INDIA: An Introduction to FinTech Legal

Chambers PA: Fintech 2023: Overview  

India: Fintech Legal  

The investment landscape and growth of the fintech sector

The fintech sector in India is now one of the fastest growing globally with nearly five thousand start-ups and 22 unicorns in the space. Business models and investments in this space have now diversified and expanded beyond back-end technologies and digital payments, to cover more financial services such as lending, insurance, brokerage, mutual funds distribution, and wealth management. The expansion of the fintech sector has, in large part, been fuelled by technology innovation, reducing data costs, higher smartphone penetration, better digital infrastructure and a generally fintech-friendly regulatory environment in India. While experiments of home-grown fintech giants saw a tepid response from the public markets, venture backing in the sector too seems to have plateaued to a marginal increase of about 3% in funding over the past few quarters even though the volume of deals has increased by about 30%. That said, the fintech market remains optimistic of growth with projections indicating up to a fourfold increase in the sector’s valuation in the short to mid-term.

Steps taken by the Government to boost investments in the fintech sector

The Indian Government has taken several steps over the years to encourage foreign investment into the fintech sector and make the process of investments less tedious. One of the major steps was taken in 2016, wherein the Reserve Bank of India (“RBI”) and the Department for Promotion of Industry and Internal Trade (“DPIIT”) liberalised the Foreign Direct Investment (“FDI”) regime in relation to the financial services sector, allowing 100% FDI under the automatic route (ie, not requiring any prior approval from the Indian Government) for the category of ‘other financial services’. This opened an avenue for all entities engaged in financial services and regulated by any financial regulator in India, to attract foreign investment. Subsequently, the minimum capitalisation norms for ‘other financial services’ activities were prescribed for ‘fund based’ and ‘non-fund based’ activities respectively (even if unregulated); this development paved the way for fintech entities to receive investments from across the globe.

In the last decade the government has played an important role in developing the underlying digital infrastructure that has supported the growth of fintech, obviating the need for private players to build an infrastructure of their own. This includes a wide-ranging technology stack comprising of the Aadhaar and e-KYC, the unified payments interface and other payment platforms of the National Payments Corporation of India, DigiLocker, eSign, the Open Credit Enablement Network and the account aggregator framework.

The Indian Government has also developed a regulatory framework for establishing International Financial Services Centres (“IFSCs”) in India (within the jurisdiction of a single regulator, ie, the International Financial Services Centres Authority “IFSCA”). IFSCs have been envisioned as financial services special economic zones with entities registered therein legally deemed as foreign entities, for providing financial services to resident and non-resident participants in a foreign currency (ie, not Indian Rupee). The IFSC regime allows investors to route investments into India seamlessly, without having to comply with the foreign exchange controls otherwise applicable in India. More recently, the IFSCA has introduced comprehensive and business-friendly regulations governing capital markets, insurance and funding vehicles, among others which stand completely equivocal to domestic Indian laws.

Further, multiple initiatives have been rolled out across regulatory domains for the financial, securities and insurance sectors, that include market studies, regulatory sandboxes, innovation schemes, incubation and funding support, to enable testing of new technology-driven products, services and business models for these markets in a controlled regulatory environment. This together with the consultative process being generally adopted by regulators in this sector prior to the introduction of any new laws, have allowed industry players to play a more active role in the development of the regulatory framework for the fintech sector in India.

Regulatory approach in India towards fintech 

In addition to the FDI regime, the general regulatory approach in India has also been largely conducive to support the growth of fintech, with the underlying policy objectives of the Indian Government to attain a ‘less-cash’ economy and drive financial inclusion across cities and demographics.

Until recently, a portion of this sector had been operating at the brink of or outside the regulatory regime applicable to banking and financial services, by virtue of positioning themselves as third-party technology enablers operating ‘over the top’ of licensed entities. With increasing fintech penetration, together with the growing inter-play between regulated and unregulated players (discussed below), Indian regulators have taken cognisance of the emerging risks and regulatory gaps, and accordingly have been working towards effectively dealing with this dynamically evolving industry. Accordingly, the RBI recently issued the Digital Lending Guidelines (“DLG”) , which effectively coordinate regulated entities such as non-banking companies, specifically with regard to interactions with unregulated “lending service providers” (“LSPs") (ie, fintechs that usually provide services to regulated lenders such as customer acquisition, marketing etc) in the digital lending space. The DLG placed special emphasis on sharing of responsibilities and risks between such LSPs and regulated lenders and includes restrictions on handling of funds by unregulated entities, levy of charges on the borrower by such LSPs, data privacy practices of both LSPs and regulated entities, among other requirements. Most notably, the DLG prohibits regulated entities from sharing of credit risk with LSPs through synthetic securitisation measures, which was the industry norm thus far. While the industry has acquiesced to comply with the DLG, the question of alternatives for such synthetic securitisation measures has created a panic.

