पाठशाला Pathshala · नियम Niyam, Law and compliance · Lesson 19 · Build

Sector licences: RBI, SEBI, IRDAI, FSSAI and who needs which

Some businesses need a licence before the first customer. Find your regulator from what you actually do with money, advice or food, then plan the capital and the calendar the licence demands.

Pathshala, The Founder Library · 11 October 2026 · 7 min read

Ticket gates at a station entrance with low sunlight coming through from the platform side. — Photograph: Jona · Pexels

A founder builds a buy-now-pay-later checkout for kirana stores. The product works and merchants like it. Then the first serious investor asks one question: whose balance sheet does the credit sit on, and under which licence? There is no good answer, and the round waits nine months while the company finds a partner bank and rebuilds its flows around someone else’s permission.

Most companies in India need only the registrations every business needs: incorporation, GST, PAN and TAN, the labour codes. A smaller set needs a sector licence before it may lawfully do the thing it was founded to do. Lending, holding customer money, moving payments, advising on securities, selling insurance and selling food are the common ones. This lesson shows how to find your regulator from the activity, what each licence demands in capital and time, and how to build while you wait. Every figure was read on the regulator’s own site on 10 October 2026.

The activity decides the regulator

Regulators license activities, not business models. A founder who describes the company as a “platform” or a “marketplace” has not yet answered the question; the regulator will look at what happens to the money, the advice or the food. Ask four questions of the product as it actually works. Does the company lend its own money or arrange credit on its balance sheet? Does customer money pass through an account the company controls, even for a day? Does the company tell an individual which security, fund or insurance policy to buy? Does it make, pack, store, sell or deliver food? A yes to any one of them is a licensing question.

Each yes points to a regulator. Lending and payments go to the Reserve Bank of India. Advice on securities and the running of investment products go to SEBI. Insurance distribution goes to IRDAI. Food goes to the Food Safety and Standards Authority of India. Several businesses touch two: a wealth app that advises and also collects payments; a lending app that also sells credit insurance. Map every flow before you map the product, because the licence follows the flow.

The Reserve Bank: lending, payments and wallets

Lending. Section 45-IA of the RBI Act says no company may carry on the business of a non-banking financial institution without a certificate of registration from the Reserve Bank. The Reserve Bank’s NBFC FAQ, updated 15 September 2026, sets the entry floor at a net owned fund of ₹10 crore, and existing NBFCs have until 31 March 2027 to reach it. Specialised NBFCs carry their own floors: ₹2 crore for a peer-to-peer lending platform and for an account aggregator, ₹20 crore for a housing finance company. Applications go through the Reserve Bank’s PRAVAAH portal. The FAQ also explains the 50-50 test: a company is in the business of finance when financial assets are more than half its total assets and income from them is more than half its gross income. A company that lends from its own books at scale is an NBFC whether it calls itself one or not.

Payments. A company that collects money from customers on behalf of merchants and settles it to them is a payment aggregator. Under the Master Direction on Regulation of Payment Aggregators of 15 September 2025, issued under the Payment and Settlement Systems Act 2007, a non-bank entity must seek authorisation, must have a net worth of ₹15 crore when it applies and must reach ₹25 crore by the end of the third financial year after authorisation. The Direction brought physical point-of-sale aggregators in as well: an entity doing only that business had to apply by 31 December 2025 or wind up by 28 February 2026. The protection that the escrow rules give merchants applies only after authorisation, which is one more reason merchants and banks will ask for the certificate.

Wallets and stored value. A prepaid payment instrument, a wallet or a gift card that holds customer money, is also authorised under the Payment and Settlement Systems Act. The Master Directions on Prepaid Payment Instruments, updated 30 September 2026, require a non-bank applicant to show a positive net worth of ₹5 crore in its latest audited balance sheet, rising to ₹15 crore by the end of the third financial year after final authorisation, maintained at all times after that.

The figure below turns those floors into a fundraising number. Pick a licence, enter today’s net worth and the losses you expect while you build, and see how much equity the licence alone requires.

Most founders read the entry floor and stop. The second floor is the one that bites. A payment aggregator that applies with exactly ₹15 crore and loses ₹4 crore a year has a net worth of ₹3 crore at the end of year three, and owes the regulator ₹22 crore more of equity. The licence is a capital plan, and the investor deck should show it as one.

