1. The Fintech Landscape

1.1 Please describe the types of fintech businesses that are active in your jurisdiction and the state of the development of the market, including in response to the COVID-19 pandemic. Are there any notable fintech innovation trends of the past year within particular sub-sectors (e.g. payments, asset management, peer-to-peer lending or investment, insurance and blockchain applications)?

Since India’s economic liberalisation, the information technology industry has shown significant growth and prominence in both domestic and offshore markets. As a natural progression, this sector has challenged traditional financial systems and has created a sub-financial sector, commonly referred to as the “fintech” market. India’s financial regulator, the Reserve Bank of India (“RBI”), provided regulatory recognition of this innovation by enacting the Payment and Settlement Systems Act, 2007 (“PSSA”), which covers payment systems and recognised activities involving payment, settlement and clearing.

Since the introduction of the PSSA, a number of “non-banking” or “non-financial” institutions, including global players, obtained registrations to establish and operate payment networks in India. This resulted in multiple market innovations, including the creation of the National Payment Corporation of India (“NPCI”), the launch of the RuPay card network and the National Financial Switch. Additionally, Indian consumers more regularly interact with pre-paid payment instruments that affect the cashless/cardless transfer of funds between peers and merchants via “e-wallets”, “tokens” and “points”. This burgeoning pre-paid market, presently, provides an alternative to traditional payment modes, whilst guaranteeing security and handling both small and high-value transactions for service providers/merchants.

As a follow-up, in 2015, the regulator issued Guidelines for Online Payment Gateway Service Providers (“OPGSP”) to regulate cross-border payment processing of cross-border sale of goods and services (or settlement of import/export-related payments affected over websites/apps).

In 2020, the RBI issued the Guidelines for Payment Aggregators and Payment Gateways, pursuant to which payment aggregators, (entities facilitating e-commerce sites and merchants to accept various payment instruments from customers for completion of their payment obligations without the need for merchants to create a separate payment integration system of their own) are now required to obtain a licence from the RBI. Significantly, unlike payment aggregators, these guidelines permit payment gateways (i.e., entities providing technology infrastructure to route and facilitate processing of an online payment transaction without any involvement in handling of funds) to operate without a licence and recommend certain baseline technology considerations (though not mandatory). A licence applicant is required to be an Indian entity, meet “fit and proper” criteria stipulated by the RBI, and comply with prescribed net-worth requirements.

In addition, artificial intelligence and blockchain applications have increasingly been incorporated in financial services, with several banks and financial institutions having entered into partnerships with technology firms to incorporate artificial intelligence and blockchain applications in their products/ services and internal systems.

While due to COVID-19, there were initial apprehensions regarding the growth of financial services in India, there still continues to be significant growth in services such as digital banks, standalone platforms operating in conjunction with licensed banks, payment aggregators and processors, and digital financial services. Publicly available market analysis indicates that these businesses will continue to see a rise in investor confidence, with their products/services being customer-centric, and which can withstand disruptions or are reactive to the pandemic, most notably seen in insure-tech and prop-tech companies.

1.2 Are there any types of fintech business that are at present prohibited or restricted in your jurisdiction (for example cryptocurrency-based businesses)?

Whilst there is no fintech business that is per se prohibited, between 2018–19, the RBI had, via its circular dated April 6, 2018, banned all financial institutions from dealing in cryptocurrency. It is understood that in 2019, the Government had prepared draft legislation seeking to ban mining, generating, holding, selling, dealing in, issuing, transferring, disposing of or using cryptocurrency in the territory of India. While the draft legislation was yet to be enacted by Parliament, in March 2020, the Supreme Court struck down the RBI’s ban on cryptocurrency.

Currently, the Government is contemplating similar legislation (“The Cryptocurrency and Regulation of Official Digital Currency Bill, 2021” or “2021 Bill”) which will regulate cryptocurrency and may prohibit private cryptocurrencies. The 2021 Bill is yet to be introduced in Parliament, though, based on news reports, this is imminent. Pending the introduction of any specific legislation, the legality of cryptocurrency in India remains an open question.

