulatory Organisation in the Fintech Space
Many digital payment players are reportedly pushing to set up a self-regulatory body to create common rules and standards of operation for their businesses. Reportedly, the Payments Council of India (industry body of payment players), was in talks to take on the role of such a selfregulatory body. However, after recognising that self-regulation is an effective tool,9 the RBI seems to have taken a step backwards in allowing effective self-regulation in the fintech sector and rejected the proposal of the Payments Council of India to be a self-regulatory body. According to the reports, this was because it did not comprise solely of entities regulated by it but also included unregulated fintech entities.10 The idea of creating a self-regulatory organisation was given the go-ahead by the RBI Governor in March 2023, at a conference organised by the Department of Payment and Settlement Systems.11
The National Payments Corporation of India Mandates Implementation of Advance Refund API
The National Payments Corporation of India ("NPCI") through circular dated April 19, 202312 has mandated all merchant acquiring entities i.e., banks, payment aggregators and payment service providers to (i) implement a pre-approved online refund functionality; and (ii) provide real time 'check transaction status' option to merchants from June 15, 2023. This is intended to strengthen the UPI help feature that is currently made available by third-party application providers pursuant to the RBI and NPCI's previous circular on the online dispute resolution ("ODR") system for digital payments.13
MARKET UPDATES AND MAJOR DEALS IN INDIAi
Market Updates
The startup ecosystem is facing myriad issues, including, amo her things, lengthier funding rounds and low risk appetite of investors. In that background, the sector witnessed the following pertinent developments this month:
LegalPay announces launch of 'LegalPay Max'
LegalPay, a third-party litigation financier and interim financier, has announced the launch of its pay-later product, 'LegalPay Max', that helps businesses to pay for legal services in instalments. The start-up has envisioned this product to be the next generation of payment solutions for the legal industry, and that the product was developed in response to the growing demand for free financing options in the sector.14
Fintech company Zaggle receives final observations from SEBI on proposed IPO
Additionally, Zaggle Prepaid Ocean Services Limited, a fintech – software as a service entity that is a leading player in spends management, has received final observations from the SEBI for their proposed Initial Public Offering ("IPO"). The company had earlier filed a draft red herring prospectus with the SEBI in December, 2022. It seeks to raise funds through an offer of equity shares of face value of INR 1.0 each. It has also proposed that the offer will consist of a fresh issue aggregating up to INR 490 crore (approx. USD 5,93,86,432) and an Offer for Sale aggregating up to 10,526,316 equity shares by 'Promoter Selling Shareholder' and 'Investor Selling Shareholder'. The company aims to utilise the proceeds from the fresh issue towards customer acquisition and retention, development of technology and products, payment of debt and for general corporate purposes.15
RBI announces simplification of the application process for registration of Core Investment Companies
The RBI, in early April also issued a press release to announce a simpler application process for registration of CICs. The application form has been revamped to make it structured and aligned with the extant CIC regulations, with the number of documents to be furnished along with the application form reduced to 18 (Eighteen) from the existing set of 52 (Fifty-Two) documents. However, the RBI still has the power to call for further document/s, if necessary, to satisfy itself on the eligibility of the company seeking registration as a CIC.16
SBM Bank India, blocks corporate credit cards issued to some customers of fintech partners, due to KYC issues
The wholly-owned subsidiary of State Bank of Mauritius ("SBM"), SBM Bank India ("SBM India"), has blocked the corporate credit cards issued to some of the customers of its fintech partners due to some KYC issues. SBM India has more than thirty fintech partners in India, including among other aspects, across commercial credit card/ secured corporate cards, prepaid cards, remittances, and digital lending. Under Section 22 of Banking Regulation Act, 1949, banks are mandated to keep updated records by undertaking their periodic review. Accordingly, the bank has ordered the re-KYC on some corporate credit card accounts in line with its commitment to maintaining the most compliant environment. This move comes after the RBI, in January this year, over some material supervisory concerns, had directed SBM India to stop all transactions under the Liberalised Remittance Schemes with immediate effect, until further directions. Observing that the bank initiated corrective actions, and also made a submission for relaxation of the restrictions, the RBI subsequently had extended a partial relaxation until March 15, 2023.17
