Sector-specific licenses in India: FSSAI, RBI, SEBI & other approvals
Authored by - Souvik Das, Executive at Outsource360
In the recordings SEBI reviewed, the market is open and a live chart is on the screen. The trainer names a stock, an entry level, a target and a stop-loss, and paying course participants follow along. The product they bought was sold as education. What the regulator saw in it is the clearest lesson there is on sector-specific licenses in India: the regulator decides by what a business does, not by what it calls itself.
On 4 December 2025, a Whole Time Member of the Securities and Exchange Board of India passed an ex parte interim order cum show cause notice against a Maharashtra trading academy and its directors. SEBI had already sent the academy an administrative warning in March 2024 over misleading profit claims, and it searched the academy's premises in August 2025. Recordings of paid courses, and messages in paid WhatsApp groups, showed stock-specific calls with entry levels, targets and stop-losses, often made on live market data. In 33 of 34 sampled instances, participants traded as they had been told.
Neither the academy nor its directors held registration as an investment adviser or a research analyst. The order treated the sessions as exactly that: advice and research, delivered without the certificate section 12 of the SEBI Act requires. It was careful about what it wasn't objecting to, saying there "would not have been any cause of action" had the academy been providing educational services. Stock-specific advice, it held, was never education in the first place.
The numbers explain why the regulator moved hard. The academy had collected Rs 601.38 crore in course fees from more than 3.37 lakh investors between July 2015 and October 2025. SEBI impounded about Rs 546 crore, barred the company and its principal director from dealing in securities, and banned any use of live market data. Of the 186 sampled participants in its premium mentorship course, 121 lost money in the six months that followed.
All of those findings were prima facie, and the story isn't finished. In January 2026 the Securities Appellate Tribunal upheld the prima facie case but cut the required deposit to Rs 100 crore, and in March 2026 the Supreme Court declined to interfere. As of September 2026 the matter was still before SEBI, with no final order published.
For a founder, the useful part is the principle rather than the penalty. In a regulated sector the license attaches to the activity, and it has to exist before the first rupee changes hands, not after the product finds its market. That's true of lending, payments, insurance distribution, food, medicines, telecom and gaming as much as it's true of stock advice.
It also cuts the other way, and that's the part most founders miss. On 1 April 2026 FSSAI lifted its thresholds, so a food business turning over Rs 1 crore now needs only a registration rather than a State license, and a 2026 amendment ended license renewals. Insurance intermediaries moved to one-time registration, and many small units no longer need pollution consent at all. Founders who map their licenses early often find they need less than they feared, and most guides online are still quoting the old numbers.
Sector-specific licenses in India are approvals from an industry regulator that a business must hold before it carries on a regulated activity, on top of company registration and GST. The main ones are FSSAI for food, RBI for lending and payments, SEBI for investment advice and fund management, IRDAI for insurance distribution, and drug controllers for medicines and medical devices.
What follows maps each regulator to the activities it licenses, with the 2026 entry capital, fees and thresholds, then covers what foreign-owned companies need on top, what keeps a license alive after it's granted, the penalties for operating without one, and the order to apply in.
On this page
What sector-specific licenses in India are, and how they differ from registration
FSSAI license: registration, State or Central after the April 2026 change
RBI licenses: NBFC registration, payment aggregators and wallets
SEBI registration: investment advisers, research analysts and fund managers
IRDAI, IFSCA and the rest of the financial perimeter
Drug licenses, medical devices, imports and product standards
Telecom, online gaming, environment and the local layer
Foreign-owned companies: the FDI route and the sector license are separate gates
After the license: change in control, going abroad and the compliance calendar
Penalties for operating without a license
How to check whether a business actually holds the license it claims
Sector-specific licenses in India: the order to apply in
The general registrations every new company files in its first year (professional tax, shops registration and the like) are set out in the first-year compliance checklist for startups. This guide covers the layer above them: the approvals only some businesses need, and the ones that stop a business cold when they're missing.
What sector-specific licenses in India are, and how they differ from registration
A certificate of incorporation lets a company exist. It doesn't let the company lend money, sell medicines, run a wallet, broker insurance or give stock advice. Each of those activities has its own regulator, its own statute and its own permission, and the permission has to be in place before the activity starts.
Regulator | Activities it licenses | License or approval | Governing law | Entry threshold or trigger (September 2026) |
FSSAI | Making, storing, distributing, selling or importing food | Registration, State license or Central license | Food Safety and Standards Act, 2006, s.31 | Registration up to Rs 1.5 crore turnover; State license to Rs 50 crore; Central above that, and for importers and e-commerce at any size |
RBI | Lending or investing as principal business | NBFC certificate of registration | RBI Act, 1934, s.45-IA | Net owned fund Rs 10 crore (investment and credit company); Rs 2 crore (P2P, account aggregator) |
RBI | Payment aggregation, wallets and other payment systems | Authorisation | Payment and Settlement Systems Act, 2007, s.4 | Net worth Rs 15 crore (payment aggregator); Rs 5 crore (prepaid instruments) |
SEBI | Investment advice, research, portfolio management, AIFs, broking | Certificate of registration | SEBI Act, 1992, s.12 | Deposit Rs 1 lakh to Rs 10 lakh (advisers, analysts); net worth Rs 5 crore (portfolio managers) |
IRDAI | Insurance broking, corporate agency, web aggregation and other intermediation | Certificate of registration | Insurance Act, 1938, s.42D | Capital Rs 75 lakh (direct broker) to Rs 5 crore (composite broker) |
IFSCA | Financial services inside GIFT City's IFSC | Registration or authorisation under IFSCA regulations | IFSCA Act, 2019 | Set activity by activity |
State drug controllers and CDSCO | Selling, making or importing drugs, medical devices and cosmetics | Sale, manufacturing and import licenses; import registration for cosmetics | Drugs and Cosmetics Act, 1940 and its rules | A sale license for every premises; a registered pharmacist for retail |
DGFT | Importing or exporting goods | Importer-Exporter Code | Foreign Trade Policy 2023, para 2.05 | Rs 500; updated every April to June |
BIS | Making, importing or selling products covered by Quality Control Orders | License or registration to use the Standard Mark | BIS Act, 2016, ss.16 and 17 | Before a notified product is made or imported |
Legal Metrology | Pre-packing or importing packaged goods | Packer or importer registration | Legal Metrology (Packaged Commodities) Rules, 2011, r.27 | Within 90 days of starting; Rs 500 |
Department of Telecommunications | Providing telecom services or networks | Authorisation | Telecommunications Act, 2023, s.3 | In force since 23 June 2026 |
Online Gaming Authority of India | E-sports and notified social games (money games are banned) | Registration per game | Promotion and Regulation of Online Gaming Act, 2025 | In force since 1 May 2026 |
State Pollution Control Board | Setting up or running an industrial plant | Consent to Establish and Consent to Operate | Air Act, 1981, s.21; Water Act, 1974, s.25 | White-category plants exempt on written intimation |
State labour department and municipality | Running any business from premises | Shops and establishments registration; trade license | State Shops and Establishments Acts; municipal law | Varies by State and city |
The activity decides the license, not the name on the certificate
Every regulator in that table starts from a verb: lends, aggregates, advises, sells, imports, operates. None starts from what a company calls its product. A "buy now, pay later" feature is credit, a "community" that shares stock picks for a fee is research, and a "store balance" usable at other merchants is a prepaid payment instrument, whatever the pitch deck says.