While clarity is awaited, public sources suggest that the Ministry of Finance recognises the benefit of blockchain technology and may provide private players a window to “experiment” with blockchain and cryptocurrencies.

2.  Funding for Fintech

2.1. Broadly, what types of funding are available for new and growing businesses in your jurisdiction (covering both equity and debt)?

In order to raise financing, typically, most entities within India source their funds privately through angel investors or private equity funds, and in limited cases, through crowdfunding. Alternatively, depending on the stage of growth or size of the organisation, funds may also be raised pursuant to an initial public offering. In light of the revised foreign exchange regulations, today, most sectors permit 100% foreign investments without obtaining any approvals. Recently, there have also been relaxations introduced for foreign portfolio investors, such as an increase in the short-term investment limits in Central Government securities (including treasury bills), state development loans, and corporate bonds from 20% to 30% of the total investments and an increase in the cap on investment under the voluntary retention route to INR 75,000 crore.

2.2 Are there any special incentive schemes for investment in tech/fintech businesses, or in small/ medium-sized businesses more generally, in your jurisdiction, e.g. tax incentive schemes for enterprise investment or venture capital investment?

Along with tax relaxations/deductions available to start-ups, the RBI and the Central Government have undertaken significant steps to specifically incentivise tech/fintech firms. This has been illustrated by moves such as demonetisation, tax rebates, reduction in transaction costs, or by subsidising the merchant discount rates on all low value payments (i.e., below INR 1,000), thereby accelerating a shift from paper to electronic payment. Similarly, initiatives such as the Trade Receivables Discounting System have promoted online bill discounting platforms such that small and medium enterprises may raise funds by facilitating an online sale of their trade receivables. Despite only three entities obtaining a licence to operate this platform, per public sources, these licensed entities have projected a turnover of over INR 25,000 to INR 30,000 crore for the coming financial year. Bodies such as the NPCI have further expanded the network system by floating the unified payment interface that has inadvertently resulted in the top technology service providers integrating payment functionalities into their platforms, thereby further boosting peer-to-peer payment modes. RBI has also released the framework for authorisation of pan-India umbrella entity for retail payments, which will rival NPCI, on August 18, 2020, for which applications may be submitted until March 31, 2021. The new umbrella entity (“NUE”) may set up, manage, and operate payment systems such as ATMs, Point of Sale, Aadhaar-based payments and remittance services, and be interoperable with existing systems operated by NPCI. NUEs have to, inter alia, ensure a minimum net worth of INR 500 crore at all times, that the promoters are Indian- owned/-controlled, etc. On the basis of public reports, certain consortiums led by India’s largest banks and/or corporate houses are in the fray to apply for such authorisation to operate an NUE.

2.3 In brief, what conditions need to be satisfied for a business to IPO in your jurisdiction?

In order to undertake an initial public offering (“IPO”), a company is required to meet the eligibility criteria set out under the Securities Exchange Board of India (“SEBI”) (Issue of Capital and Disclosure Requirements) Regulations, 2018 (as amended from time to time). This includes meeting prescribed financial thresholds through its own sources or undertaking a book-building process. Additionally, the business has to ensure that its directors/promoters are not debarred from accessing capital markets or are wilful  defaulters/economic fugitives, no outstanding convertible securities exist that would provide the holder an option to receive equity shares (unless such option is through an employee stock option or are securities to be converted before the day of filing of the red herring prospectus) and the minimum prescribed number of securities is offered to the public.

2.4 Have there been any notable exits (sale of business or IPO) by the founders of fintech businesses in your jurisdiction?

Some notable exits include the exit of the founders of PayU, an online payment service provider, through its brand “LazyPay”. This entity received an approximate investment of INR 900 crore from Naspers in 2016; however, in 2019, its founders left to explore new opportunities within the fintech segment. One of its founders is also floating a new venture, Jupiter.money, to provide banking services as a “neobank” to commence operations in 2020. NestAway, a leading business in the rental home segment, also saw the exit of two cofounders within three months of its incorporation. The last year has also seen significant moves from the tech industry to private equity funds, such as the exit of Google’s South East Asia vice president to join Sequoia Capital India, as its managing director, as well as large-scale IPOs for entities such as (i) SBI Cards and Payments Services (i.e., a subsidiary of India’s largest commercial bank) in March 2020, with an IPO size of approximately INR 10,000 crore, (ii) Angel Broking IPO (which provides broking and advisory services, margin funding, loans against shares and financial products distribution through an online platform) in September 2020 for an IPO size of approximately, INR 600 crore, and (iii) Route Mobile (which provides cloud-communication as a service to enterprises, over-the-top (OTT) players and mobile network operators) in September 2020, for an IPO size of approximately INR 600 crore.