Major Deals
PhonePe,ii the Walmart Inc. owned digital payments platform in India has raised USD 100 (Hundred) million from a US - based private equity firm, General Atlantic, as part of its ongoing fundraising round. In this this round of funding, PhonePe has also raised funds from Tiger Global, Ribbit Capital, TVS Capital, as well as from its parent company, Walmart. PhonePe plans to utilize the funds to strengthen its own infrastructure, develop data centres, and scale up its financial services offerings in India. It also plans to invest in new businesses, such as insurance, wealth management, Open Network for Digital Commerce ("ONDC")-based shopping, and to UPI payments in India, including UPI lite and credit on UPI.18
Niro, a fintech startup established in 2021 that provides an embedded lending platform enabling consumer internet platforms to provide customized credit offerings, closed its Series A funding round at USD 11 (Eleven) million. The round witnessed participation from its existing investor, Elevar Equity, as well as GMO Venture Partners, Rebright Partners, Mitsui Sumitomo Insurance VC, and Innoven Capital. The start-up will reportedly utilise the newly acquired funds for product development and expansion, as well as for scaling up their technology stack.19
Avanti Finance, a technology-led NBFC, raised USD 24 (Twenty-Four) million in funding from Rabo Partnerships and IDH Farmfit Fund, with its existing investors Oikocredit and NRJN Trust also joining the fundraise. The NBFC uses a digital delivery model based on a paperless, presence-less and cashless approach to lending, aimed at reducing costs for unserved segments, especially in rural India. Avanti plans to use the funds to, amongst other things, enhance its deep-tech platform, develop fit for purpose hyperlocal credit products, automated data and social signals driven underwriting for data-dark customers, as well as expand its partnerships.20
Uni Cards, a fintech startup, has acquired a peer-topeer lending platform 'OHMY Technologies' (known as OMLP2P) ("OML"), which is registered as an NBFC-P2P with the RBI. The value of the acquisition while unconfirmed, is reportedly estimated to be in INR 3-4 crores range (approx. USD 3,63,581 – USD 4,84,775). The founders of Uni Cards, Nitin Gupta, Laxmikant Vyas and Prateek Jindal, have joined the Board of Directors of OML.21
Deciml, a fintech startup that provides an application to automate investment processes through round-up investing, raised a bridge round of funding from a host of investors including Zakir Khan, Viraj Sawant, Abhishek Oswal, Chirag Chetan Gandhi, Hemant Ruprell, Shashank Deshpande, Sandeep Kumar Chawda and Blaze Management Labs LLP. This comes after the startup had raised USD 1 (One) million in a pre-seed round in June 2022. The startup is set to use the funds for product expansion, geographical expansion and development of its technology stack.22
Footnotes
1. To the extent any transactions involve clients of IndusLaw, the information herein is based on statements in the media and not our professional knowledge of the relevant transaction.
2. INDUSLAW advised PhonePe in this deal
1. https://www.moneycontrol.com/news/business/startup/pevc-funding-to-indian-startups-falls-77-in-february-2023-10172811.html
2. https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=12486
3. https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=11566
4. SEBI | Guidelines with respect to excusing or excluding an investor from an investment of AIF
7. Reserve Bank of India - Database (rbi.org.in)
8. https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=55481; https://www.rbi.org.in/Scripts/BS_ PressReleaseDisplay.aspx?prid=55478
9. Self-regulation useful tool for setting rules for fintechs: RBI's M K Jain (business-standard.com)
10. fintech rbi: Fintech firms struggle to come together for self-regulation - The Economic Times (indiatimes.com)
11. https://economictimes.indiatimes.com/tech/startups/fintech-firms-struggle-to-create-common-rules-for-epayments/ articleshow/99648380.cms
12. NPCI-UPI-OC-165-Implementation-of-advanced-refund-API-as-part-of-UPI-Help-(UDIR).pdf
13. Reserve Bank of India - Notifications (rbi.org.in)
14. https://m.economictimes.com/industry/banking/finance/legalpay-launches-indias-first-pay-later-product-for-legal-expenses/ articleshow/98963737.cms
16. https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=55494
17. https://inc42.com/buzz/sbm-bank-indias-fintech-partners-in-a-fix-over-kyc-notice/
18. https://economictimes.indiatimes.com/tech/funding/phonepe-bags-another-100-million-from-general-atlantic/ articleshow/99431296.cms
19. https://m.economictimes.com/tech/funding/fintech-startup-niro-raises-11-million-from-elevar-equity-others/ articleshow/99842040.cms
21. https://inc42.com/buzz/fintech-startup-uni-cards-acquires-p2p-lending-platform-ohmy-technologies/
22. https://www.entrepreneur.com/en-in/news-and-trends/micro-investing-platform-deciml-raises-bridge-funding-round/450241
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