That's also why the words registration and license can't be taken at face value in India. Some "registrations" are full licenses in everything but name: an NBFC certificate of registration or a SEBI registration involves capital tests, fit-and-proper checks and ongoing supervision. Others are light-touch enrolments, like an FSSAI registration for a small food business or the registration that replaced licensing for low-risk medical devices. The test that matters is what the regulator checks before it says yes, and what it can take away afterwards.
Does every business in India need a sector license? No. A software company, a consultancy or a marketing agency usually needs none, only the general registrations every business carries. But the moment the product touches money, food, health, telecom networks or packaged goods, the answer changes, and it changes on the day of the first transaction.
Horizontal registrations every business gets, and the vertical ones only some do
Think of it this way. Horizontal registrations apply across sectors: incorporation, PAN, GST once turnover or the type of supply requires it, professional tax, and shops and establishments registration for the premises. The rules for when GST registration becomes mandatory are a separate question from anything in this guide.
Vertical licenses are the sector layer. They exist because India moved away from licensing industry in general and towards regulating specific risks: the 1991 industrial policy dismantled most industrial licensing, and in its place came sector regulators such as SEBI in 1992, IRDAI in 1999, FSSAI under the 2006 food law (which replaced several older food statutes) and the payments framework in 2007. The result is fewer licenses overall, but each one is deeper.
A question founders often ask is whether a GST certificate counts as a business license. It doesn't. GST registration is a tax identity, and it authorises nothing: a company with a GST number that starts lending or selling food is operating without the license just the same.
Finding every approval that applies: NSWS and Know Your Approvals
There's no single business license in India, but there is a single place to start looking. The National Single Window System run for DPIIT gives access to over 325 central approvals and 2,364 State approvals, and its Know Your Approvals module guides applicants across 32 central departments and 34 States and Union Territories (as displayed on the portal in September 2026).
Know Your Approvals is a questionnaire: describe the business, location and activity, and it lists the approvals that may apply. In practice, though, it's a starting inventory, not legal advice, and it can't see what a product actually does. Run it, then test each activity against the regulator-by-regulator sections below.
One common confusion is worth clearing up here. DPIIT start-up recognition is a benefit, not a permission. It can bring tax and compliance advantages, but a recognised start-up that lends, pays out or advises still needs every license in this guide.
FSSAI license: registration, State or Central after the April 2026 change
Food is the sector where most Indian founders first meet a regulator, because it has no minimum size. A home baker selling through Instagram, a cloud kitchen, a spice importer and a packaged-snacks brand all sit under the Food Safety and Standards Act, 2006. Section 31(1) says no one may commence or carry on a food business except under a license, and section 31(2) lets petty manufacturers, petty retailers, hawkers, temporary stall holders and small-scale or cottage food businesses register instead.
What changed in 2026 is where those lines fall, how long a license lasts, and what a business owes to keep it alive. If your checklist was written before April 2026, it's wrong on all three.
The new turnover thresholds, and what they replaced
From 1 April 2026, a food business is sorted mainly by annual turnover. Registration covers turnover up to Rs 1.5 crore, a State license covers turnover above Rs 1.5 crore and up to Rs 50 crore, and a Central license applies above Rs 50 crore. The figures come from the FSSAI order of 13 March 2026, made under powers inserted by the FSS (Licensing and Registration of Food Businesses) Amendment Regulations, 2026, notified on 10 March 2026.
The old system was messier than most summaries admit. Registration stopped at Rs 12 lakh, most trade and food-service businesses needed a Central license above Rs 20 crore (Rs 30 crore for wholesalers and transporters), and manufacturers were tiered by production capacity in litres or tonnes a day rather than by turnover. The 2026 order says it "supersedes all other earlier orders and regulations" on thresholds, so the capacity tiers are gone. FSSAI's own FAQ puts more than 98 per cent of food businesses under State authorities as a result.
So what does that mean for a Rs 1 crore business? Under the old rules, a restaurant at that turnover needed a State license. It now needs a registration, which the amended regulations allow the authority to grant instantly on submission of the required documents. A Rs 30 crore distributor that held a Central license now falls to a State license.