3   Fintech Regulation

3.1 Please briefly describe the regulatory framework(s) for fintech businesses operating in your jurisdiction, and the type of fintech activities that are regulated.

Whilst there is no single ombudsman regulator for fintech businesses, most fintech businesses would fall under the purview of the RBI. In addition to the RBI, depending on the nature of activity sought to be regulated, or on the third party with which a fintech entity would interact, regulators such as the SEBI, Ministry of Electronics and Information Technology, the Insurance Regulatory and Development Authority of India (“IRDAI”) and the Ministry of Corporate Affairs would also have oversight.

As stated above, businesses engaged in peer-to-peer lending, or cross-border payment processing for current account transactions would require businesses to obtain specific licences from the RBI. Whilst there may not be formal legislation addressing certain fintech activities, certain aspects may be regulated or proposed to be regulated. For instance, in the case of open banking, whilst there is no formal regulation, the RBI Master Directions on Account Aggregator, dated September 2, 2016, regulate activities such as account aggregation, which is a key facet of open  banking. Similarly, the RBI has also sought industry views on the potential regulation of payment service providers. Alternatively, if the activity is not itself regulated, some fintech businesses, such as consumer lending, invoice discounting or foreign exchange trading, can only be undertaken by regulated entities such as non-banking financial institutions and/or adhere to data protection norms, etc.

3.2 Is there any regulation in your jurisdiction specifically directed at cryptocurrencies or cryptoassets?

The Government had prepared draft legislation, i.e., the “Banning of Cryptocurrency and Regulation of Official Digital Currency Act, 2019”, which sought to ban any person from mining, generating, holding, selling, dealing in, issuing, transferring, disposing of or using cryptocurrency in the territory of India; however, this legislation was not tabled and enacted by Parliament. Between 2018–19, the RBI had temporarily created a block on any dealing in cryptocurrency by banning all financial institutions from dealing in cryptocurrency. However, this directive was subsequently quashed by the Indian Supreme Court. With this background, presently, the Government is proposing to introduce legislation (a draft of which is not currently available publicly) which may regulate and/or prohibit dealing in private virtual currencies. As indicated above, pending the introduction of any specific legislation, the legality of cryptocurrency remains an open question.

3.3 Are financial regulators and policy-makers in your jurisdiction receptive to fintech innovation and technology-driven new entrants to regulated financial services markets, and if so how is this manifested? Are there any regulatory ‘sandbox’ options for fintechs in your jurisdiction?

The rapid growth of the fintech industry in India is a testament to the encouragement provided to industry participants by regulators. Every key regulator, i.e., the RBI, SEBI, IRDAI and the Pension Fund Regulatory and Development Authority (“PFRDA”), has issued draft guidelines and, in the case of RBI and SEBI, operationalised regulatory sandboxes in order for fintech businesses to live test their innovations in a controlled regulatory environment, whilst providing exemptions of liquidity requirements, corporate compliances, credit record, financial soundness, management experience, etc. Some key identified themes include retail payments, money transfer services, marketplace lending, digital KYC, financial advisory services, wealth management, digital identification, smart contracts, etc. These sandboxes have been designed to be short term (i.e., between six and seven months) such
that multiple sandboxes with various themes may be operationalised. In fact, the RBI has already announced two cohorts, the first on retail payments, and the second on cross-border payments. In addition to sandboxes, it is evident from the Government’s budget policies and the regulator’s policy decisions that it seeks to support innovation. Nascent technologies, such as Blockchain is one such example. Currently, not only are private parties being invited by the Government/financial institutions to operationalise authentication services by deploying Blockchain, but the Government itself has set up working groups to test potential applications on the technology.