Separately, specific regulatory frameworks have developed in the last three years to govern different fintech activities – including for online payment intermediaries, digital wallets, small payment banks, peer-to-peer digital lending platforms, and account aggregators. These new regulations broadly mimic the existing laws, albeit aligned to the technological and industry changes being seen in the sector, and are indicative of the regulators increasingly blurring the distinction between traditional banks and non-bank fintech entities – for instance, with non-bank entities now being permitted to issue full-KYC digital wallets and use the Aadhaar-based e-KYC facility for on-boarding and authentication. These regulatory developments are in addition to the increased indirect regulatory governance of fintech entities through more onerous ‘outsourcing’ norms now applicable to regulated financial institutions and payment system operators. Further, the RBI seems to have taken a proactive approach in regulating the fintech space by introducing new legal regimes and providing clarifications regarding the legality of industry practices from time to time, which sometimes results in a tectonic shift in existing market practice. While a proactive regulator is advantageous to the sector, such clarifications may lead to volatility in the market given the impact on generally accepted business models in the industry.

The digital payments space is the most developed fintech category in India, including in terms of the regulatory developments. For instance, the RBI has recently updated and consolidated the existing regulation on credit cards and debit cards through the Master Direction – Credit Card and Debit Card – Issuance and Conduct Directions. While these directions generally govern the card business as a whole, new provisions governing the roles and responsibilities of fintechs that issue co-branded cards is important to take note of. Additionally, with significant growth in the adoption of digital payments across India, there is now an increased regulatory focus on consumer protection, data security and anti-money laundering. This is alongside increased focus on consumer-centric initiatives through making online payments more affordable, mandating and incentivising interoperability in digital payment systems, enhancing the grievance redressal structures, and deployment of more digital payments acceptance infrastructure. The above is evident from recent regulatory developments and enforcement around the changes to the extant guidelines for online payment intermediaries and digital wallets, e-mandate framework containing safeguards relating to ‘recurring’ online transactions, data localisation norms for payment-related data, prohibition on storage of card-on-file data, the expanding tokenisation framework, introduction of cyber security controls, and KYC, CFT and AML norms. Further, other regulatory requirements arising from the Ministry of Electronics and Information Technology under the Information Technology Act, 2000 and rules thereunder such as the guidelines issued by the Indian Computer Emergency Response Team (CERT-In), providing for the specific cybersecurity-related directions for reporting and maintaining records of cybersecurity incidents in India too would have to be factored in by the fintech sector.

These changes, although aimed at improving consumer welfare and are steps in the right direction over the long-term, are inevitably increasing the compliance burden and costs for digital payment companies. That said, the RBI is contemplating the introduction of charges in the payment space along with stricter regulation of merchant discount rates (MDR) chargeable by acquirers on merchants accepting digital payments. The direction that RBI takes in this is yet to be seen.

Although the RBI is the key regulator for most fintech activities in banking, payments and lending, there is jurisdictional overlap with the Securities and Exchange Board of India (“SEBI”) when dealing in or advising on securities, the Insurance Regulatory and Development Authority of India (“IRDAI”) for insurance products and services, as well as the rapidly growing Ministry of Electronics and Information Technology (MEITY) in relation to data protection.

In this backdrop, the Financial Stability and Development Council of India has recently constituted a new inter-regulator panel, including officials from the RBI, the SEBI, and the IRDAI, to seek better regulatory co-ordination to deal with fintech companies. Additionally, frameworks for self-regulatory industry organisations that will be recognised by the RBI are also being developed, including for the Self-Regulatory Organisation (for payment system operators), the New Umbrella Entity (for retail payment systems) and ‘Sahamati’ (for account aggregators).

India’s evolving stance towards crypto 

The legal ecosystem in India for dealing with crypto continues to remain uncertain and an evolving one. There is no specific legal framework to regulate crypto transactions in India. The RBI, through its circular of 6 April 2018 (“RBI Circular”), had effectively imposed a ban on cryptocurrency trading in India, by shutting off formal banking and payment facilities for such transactions. However, on challenge, the said RBI Circular was set aside by the Supreme Court of India on the test of ‘proportionality’. Recently, the RBI has officially clarified that the RBI Circular cannot be cited by financial institutions to deny services related to cryptocurrencies. However, financial institutions can continue to carry out due diligence processes for crypto transactions relating to KYC, AML and CFT, as well as under the FEMA framework for overseas remittances. This RBI clarification appears to have become a key thrust for the recent regulatory action initiated by the Enforcement Directorate against digital exchange platforms that facilitate trading in cryptocurrency, and access to crypto platforms by banks and payment system operators.

The Union government has also imposed a 30% tax on any income from transfer of ‘virtual digital assets’, (“VDAs”) and 1% tax-deductible-at-source for transactions involving VDAs or cryptocurrencies, through the Finance Act, 2022. However, it was adequately clarified by the government that no legitimacy had been provided to transactions involving such VDAs merely because such transactions were taxed. That said, the RBI has issued a concept note expressing its intention to issue a Central Bank Digital Currency (CBDC) in India. Separately, there have been some consumer-centric developments in the crypto space too wherein the Advertising Standards Council of India issued guidelines on the advertising of VDA transactions. The direction that the government takes with regard to crypto in general would have to be observed closely.