Two cautions keep this from being as simple as it sounds. The thresholds apply to applications made on or after 1 April 2026, and FSSAI's FAQ of 27 March 2026 says existing licensees migrate through FoSCoS, the licensing portal, on their own self-declaration, keeping the same license number. And several non-turnover rules survive: hotels rated five-star and above still need a Central license, grain and pulse milling units always take a State license, and caterers have no registration tier at all.
Worth flagging: some of FSSAI's own older help pages and eligibility PDFs still show Rs 12 lakh and Rs 20 crore, and so do most ranking guides. The current table is the one marked "Updated on 01.04.2026".
FSSAI tier (from 1 April 2026) | Annual turnover | Annual government fee | Also placed here regardless of turnover |
Registration | Up to Rs 1.5 crore | Rs 100 (nil for hawkers) | Street vendors registered under the Street Vendors Act, 2014 are deemed registered |
State license | Above Rs 1.5 crore, up to Rs 50 crore | Rs 5,000 | Grain, cereal and pulse milling units; hotels up to four-star (above the registration threshold) |
Central license | Above Rs 50 crore | Rs 7,500 | Importers, e-commerce, 100 per cent EOUs, exporters, nutraceutical and proprietary food manufacturers, airports and seaports, Central Government agency premises, head office of a multi-State business, five-star hotels |
Fees are as listed in FSSAI's FoSCoS kind-of-business table updated on 1 April 2026. Railway-station and Central Government canteen operators sit with the central authority but pay Rs 100 for a registration and Rs 2,000 for a license.
Businesses that need a Central license whatever their turnover
Turnover doesn't decide everything. The FoSCoS table puts importers, e-commerce, exporters and 100 per cent export-oriented units, manufacturers of nutraceuticals, proprietary food and Ayurveda Aahara, radiation processing units, and businesses at airports, seaports and Central Government agency premises in the Central tier with "no restriction on turnover threshold". A business operating in two or more States also needs a Central license for its head office or registered office.
This is the second-order effect of the April change that most coverage skips. A mid-size food brand selling through its own distributors dropped a tier, but the same brand the day it imports one container of ingredients, or launches its own ordering app, is back in the Central tier. FSSAI's FAQ is explicit that a business selling its own products through its own website or app needs a license under the e-commerce category as well.
Each premises is licensed on its own eligibility. A restaurant chain with ten outlets in two States needs a registration or license for every outlet, sized to that outlet's turnover, plus the Central license for the head office.
Fees, validity, and why renewals have ended
Under the new regulation 2.1.7, a license or registration now stays "valid and subsisting" unless it is suspended, cancelled or surrendered. There is no renewal, and FSSAI's FAQ says any license or registration issued on or after 1 April 2026 has perpetual validity, including instant (Tatkal) ones.
But "no renewal" is not "no annual fee". The same regulation says that if a business fails to pay the annual fee, or fails to file a return that is due, the license or registration "shall be deemed suspended" until it pays. A business trading while suspended is treated as non-compliant and exposed to penalties under the Act. The better approach is to prepay: FSSAI lets a business pay for several years at once, at any time of year, which takes the risk off the table.
Closing a food business also has a clock now: the business tells the authority in writing within 30 days and surrenders the certificate. Ordinary processing timelines under FSSAI's order of 1 July 2024 are 60 days for a license and 7 days for a registration.
Home bakers, cloud kitchens and marketplace sellers
"Do I need FSSAI registration as a home baker?" is a question home bakers ask on Quora, and the answer is yes. FSSAI has no special rule for home bakers, so they follow the general scheme: a bakery is general manufacturing, which means registration up to Rs 1.5 crore, a State license above that and a Central license above Rs 50 crore. Home-based canteens and dabba services have their own row, with registration up to Rs 1.5 crore and a State license above it. Running it from a home kitchen doesn't change the tier; FSSAI's FAQ exempts from individual registration only members of a registered cooperative, mahila udyog or self-help group who make food at home for that body.
Cloud kitchens follow the restaurant row. FSSAI's FAQ says they "shall obtain FSSAI License or Registration as per the Eligibility Criteria", so a delivery-only kitchen at Rs 80 lakh of turnover registers, and one at Rs 3 crore takes a State license. Restaurants and caterers that take orders online may deliver only fresh food.
Marketplaces are Central, and so is every seller's paperwork. An FSSAI order of 18 March 2026 says an e-commerce entity that lists food businesses and facilitates orders needs a Central license, and in the ONDC open-network model both the buyer app and the seller app need one. FSSAI's advisory of 3 December 2024 bars a platform from listing any seller without displaying that seller's valid license or registration, and packaged food delivered to a consumer must have at least 30 per cent of its shelf life, or 45 days, left.
So an Amazon or Swiggy seller doing Rs 60 lakh a year needs its own registration as a retailer or manufacturer, sized to its own turnover. The platform's Central license doesn't cover it. And an FSSAI registration is only one layer: the municipal trade license and shop registration for the kitchen's premises are separate, covered further down.
After the license: labels, invoices and the 31 May annual return
A license comes with conditions that are checked on every package and every bill. Regulation 5(7) of the Food Safety and Standards (Labelling and Display) Regulations, 2020 requires the FSSAI logo and license number on every pre-packaged food label, and the registration or license number displayed at every premises where food is stored, processed or sold. FSSAI has also asked food service businesses to display the certificate, which now carries a Food Safety Connect QR code, where customers can see it.
The invoice rule is the one small businesses miss. Since 1 January 2022, under FSSAI's order of 8 June 2021 as deferred on 30 September 2021, every food business must print its 14-digit license or registration number on cash receipts, purchase invoices, cash memos and bills. Only system-generated government documents such as the GST e-way bill are exempt.
Manufacturers (including repackers and relabellers), importers and manufacturer-exporters file an annual return on FoSCoS by 31 May for the previous financial year. FSSAI's advisory of 16 April 2024 sets the late fee at Rs 100 a day from 1 June, capped at five times the annual license fee, and says waiver requests won't be considered. Since March 2026 a missed return also means the license is deemed suspended until the return is filed with the penalty.