A licence is a balance sheet before it is a form. Raise for the third-year floor, not the first.

SEBI: advice, research and products

Regulation 3(1) of the SEBI (Investment Advisers) Regulations 2013, last amended on 25 November 2025, says no person shall act as an investment adviser or hold itself out as one without a certificate of registration. Telling an individual which security or fund to buy, for a fee, is advice. Regulation 7 requires the individual adviser or the principal officer of a company to hold a graduate degree or equivalent and relevant NISM certification, or one of the NISM post-graduate programmes; regulation 8 requires a deposit of an amount SEBI specifies, which replaced the old net-worth test. An individual adviser whose clients exceed three hundred must move to a non-individual registration.

Regulation 4 lists who need not register, and two exemptions matter to product teams. General commentary in good faith that does not name particular securities is not advice. Advice given exclusively to clients outside India, other than non-resident Indians and persons of Indian origin, is outside the regulations. Everything between those lines needs a registration or a registered partner. Research reports on listed securities fall under the separate Research Analysts Regulations 2014; broking, portfolio management and fund management each have their own. Read the regulation that matches the activity before choosing the product name.

IRDAI: distributing insurance

An app that recommends a policy and takes a commission from the insurer is distributing insurance, and insurance distribution in India is done only by intermediaries that IRDAI registers or by insurers themselves. A startup has three practical routes: embed an insurer’s product and act as a technology provider without soliciting, partner with a registered broker or corporate agent who carries the regulatory duties, or apply for its own registration as an intermediary. The capital, the fit-and-proper tests and the permitted activities for each category sit in IRDAI’s intermediary regulations, which the Authority revises often. Read the current version on IRDAI’s own website before building the commission into the business model, and assume that a commission paid to an unregistered entity is a problem for both sides of the payment.

FSSAI: anything that touches food

The Food Safety and Standards (Licensing and Registration of Food Businesses) Regulations 2011 divide food businesses into three tiers. A petty food business with annual turnover not exceeding ₹12 lakh registers. Larger businesses take a licence: from the State or Union Territory licensing authority in most cases, and from the central licensing authority for the activities in Schedule 1, which in the FSSAI compendium include all importers of food and food businesses operating in two or more States. A licence or registration runs for one to five years as the operator chooses. A cloud kitchen, a D2C snack brand and a grocery marketplace each need to know which tier they sit in and which premises the licence must name, because each kitchen and warehouse is its own question.

Mounds of coloured powdered spices on a market stall. — Anything that is made, packed, stored or sold as food sits inside one of FSSAI’s three tiers. Each premises is its own question. Photograph: Mike van Schoonderwalt · Pexels

Building while the licence is pending

Three patterns let a company sell before its own licence arrives, and each has a cost. Partner first. Lend through a licensed NBFC or bank, collect through an authorised aggregator, distribute insurance through a registered broker. The partner carries the licence and takes a share of the economics, and the company learns the business on someone else’s permission. Most fintechs in India begin this way. Stay outside the line. Offer software to licensed entities rather than services to their customers; write general commentary rather than personal advice. The product is narrower but legal. Apply early and raise for it. If the licence is the moat, start the application as soon as the capital is in the bank, and plan the product calendar around a decision date the regulator controls.

Whatever the pattern, the contracts with the licensed partner decide whether the company can ever leave. Read the exclusivity, data-ownership and termination clauses with the [contracts lesson](/library/contracts-ten-clauses-that-decide-disputes) open beside them, because a lending partner who owns the customer data owns the business.

The licence file, kept quarterly

Before the seed round closes, write one page: every flow of money, advice or food in the product; the regulator each flow touches; the licence or partner that covers it; the capital floor and the date it bites. Put the page in the data room, because every investor will ask for it. Once a quarter, compare net worth on the latest management accounts with the floor for the licence held or sought, and project it forward three years at the current loss rate. Re-read the governing Master Direction or regulation each time the regulator updates it, and note the update date on the page. A company that does this finds out about a capital gap a year before the regulator does, which is the only time a gap is cheap to fill.

Nothing here is legal or tax advice; confirm the current rule with a chartered accountant or lawyer before acting.