3.4 What, if any, regulatory hurdles must fintech businesses (or financial services businesses offering fintech products and services) which are established outside your jurisdiction overcome in order to access new customers in your jurisdiction?

In light of the Government’s initiative to incentivise businesses locally, a key barrier for most offshore fintech businesses operating within the payment ecosystem, is undertaking steps to localise their business/operations and locally store payments data. These measures can often include significant costs on the offshore entity. Despite localisation measures, the Government has ensured that foreign investors can completely own and control locally incorporated companies and therefore an investor can penetrate the Indian market with ease. Significantly, in April 2020, the Government issued press note 3 of 2020, wherein foreign investors sharing a land boundary with India, such as investors situated in China, Hong Kong, Nepal, Pakistan, etc., or having beneficial ownership from any entities/individuals that are citizens of countries
sharing a land boundary, would require approval from the Indian Government prior to making any investment (including in sectors that otherwise permit 100% investment by foreign investors).

4  Other Regulatory Regimes / Non-Financial Regulation

4.1 Does your jurisdiction regulate the collection/use/transmission of personal data, and if yes, what is the legal basis for such regulation and how does this apply to fintech businesses operating in your jurisdiction?

Pursuant to the (Indian) Information Technology Act, 2000 (“IT Act”), any collection, disclosure or transfer of personal data that would include details such as an email address, password or financial data such as bank account details would require the owner’s consent. Irrespective of the nature of the entity or the operations it undertakes, in the event such information is either collected, disclosed or transferred, every entity undertaking this activity would be required to do so with consent, which may be obtained pursuant to a legally binding contract.

4.2 Do your data privacy laws apply to organisations established outside of your jurisdiction? Do your data privacy laws restrict international transfers of data?

Given that the IT Act has extra-territorial jurisdiction, it is possible for its provisions to be made applicable to offshore entities, including in case of a data breach. Further, whilst the IT Act does not restrict international transfer of personal data, in case of payments data, payment system providers are required to store such data of domestic transactions within India only. In case of cross-border transactions, a copy of the transaction may be stored overseas; however, a domestic copy must also be stored. Parliament had also proposed a specific data protection law (“Data Protection Bill”) that is presently under review by the joint parliamentary committee (“JPC”). Upon the completion of review by the JPC, it is anticipated that a revised draft of the legislation would be introduced in the Parliament (though such draft legislation is not presently available in public). However, per the Data Protection Bill (i.e., the erstwhile legislation), sensitive personal data, i.e., health data, or other data including financial data, that identifies a person, will be required to be stored in India by all entities and not just financial institutions. Further, the aforementioned legislation also provided the Government broad discretion to identify “critical data”, which would have to be processed in India and cannot be transferred outside India unless the same is for the provision of health services or emergency services and prompt action is required, or to a country or, any entity, etc., where the Government has deemed that the transfer does not prejudicially affect the security and strategic interest of India. In addition to the above, the Government is also contemplating introducing regulations for “non-personal data”; however, these terms, along with the Data Protection Bill, are still under consideration.

4.3 Please briefly describe the sanctions that apply for failing to comply with your data privacy laws.

The IT Act has provided for both civil and criminal consequences for breach of its provisions and underlying rules as well as failure to undertake specific prescribed actions. For instance, in the event of a data breach, a failure to report such breach to the Indian Computer Emergency Response Team (“CERT”) would attract a penalty of INR 5,000 (approx. USD 68) per day of such violation. Similarly, in case CERT requires the entity to provide requisite information and the entity fails to do so, such entity could attract a penalty of INR 100,000 (approx. USD 1,343). In addition to monetary penalties imposed, in the event that a case of negligence in maintaining reasonable security practices is proved, the entity would also be required to compensate any persons affected by such negligence. Similarly, any person who has received personal data, pursuant to a contract, with the intent to cause, or knowing it could likely cause, wrongful gain/loss, and discloses such information without consent or in breach of the contract, would be punished with imprisonment for a term that may extend to three years or a maximum fine of INR 500,000 (approx. USD 6,717). The Data Protection Bill had in fact prescribed a higher penalty for offences such as processing or transferring personal data in violation of such legislation, being punishable with a fine of the higher of INR 150,000,000 or 4% of the annual turnover. Similarly, a fine of the higher of INR 50,000,000 or 2% of the annual turnover will be imposed in case of failure to conduct a data audit. In fact, processing any de-identified data without consent is punishable with a three-year imprisonment term with or without a fine. However, it is anticipated that the JPC could revise the aforementioned penalties on completion of their review of the Data Protection Bill. As of the time of writing, such revised legislation has not been made public or placed before Parliament.