The cost of getting this wrong has changed too. Since 8 November 2023, section 63 of the Act makes carrying on a food business without a required license liable to a penalty of up to Rs 10 lakh instead of imprisonment, which is twice the old maximum fine, and a deemed suspension can leave a business trading in breach without anyone noticing.
RBI licenses: NBFC registration, payment aggregators and wallets
"Which RBI license do we need?" assumes there is one. The Reserve Bank regulates three different things, and a product can touch all three: lending or investing as a business, running a system that moves money between payers and merchants, and issuing stored value that customers spend later.
So the question that sorts a fintech is where the money sits. A company that lends from its own balance sheet is a candidate non-banking financial company. A company that receives customer money and settles it to merchants is operating a payment system. A company that only writes the software a bank or NBFC runs is neither, and its obligations arrive through its contract with that regulated entity rather than through a license of its own.
The rulebook itself moved recently. On 28 November 2025 the Reserve Bank released 244 Master Directions for 11 types of regulated entities and withdrew 9,445 circulars the same day. A guide written before that date is probably citing an instrument that no longer exists under that name, and the Digital Lending Directions issued only six months earlier were among the withdrawals.
The NBFC certificate of registration and the 50-50 test
Section 45-IA of the Reserve Bank of India Act, 1934 says a non-banking financial company cannot commence or carry on business without two things: a certificate of registration from the Reserve Bank, and the net owned fund the Reserve Bank specifies. Both have to exist first. The Act has no grace period for a company that starts lending while its application is pending.
Whether a company is an NBFC at all is decided by the principal business test, now in paragraph 38 of the Reserve Bank of India (Non-Banking Financial Companies - Registration, Exemptions and Framework for Scale Based Regulation) Directions, 2025. On its last audited balance sheet, financial assets must be more than 50 per cent of total assets (netted off by intangible assets), and income from financial assets must be more than 50 per cent of gross income. Both tests must be met. The criterion dates from a Reserve Bank press release of April 1999 and isn't in the Act itself, which never defines "principal business".
Section 45-I(c) of the Act also carves out companies whose principal business is agriculture, industrial activity, trading in goods other than securities, providing services, or buying, building and selling immovable property. That's why a software company that offers customers a few months of credit on its own invoices usually isn't an NBFC. It becomes one when the lending book, not the software, is what the balance sheet and the income statement are made of.
Here's what that looks like in practice. A B2B marketplace that starts extending 60-day credit to buyers from its own funds can drift across both lines within two or three years without anyone deciding to become a lender. The test runs on audited numbers, so the finance team (whether that's an in-house controller or a virtual CFO) is usually the first to see it coming, and the board should hear about it before the auditor does.
Does every company that lends need RBI registration? Not quite. The Directions exempt several entities another regulator already supervises, including insurers, SEBI-registered stock brokers and alternative investment funds, and Nidhi and chit companies, though each still needs its own primary license. And since July 2026 one class of genuine NBFCs is exempt too, which the next section covers.
The application runs on the Reserve Bank's PRAVAAH portal. Its Citizen's Charter commits to 90 days for a certificate of registration, counted only from the date the application is complete with every attachment. The timeline is a service standard, not a deemed approval, so a silent Reserve Bank means no license. Entity choice comes before any of this, and the trade-offs between structures are set out in choosing between a private limited company, LLP and OPC.
Net owned fund: Rs 10 crore for new applicants, and the July 2026 exemption
Paragraph 39 of the 2025 Directions sets the net owned fund at Rs 10 crore for an investment and credit company (NBFC-ICC), a microfinance institution (NBFC-MFI) and a factoring company (NBFC-Factor). Peer-to-peer lending platforms, account aggregators and the new "Type I NBFC" need Rs 2 crore. Infrastructure finance companies and infrastructure debt funds need Rs 300 crore, and a housing finance company needs Rs 20 crore.
Existing companies are on a glide path. An NBFC-ICC that was registered on the old Rs 2 crore floor had to reach Rs 5 crore by 31 March 2025 and must reach Rs 10 crore by 31 March 2027. Paragraph 43 is blunt about the alternative: a company that misses the glide path "shall not be eligible to hold" a certificate of registration.
This is where most applicants go wrong: net owned fund isn't the same number as paid-up capital. The Explanation to section 45-IA starts from paid-up equity and free reserves, deducts accumulated losses, deferred revenue expenditure and intangible assets, and then deducts investments in the shares of subsidiaries, group companies and other NBFCs, plus loans to and deposits with subsidiaries and group companies, to the extent they exceed 10 per cent of that figure. A holding structure that parks cash in a sister company can have Rs 12 crore of share capital and less than Rs 10 crore of net owned fund.
Now, here's where it gets interesting. From 1 July 2026, the Amendment Directions of 29 April 2026 exempt an NBFC from sections 45-IA and 45-IC if it takes no public funds, has no customer interface, and has assets below Rs 1,000 crore. The Reserve Bank calls it an "Unregistered Type I NBFC". All four conditions in the new paragraph 65A have to hold: that business model is conscious and long-term, assets stay under Rs 1,000 crore, the board passes a resolution at the start of every financial year, and the notes to accounts disclose the status.
Existing NBFCs that fit may apply for deregistration by 31 December 2026, sending the original certificate, three years of audited financials, an auditor's certificate and board undertakings. It isn't automatic: the Reserve Bank decides, and only if it is satisfied about the business model. Assets of every Unregistered Type I NBFC in a group are added together, and at Rs 1,000 crore the whole group has to register as Type I.
What most people miss is how narrow "public funds" is drawn. Paragraph 6 counts inter-corporate deposits, bank finance, commercial paper and debentures, and money routed indirectly through group entities, while excluding instruments compulsorily convertible into equity within five years. So a family investment company that deregisters and later takes a single bank loan has broken the first condition, and the auditor is required to report the breach. A company intending to take public money or deal with customers registers as a "Type II NBFC" instead.