This shifting policy approach in India towards crypto has been a major cause of concern for players in this industry, who have had to constantly change and evolve their business models for the Indian market to manoeuvre through the regulatory developments in this space. This alongside the unclear operating environment in India, largely on account of the recent regulatory enforcement against crypto exchanges and the shifting stance of banks for facilitating crypto-related transactions, has made it difficult for crypto players to invest and operate in India. Given that the crypto and blockchain industry is, at present, driving substantial technological innovation globally across domains, it is important that the Indian Government creates an enabling regulatory environment for crypto and blockchain, in order to capitalise on the industry’s massive potential. This will also enable India to develop on par with and integrate with other developed countries globally, which are establishing progressive frameworks to regulate crypto and blockchain, instead of a blanket prohibition.

Recent trends in the fintech sector 

As discussed above, fintech innovation in India has now diversified beyond payments to cover other financial services. Neo-bank platforms are a new category of fintech start-ups growing in India at a fast pace, that operate entirely online (ie, without any physical branches). However, given that the RBI does not, at present, recognise ‘virtual’ banks and requires banks to have some physical infrastructure, neo-bank platforms in India typically offer banking services through an underlying partnership with a licensed bank. The fintech sector is also experimenting with self-executing smart contracts (that currently operate in a regulatory grey area regarding their authenticity, admissibility and enforceability), blockchain-based use cases, and insuretech. Further, ‘artificial intelligence’ (“AI”) is one of the key technology enablers underlying the growth of fintech in India, particularly to support data-focused analysis and services. Some common areas where AI is being deployed include virtual assistants to improve customer service and engagement, credit underwriting, automated tools and algorithms for aiding in analytics and investment decisions, algorithmic trading, contract automation, as well as regulatory compliance, fraud detection and risk management.

Fintech and AI are playing a significant role to augment ‘financial inclusion’ across the underbanked and uninsured demographic in India, by improving access to financial services to children, lower-income groups, small businesses, and rural parts of India (especially tier-II and tier-III cities). For instance, industry stakeholders (including regulators and private players) have been working towards evolving the payments acceptance infrastructure to offer offline-transaction capabilities to cater to under-served rural areas and non-smartphone users. Similarly, based on data-driven underwriting and customer discovery processes, digital lending platforms have improved access to credit for many stakeholders (such as small merchants and rural businesses) that have limited credit history for traditional capital raising.

The growing significance of fintech to the Indian financial sector is also evident from the evolving relationship between traditional institutions and fintech entities, which is no longer competitive, but focused on leveraging synergies. Traditional financial institutions in the banking, securities and insurance space are increasingly adopting technology and online delivery channels to develop new offerings and expand market reach, reduce operational friction and gain cost efficiencies, strengthen data analytics, and improve customer service. Similarly, fintech entities are increasingly bundling their services with banks, non-banking finance companies and other licensed entities to rely on the latter’s licences and regulatory know-how, as well as their distribution infrastructure, large client base and strong networks. Different collaborative strategies are being used by traditional institutions for adopting fintech, including investments and partnerships with fintech companies, acquisitions, as well as development of in-house technology capabilities. As a result, the fintech sector in India is now no longer made up of only start-ups, but also includes seasoned companies and traditional financial institutions that have started offering a broad array of customer-focused and technology-driven product and service offerings.

Conclusion  

Demonetisation (the removal of INR 500 and 1000 denominated currency) in India in 2016 provided an initial push towards the adoption of digital payments. The recent COVID-19 pandemic has accelerated trends that were already occurring since then, including the shift towards digitisation and fintech adoption among various stakeholders, including small and medium businesses, government bodies, banks and other financial institutions. A new cohort of users that were previously resistant to fintech have come online for the first time as a result of the pandemic, and are likely to continue using fintech products going forward. Related consumer behavioural changes are also contributing towards increased fintech adoption, such as growth in e-commerce and discretionary spends on online platforms, telemedicine consultations, online streaming and distance learning activities. The above developments, coupled with continued interest from global investors in this space across fintech business models, present further growth opportunities for this sector in India in the long run, and present a lucrative destination for foreign investment.

The expansion of the fintech sector has raised valid policy concerns around data protection and privacy, data monopolisation, cyber-security risks, consumer protection against fraud, money laundering, as well as the impact on financial stability and the wider systemic risk to the financial ecosystem in India.

A key policy question that Indian regulators are grappling with is to find the right balance between regulatory intervention to address the above concerns, whilst still allowing for fintech innovation and businesses to continue growing.

Authors: Avimukt Dar | Namita Viswanath| Shreya Suri | Aditya G | Kanishka Singh

Date: 4 November 2022