4.4 Does your jurisdiction have cyber security laws or regulations that may apply to fintech businesses operating in your jurisdiction?

In India, cyber security, i.e., data protection, is specifically regulated under the IT Act. Accordingly, every body corporate, including fintech businesses, is required to adopt appropriate data protection measures, such as adopting international security standards to ensure that there is no data breach. Further, in the event of a data breach, every body corporate is required to report such data breach to the CERT and take necessary corrective measures to resolve the same.

4.5 Please describe any AML and other financial crime requirements that may apply to fintech businesses in your jurisdiction.

The Prevention of Money Laundering Act, 2002 (“PMLA”) is the primary legislation that prohibits money laundering/financial crimes. All reporting entities are required to maintain necessary records to furnish the same to authorities periodically to ensure that their systems are not being used for such prohibited activities. In addition to the PMLA, most entities dealing with financial information are required to undertake KYC checks.

4.6 Are there any other regulatory regimes that may apply to fintech businesses operating in your jurisdiction?

In addition to the IT Act, every organisation, including those undertaking fintech operations, will be required to comply with entity specific legislation, such as the (Indian) Companies Act, 2013 and foreign exchange regulations in case such an organisation has received foreign investment.

5  Accessing Talent

5.1  In broad terms, what is the legal framework around the hiring and dismissal of staff in your jurisdiction? Are there any particularly onerous requirements or restrictions that are frequently encountered by businesses?

There are no general criteria that have been prescribed for hiring and appointment can largely be determined based on criteria set out by the recruiting entity, subject to meeting prescribed thresholds of minimum wage and age, and adhering to anti-discrimination laws such as the Equal Remuneration Act, 1976 and the Rights of Persons with Disabilities Act, 2016. The dismissal of employees would be governed by the terms of the employment contract, central statutes, and/or state-specific statutes. Indian employment laws regarding termination vary depending on a number of factors, including the type of work performed by the employee, the state in which the employee is located and the business of the employer. Depending upon the nature of the employee, i.e., skilled or non-skilled/workmen, laws such as the Industrial Disputes Act, 1947 and state-specific shops and commercial establishments aw may be applicable and require that adequate notice and statutory severance compensation is provided to eligible employees at the time of termination from employment. Additionally, the Government has consolidated various central employment law statutes into four labour codes; viz., the Industrial Relations Code, 2020, the Code on Social Security, 2020, the Occupational Health, Safety and Working Conditions Code, 2020 and the Code on Wages, 2019. The codes are not yet in effect and it is understood from information in the public domain that they are likely to be brought into effect in April 2021. Organisations would also be required to adhere to the requirements set out under these codes once they are implemented.

5.2 What, if any, mandatory employment benefits must be provided to staff?

The requirement to pay statutory employment benefits varies based on a number of factors, including the industry of the employer, number of employees in the establishment and service period of the employee. General statutory employment benefits include payment of gratuity, social security contributions (i.e., provident fund and employee state insurance contributions),
leaves (including earned, casual and sick leaves), maternity benefits, etc.

5.3 What, if any, hurdles must businesses overcome to bring employees from outside your jurisdiction into your jurisdiction? Is there a special route for obtaining permission for individuals who wish to work for fintech businesses?