Payment aggregator authorisation: online, physical and cross-border
A payment aggregator receives money from customers and settles it to merchants. Section 4 of the Payment and Settlement Systems Act, 2007 says no one other than the Reserve Bank may commence or operate a payment system without its authorisation, and since 15 September 2025 the detailed rules for aggregators sit in the Master Direction on Regulation of Payment Aggregators. It recognises three categories: PA-Online, PA-Physical for face-to-face transactions, and PA-Cross Border for current-account e-commerce payments into and out of India.
Banks don't need authorisation for aggregator business. A non-bank does, and it must be a company incorporated in India under the Companies Act, 2013. Paragraph 6 sets its minimum net worth at Rs 15 crore when it applies and Rs 25 crore by the end of the third financial year after authorisation, maintained continuously after that. Merchant money is held in an escrow account with a scheduled commercial bank, and a cross-border transaction is capped at Rs 25 lakh.
Founders on Quora ask how to get a "payment gateway license" for a UPI checkout. There isn't one. Paragraph 10(g) of the Directions leaves pure payment gateways (technology that routes transactions without handling funds) outside the Directions, so a checkout provider that never touches settlement money doesn't need authorisation. The moment the money passes through the company's own account, it's aggregating, and it needs the Rs 15 crore of net worth and a Reserve Bank certificate first.
Physical aggregators came in with hard dates: a PA-Physical business had to apply by 31 December 2025 or wind up by 28 February 2026. Paragraph 10(b) also bars an aggregator from carrying on marketplace business, although a marketplace can be onboarded as a merchant.
The catch? A rejected application now has a cost. The Master Directions on Authorisation to operate a Payment System of 15 June 2026 put authorisation on tap and make a new entity's certificate perpetual, but they also let the Reserve Bank impose a one-year cooling period after a refused application, a revoked or non-renewed certificate, or a voluntary surrender. The cooling period extends to new entities set up by the same promoters, so filing an incomplete application to "get in the queue" is a real risk.
Prepaid payment instruments, account aggregators and P2P platforms
A wallet, gift card or stored-value balance is a prepaid payment instrument. The Master Directions on Prepaid Payment Instruments of 27 August 2021, updated to 27 December 2024 and still in force, require a non-bank issuer to have a positive net worth of Rs 5 crore on its latest audited balance sheet when it applies, rising to Rs 15 crore by the end of the third financial year from final authorisation. Authorisation runs in two stages: an in-principle approval valid for six months, during which a system audit report is due, and then the final certificate.
Do in-app balances and loyalty points need Reserve Bank approval? Only if they work beyond the issuer's own shop.
Paragraph 2.1 says a closed-system instrument, issued by an entity for buying its own goods and services with no cash withdrawal, is not a payment system requiring authorisation. A coffee chain's app wallet is closed. A wallet that pays other merchants, allows cash-out or transfers money to third parties is a semi-closed instrument and needs a certificate.
That line may move. On 22 April 2026 the Reserve Bank released a draft Master Direction on Prepaid Payment Instruments, with comments due by 22 May 2026. The draft keeps the Rs 5 crore and Rs 15 crore figures but narrows the closed-system carve-out to issuers "other than a marketplace". As of mid-September 2026 it is still a draft, but a marketplace running a store-credit balance for its sellers' goods would be wise to plan for authorisation rather than assume the exemption survives.
Two smaller NBFC categories matter to data and lending start-ups. An account aggregator, which moves financial data between institutions with the customer's consent, registers as an NBFC-AA with Rs 2 crore of net owned fund under its own 2025 Directions. A peer-to-peer lending platform registers as an NBFC-P2P, also with Rs 2 crore, and paragraph 13 of the P2P Directions requires that fund to be infused before the certificate is granted.
Digital lending: why a lending app is not a license
Does a lending app need its own RBI license? No, and that's exactly the problem: the Reserve Bank licenses the lender, not the app. For NBFCs the rules now sit in Chapter III of the Reserve Bank of India (Non-Banking Financial Companies - Credit Facilities) Directions, 2025, which absorbed the Digital Lending Directions of May 2025 when those were withdrawn in November. Banks and other regulated entities carry the equivalent chapter in their own credit facilities directions.
A lending service provider is defined as the lender's agent, and the regulated entity stays fully responsible for what it does. Loans are disbursed and repaid directly between the borrower's bank account and the lender's, with no pass-through or pool account run by the app. The provider's fee is paid by the lender and never collected from the borrower, and the borrower's cooling-off period can't be shorter than one day.
Each lender reports every digital lending app it deploys on the Reserve Bank's CIMS portal, with its chief compliance officer certifying the data, and the Reserve Bank publishes the result as a public directory that has been live since 1 July 2025. Paragraph 18 is careful about what that listing means. The data is published automatically without Reserve Bank verification, and it "shall not be construed" as registration, authorisation or endorsement.
The practical reality is that a founder building a lending product has two options: become a regulated entity, or become a service provider to one and accept that the lender's compliance team will audit you. Fintech compliance in the second model is mostly contractual: data handling, grievance redress, recovery conduct and the lender's right to inspect. The data side overlaps heavily with India's new privacy law, which the guide to DPDP Act compliance for SaaS and fintech founders covers.
