Compliance in an Indian deal: what gets checked, and who answers for it

Compliance runs both ways in an Indian deal. Diligence tests the company’s past filings and approvals, and the bankers and fund managers running the deal answer to rules of their own.

Advisors report that investor diligence on an Indian funding round runs as six parallel workstreams (legal, financial, tax, regulatory, IP and HR) within the 45 to 60 day exclusivity window typical of term sheets (Treelife, Financial due diligence checklist for startups, June 2026).

Filings and approvals

Advisors report that missing FEMA filings from earlier rounds are the most common serious finding in secretarial diligence on Indian startups. They also report that diligence tests these deadlines: Form FC-GPR within 30 days of allotting shares to a foreign investor, and Form FC-TRS within 60 days of a share transfer between a resident and a non-resident (Treelife, Secretarial documents for a funding round data room, June 2026). Have each filing and its acknowledgement ready before the investor asks.

Separately, the RBI Master Direction on Foreign Investment in India (updated 15 June 2026) requires a company that receives money from a foreign investor to issue the shares within 60 days, or refund the money.

Diligence also asks who stands behind each foreign investor. Press Note 3 of 2020 (PIB) put investors from land-border countries, or with beneficial owners there, on the Government route. DPIIT’s Press Note 2 (2026 Series), dated 15 March 2026, now ties “beneficial owner” to PMLA thresholds; below them, the investment is reported to DPIIT before remittance instead of needing approval. The change took effect through the FEM (NDI) Amendment Rules of 1 May 2026 (DPIIT, SOP for processing FDI proposals, 4 May 2026).

On larger M&A, the Competition (Amendment) Act, 2023 requires CCI notification where the deal value exceeds ₹2,000 crore and the target has substantial business operations in India, a test in force since 10 September 2024.

Rules the deal team works under

Since 10 February 2025, reg 16C of the SEBI (Intermediaries) Regulations, 2008 (consolidated to 16 April 2026) has made SEBI-regulated persons solely responsible for the AI tools they use, including third-party tools, for data privacy, outputs and compliance. That covers merchant bankers and AIF investment managers.

Where a deal involves a listed company’s unpublished price-sensitive information, the SEBI (Prohibition of Insider Trading) Regulations, 2015 (amended to 12 March 2025) require a structured digital database of who it was shared with. It “shall not be outsourced and shall be maintained internally”. The same Regulations require it to be preserved for at least eight years after the relevant transactions.

And since 3 January 2026, under the SEBI (Merchant Bankers) Regulations, 1992 (consolidated to 5 December 2025), a merchant banker “shall not outsource its core merchant banking activities”, due diligence and offer-document preparation among them.

Each duty stays with the firm the rule names, not with its vendors.

About CADO

CADO is an AI-native data room specialising in Indian deals. It matches uploads to the India due-diligence checklist for the deal’s stage and industry and flags missing mandatory documents. Its AI agents answer from the room’s documents and cite the page, slide or spreadsheet row. Whether a filing was made, and on time, is for you and your advisors to judge.