Transfer of employees is typically undertaken contractually subject to ensuring that such transfer is in accordance with immigration and taxation laws. Commonly, the biggest hurdle lies in ensuring necessary work permits/visas are obtained for such employees. In order to receive an Indian employment work visa, the applicant should be a highly skilled and/or qualified professional being engaged at a senior/skilled position and therefore a work visa will not be granted for routine, ordinary or clerical positions. In the event that an employer seeks to appoint such employee, he must also ensure that the employee’s salary is in excess of USD 25,000 per year, unless the position is specifically exempted from meeting this requirement.

6  Technology

6.1 Please briefly describe how innovations and inventions are protected in your jurisdiction.

India, being a signatory to the Agreement on Trade-Related Aspects of Intellectual Property Rights, has established a robust intellectual property (“IP”) rights regime pursuant to the Patents Act, 1970, Copyright Act, 1957, Designs Act, 2000 and Trademark Act, 1999, along with recognition being provided under the creator’s moral/common law rights. Each of these pieces of legislation seek to identify the true creator/author of the product and thereafter provide protection depending upon the uniqueness of the innovation. Specifically vis-à-vis technology, ordinarily protection under copyright, trademark and design laws is provided. However, a patent protection is often difficult to obtain since an algorithm, mathematical or business method or computer program is not per se considered patentable subject matter in India.

6.2 Please briefly describe how ownership of IP operates in your jurisdiction.

In addition to the specific rights provided to the IP owner, pursuant to its copyright, patent or trademark, etc., moral rights and contractual ownership rights are also protected. For instance, an author/inventor can transfer its ownership rights of a product to a third party. Similarly, any copyrightable work created through the course of employment automatically bestows the IP rights in favour of the employer subject to the absence of a contract to the contrary. In transactions involving copyright, it is critical to ensure that the original author has waived all his/her moral or special rights, ensuring that any rights transferred via the contract, and the enjoyment in the transferred intellectual property is not disturbed by such author.

6.3  In order to protect or enforce IP rights in your jurisdiction, do you need to own local/national rights or are you able to enforce other rights (for example, do any treaties or multi-jurisdictional rights apply)?

National rights obtained pursuant to registrations with appropriate government authorities are robust in themselves to protect IP. In India, pursuant to the Intellectual Property Rights (Imported Goods) Enforcement Rules, 2007, the Government has set up an electronic recordal system by its customs authority to ensure that local IP rights are further protected. Pursuant to this system, no imported goods that infringe on the owner’s copyright, trademark or design rights will be imported. Therefore, to a large extent, the IP owner remains protected without having to undertake active prosecutions against imported infringing products. Further, in compliance with India’s obligations under the TRIPS Agreement dated January 1, 1995, the Trade Marks Act, 1999 introduced the concept of well-known marks into Indian trade mark law. This Act lays down a non-exhaustive list of factors for determination of the well-known status of a trade mark and broadly, these factors clarify that the well-known status of trade mark in India should not be contingent upon its direct use or registration in India. Courts in India would accept evidence on the knowledge of a foreign mark amongst the relevant Indian consumers, in order to uphold the trans-border reputation of the foreign claimant in its marks.

Copyright of “works” of foreign nationals, whose countries are member of convention countries to which India is a signatory, are protected against any infringement of their “works” in India through the International Copyright Order, 1999.

6.4 How do you exploit/monetise IP in your jurisdiction and are there any particular rules or restrictions regarding such exploitation/monetisation?

Depending upon the extent to which the IP owner is looking to transfer/share its rights, such IP may be monetised pursuant to an outright sale or limited licence/sub-licence right provided to a third party. A licence is beneficial in that the holder can retain its primary rights to the IP, whilst still creating a lucrative revenue stream by means of royalties or other profit-sharing arrangements. Additionally, the holder may also use its IP as collateral to obtain financing or similar return.

Disclaimer
This content is not intended to be an advertisement or solicitation. The contents of this update are solely meant to inform and are not a substitute for professional advice. Legal advice should be obtained based on the specific circumstances of each case, before relying on the contents of this update or prior to taking any decision based on the information contained in this update. AZB & Partners disclaim all responsibility and accept no liability for the consequences of any person acting, or refraining from acting, on such information.

Authors:

Srinath Dasari, Senior Partner
Vipul Jain, Partner
Rachana Rautray, Associate