Activity | RBI permission | Legal basis | Capital at entry | Later requirement |
Lending or investing as principal business (NBFC-ICC) | Certificate of registration | RBI Act, 1934, s.45-IA; SBR Directions, 2025 | Net owned fund Rs 10 crore | Existing ICCs reach Rs 10 crore by 31 March 2027 |
Captive NBFC: no public funds, no customer interface, assets under Rs 1,000 crore | None from 1 July 2026 (Unregistered Type I NBFC) | SBR Directions, 2025, para 65A | Not applicable | Board resolution every year; existing NBFCs may apply to deregister by 31 December 2026 |
Peer-to-peer lending platform | Certificate of registration as NBFC-P2P | RBI Act, s.45-IA; P2P Directions, 2025 | Net owned fund Rs 2 crore, infused before registration | Maintained continuously |
Account aggregator | Certificate of registration as NBFC-AA | RBI Act, s.45-IA; AA Directions, 2025 | Net owned fund Rs 2 crore | Maintained continuously |
Payment aggregator (online, physical, cross-border) | Authorisation | PSS Act, 2007, s.4; PA Directions, 15 September 2025 | Net worth Rs 15 crore | Rs 25 crore by end of third financial year |
Wallet usable at other merchants (semi-closed PPI) | Authorisation | PSS Act, 2007, s.4; PPI Master Directions, 2021 | Net worth Rs 5 crore | Rs 15 crore by end of third financial year |
Store credit for the issuer's own goods, no cash-out (closed PPI) | None | PPI Master Directions, 2021, para 2.1 | Not applicable | 2026 draft would exclude marketplaces |
Digital lending app or lending service provider | None of its own; the lender reports the app on CIMS | NBFC Credit Facilities Directions, 2025, Chapter III | Not applicable | Lender stays responsible for the app's conduct |
The mistake we see most often in this area is a fintech that treats the Reserve Bank as a hurdle to clear at launch. The capital figures above are floors to be maintained, the step-ups bite in year three, and a change of control needs fresh permission.
SEBI registration: investment advisers, research analysts and fund managers
SEBI licensing matters to far more founders than the fund managers and brokers it was built for. Wealth-tech apps, stock-market newsletters, trading courses, Telegram channels and creator businesses all sit close to its perimeter, and the Securities and Exchange Board of India has spent 2024 to 2026 making that perimeter sharper. Is SEBI approval mandatory for every business? No. It's mandatory for anyone who does one of the regulated things for money, whatever the product is called.
Section 12 of the SEBI Act and the activities it catches
Section 12(1) of the Securities and Exchange Board of India Act, 1992 says no stock broker, portfolio manager, investment adviser or other securities market intermediary may operate except under a certificate of registration from SEBI. The detailed registration duty for advisers and analysts sits in regulation 3(1) of the Investment Advisers Regulations, 2013 and the Research Analysts Regulations, 2014, which SEBI reads with section 12(1).
The definitions do the real work. The Research Analysts Regulations define research services to include making "buy/sell/hold" recommendations, "giving price target or stop loss target", recommending model portfolios and providing trading calls. Since 16 December 2024 the Investment Advisers Regulations have said that "trading calls shall not be considered as investment advice", so anyone selling trading calls needs research analyst registration, not adviser registration.
Commentary on general market trends, broad indices, the economy and sector-level technical analysis falls outside a "research report". That's the space an educator or a financial journalist can work in. A specific stock, an entry level and a stop-loss is not.
Investment adviser and research analyst registration after the deposit reform
SEBI replaced the old net worth test with a deposit on 16 December 2024. Under regulation 8 of the Investment Advisers Regulations, as amended to 25 November 2025, and the matching regulation for research analysts, the deposit depends on the maximum number of clients on any day of the previous year: Rs 1 lakh for up to 150, Rs 2 lakh for 151 to 300, Rs 5 lakh for 301 to 1,000, and Rs 10 lakh above that. Since August 2025 it can be held as units of a liquid or overnight mutual fund as well as a bank deposit, lien-marked to the supervisory body.
That body is BSE Limited, which SEBI recognised as the administration and supervisory body for advisers and analysts for five years from 25 July 2024. Qualification rules were rewritten again from 25 November 2025: a graduate degree (or a CFA charter) plus the relevant NISM certification, or a NISM postgraduate programme in the field. The old five-year experience requirement for advisers was dropped in December 2024.
How much can a SEBI-registered adviser charge? For individual and HUF clients, SEBI's guidelines of 8 January 2025 cap fees at 2.5 per cent of assets under advice or Rs 1,51,000 a year per family in fixed-fee mode. Research analysts have a flat Rs 1,51,000 cap for the same clients. Neither cap applies to non-individual clients or accredited investors, and fees can be taken up to a year in advance if the client agrees.
Two structural options suit smaller businesses. A part-time adviser, an individual or firm also engaged in unrelated business or employment, can register but is capped at 75 clients, and a part-time research analyst is recognised too. And an individual adviser who grows past 300 clients or Rs 3 crore of fees in a year has to move to a non-individual registration.
A question that comes up often: do you need SEBI registration if you only advise clients abroad? For advisers, regulation 4(i) exempts anyone who advises "exclusively to clients based out of India", but its proviso brings advice to non-resident Indians and persons of Indian origin back within the regulations. One NRI client ends the exemption. The Research Analysts Regulations contain no equivalent exemption, and no published SEBI position could be found on an India-based analyst serving only overseas clients, so that model needs specific advice before launch.
Portfolio managers, AIFs and angel funds
Managing money, rather than advising on it, carries a capital test. Regulation 9 of the Portfolio Managers Regulations, 2020 requires net worth of at least Rs 5 crore, and regulation 23(2) bars a portfolio manager from accepting less than Rs 50 lakh from a client, except accredited investors.
An alternative investment fund needs a corpus of at least Rs 20 crore for each scheme (Rs 5 crore for a social impact fund) and can't accept less than Rs 1 crore from an investor (Rs 25 lakh from employees or directors of the fund or its manager, and no minimum for accredited investors), under regulation 10 of the AIF Regulations, 2012, as amended to 14 July 2026. SEBI-registered AIFs are also exempt from registering with the Reserve Bank as NBFCs.
Angel funds changed the most. Since 9 September 2025 they may raise money only from accredited investors, with at least five on board before the first close, and each investment in a start-up must be between Rs 10 lakh and Rs 25 crore with contributions from at least two accredited investors. For a founder raising from an angel network, the practical question is now whether each participating angel is accredited.
Finfluencers, "education" and Regulation 16A
SEBI's most effective move against unregistered advice doesn't target the finfluencer directly. Regulation 16A of the Intermediaries Regulations, in force since 29 August 2024, bars every SEBI-regulated entity and its agents from any direct or indirect association (payment, client referrals, shared systems) with a person who gives securities advice or recommendations without registration, or who claims returns without SEBI's permission. Brokers, asset managers and distributors had to exit existing arrangements under a circular of 22 October 2024.
Pure educators are carved out, as long as they don't advise or claim returns. SEBI's FAQs of 29 January 2025 drew the line at data: a person engaged solely in education "should not be using the market price data of the preceding three months" to name a security while indicating a future price or recommendation. A circular of 8 May 2026, applicable from 1 July 2026, cut that window to thirty days and set a thirty-day lag on price data that exchanges and intermediaries share for education.
Here's the second-order effect. An unregistered educator who is never prosecuted can still lose the broker referral fees, affiliate income and sponsored webinars that funded the business, because the regulated side can't legally pay them. For a creator business, SEBI registration is increasingly the price of distribution rather than just a compliance box.
So can you sell stock tips as "education" without registering? The December 2025 order described at the top of this guide answers it: SEBI looked at what was said in the sessions and the paid groups, not at the course title, and treated stock-specific calls, prima facie, as advice and research.
IRDAI, IFSCA and the rest of the financial perimeter
Insurance is where embedded-finance start-ups most often cross a licensing line without noticing. The Sabka Bima Sabki Raksha (Amendment of Insurance Laws) Act, 2025 rewrote much of the Insurance Act, 1938, and section 42D(2A) now bars anyone from acting as an insurance intermediary without a certificate of registration from the Insurance Regulatory and Development Authority of India. The statutory list of intermediaries in section 2(10B) covers brokers, reinsurance brokers, consultants, corporate agents, third party administrators, surveyors and loss assessors, managing general agents and insurance repositories.
The capital numbers across the financial regulators vary more than founders expect, and they aren't measured the same way. The graphic below puts them side by side.
Insurance brokers: capital, net worth and the move to one-time registration
How do you get an insurance broker license? Under the IRDAI (Insurance Brokers) Regulations, 2018, as summarised on IRDAI's page of requirements for a license as a broker, the applicant needs minimum capital of Rs 75 lakh for a direct broker, Rs 4 crore for a reinsurance broker and Rs 5 crore for a composite broker. Net worth must never fall below Rs 50 lakh for a direct broker and half the minimum capital (Rs 2 crore and Rs 2.5 crore) for the other two. A direct broker also keeps a Rs 10 lakh deposit with a lien in IRDAI's favour.
The principal officer has to be the chief executive, a whole-time director or the managing director, with the prescribed qualification, 50 hours of training and a pass in the IRDAI-recognised broker examination. In practice that person is the long pole in the application, because the qualification, training and examination all attach to a named individual at board level.
The 2025 amendment also ended three-year renewals. Section 42D(4A) keeps a registration in force, subject to an annual fee, until IRDAI suspends or cancels it, and the IRDAI (Insurance Intermediaries) (Amendment) Regulations, 2026, gazetted on 30 July 2026, set that fee at the higher of Rs 10,000 or 0.04 per cent of the previous year's commission and other receipts, due before 31 January each year. According to IRDAI's FAQs on the 2026 amendment, an unpaid fee suspends the certificate from 1 April and it stands cancelled unless the fee plus 20 per cent is paid within three months.
Fair warning for anyone already registered: existing brokers, corporate agents, web aggregators and insurance marketing firms must apply for a fresh certificate before 31 January 2027. Late applications may be accepted up to 31 March 2027 at IRDAI's discretion, and an intermediary that hasn't applied by then must stop acting.
Corporate agents and web aggregators
Most insurtechs don't become brokers. A company that distributes one or a few insurers' products typically registers as a corporate agent under the IRDAI (Registration of Corporate Agents) Regulations, 2015, and a comparison site under the IRDAI (Insurance Web Aggregators) Regulations, 2017. The 2026 amendment regulations amended both sets separately rather than merging them, so each still has its own conditions.
Here's what that looks like on a checkout page. A travel app that sells trip insurance alongside tickets and earns commission is very likely soliciting insurance business, and soliciting needs an intermediary registration. From 1 January 2027 every proposal form and policy must also show the salesperson's name and functional identity (or, for purely digital sales, the principal officer's contact details).
The 2025 Act moved the risk onto insurers as well. Under the new section 105BA, acting as an intermediary without registration carries a penalty of Rs 1 lakh to Rs 10 lakh, but an insurer that appoints an unregistered intermediary or transacts business through one faces Rs 10 lakh to Rs 1 crore. Expect every insurer's partnership team to ask for your registration certificate before the integration call.
Even naming is regulated now. Section 2C lets only insurers use words such as "insurance" or "assurance" in their names, and an intermediary may use them only to describe the nature of its services, which is worth checking before a brand name is registered.
GIFT City: one regulator in place of four
A business setting up in GIFT City's International Financial Services Centre deals with a different regulator for all of this. The International Financial Services Centres Authority was established on 27 April 2020 under the International Financial Services Centres Authority Act, 2019, and section 13(1) with the First Schedule transfers to it, inside IFSCs, the regulatory powers of the Reserve Bank, SEBI, IRDAI and the Pension Fund Regulatory and Development Authority.
So a fund manager, an insurance broker, a bank unit and a payments business in GIFT City all apply to one authority instead of four. Fees and penalties there are collected in foreign currency under section 13(5). That single-window structure is a large part of the pitch, but the licensing itself is no lighter: IFSCA runs its own regulations for each activity.
Drug licenses, medical devices, imports and product standards
The financial regulators license what a company does with money. This next group licenses what a company makes, sells or brings into the country, and it's where D2C brands, health-tech start-ups and importers find out that a GST number and a warehouse aren't enough. And most of these approvals attach to a product or a premises rather than to the company, so they multiply as the business grows.
Retail, wholesale and manufacturing drug licenses
Section 18(c) of the Drugs and Cosmetics Act, 1940 says no one may manufacture for sale, sell, stock, exhibit or distribute a drug or cosmetic except under a license. Sale licenses come from the State Licensing Authority under rule 61 of the Drugs Rules, 1945. Form 20 (retail) and Form 20B (wholesale) cover drugs outside Schedules C, C(1) and X; Form 21 and Form 21B cover Schedule C and C(1) drugs; and Schedule X drugs need their own licenses.
A retail pharmacy supplies prescription drugs only "by or under the personal supervision of a registered Pharmacist". Wholesale is looser: the premises must be in charge of a competent person, who can be a registered pharmacist, a matriculate with four years' experience selling drugs, or a graduate with one year's experience. And rule 62 requires a separate license for every place where drugs are sold or stocked.
That last rule is what trips up quick-commerce and dark-store models. A pharmacy brand with twelve dark stores needs twelve sale licenses, twelve compliant premises and a pharmacist arrangement for every one of them. Manufacturing is licensed separately, in Form 25 or Form 28 from the State authority, with central approval for notified categories such as vaccines, large volume parenterals and r-DNA drugs.
Is it legal to sell medicines online in India? There's no clean yes or no, and anyone who gives you one is guessing.
The Health Ministry published draft e-pharmacy rules on 28 August 2018 (G.S.R. 817(E)), and they were never notified. In 2015 the Drugs Controller General told the States that the rules "do not distinguish between the conventional and over the Internet sale", and in August 2023 the Ministry told the Rajya Sabha that CDSCO had issued show-cause notices to online sellers that February. The defensible position is that no dedicated online pharmacy license exists, so any online model has to run through ordinary sale licenses and comply with every condition attached to them.
Medical devices and cosmetics imports
Every medical device is now regulated. The Medical Devices Rules, 2017 brought Class A and B devices into the licensing regime from 1 October 2022 and Class C and D from 1 October 2023. Imports need a license in Form MD-15 from the Central Licensing Authority, applied for in Form MD-14. Manufacturing licenses come from the State authority for Class A and B (Form MD-5) and from the Central authority for Class C and D (Form MD-9).
There's one real exemption. Class A devices that are neither sterile nor used for measuring were moved out of licensing and onto registration by G.S.R. 777(E) of 14 October 2022, with a system-generated number and no fee. Since an August 2026 amendment, those registrants also self-certify a quality management system, and a sterile or measuring Class A device still needs a full license.
Cosmetics run on a registration model for imports. Under rule 12 of the Cosmetics Rules, 2020, no cosmetic may be imported unless registered by the Central Licensing Authority, which issues an import registration certificate in Form COS-2 and decides within six months. Domestic manufacture needs a State license in Form COS-8, due within 45 days of a complete application. The COS-2 certificate is valid in perpetuity if its retention fee is paid before each five-year period ends, and a late payment beyond 180 days means it's deemed cancelled.
A skincare brand importing from Korea has to plan around that six-month window. Its launch date is set by CDSCO, not by the ship.
The Importer-Exporter Code, and the April-June update
Paragraph 2.05 of the Foreign Trade Policy 2023 says that, unless specifically exempted, no export or import of goods may be made without an Importer-Exporter Code, a ten-character number identical to the company's PAN and issued online by the Directorate General of Foreign Trade. The fee is Rs 500. One PAN gets one IEC, and it has permanent validity unless suspended, cancelled or deactivated.
Frankly, that "deactivated" is the part that gets overlooked. The same paragraph requires the IEC to be updated online every year during April to June, and where nothing has changed "same also needs to be confirmed online". An IEC that isn't updated is deactivated, and it's reactivated only once the update is made, which is not a position to discover with a consignment at the port.
Do service exporters need one? Only to claim benefits under the Foreign Trade Policy. A SaaS company invoicing US customers can export services without an IEC, but it needs one the day it imports a server or ships hardware, or if it wants an export incentive.
BIS registration and Quality Control Orders
Section 16 of the Bureau of Indian Standards Act, 2016 lets the Central Government make the Standard Mark compulsory for notified goods by order, and section 17(1) then bars anyone from manufacturing, importing, distributing, selling or storing those goods without the mark under a valid license. These orders are Quality Control Orders, and they're why an importer of a covered product needs BIS certification before the container lands rather than after.
Electronics and IT goods fall under the Electronics and Information Technology Goods (Requirement of Compulsory Registration) Order, 2021, which requires the listed products to conform to their Indian Standard and carry the Standard Mark under BIS's registration scheme (Scheme-II). A D2C brand importing power banks or chargers from an overseas factory needs a BIS registration covering the models it sells, if those products are on the notified list.
The list moves in both directions, which makes a static checklist dangerous. Several QCOs were withdrawn in late 2025 and 2026, while a Transition Facilitation (Quality Control) Order notified on 25 June 2026 eased input sourcing for domestic manufacturers. Check the current BIS list for the product, not a blog's count of how many products are covered.
Legal Metrology registration for packers and importers
A business that pre-packs goods for sale, or imports them in packages, is squarely within the Legal Metrology (Packaged Commodities) Rules, 2011. Rule 27 requires every company, firm or individual that pre-packs or imports a commodity for sale to register with the Director or the State Controller, on a fee of Rs 500, within 90 days of starting. Section 19 of the Legal Metrology Act, 2009 separately requires importers of weights and measures to register with the Director.
The regime is becoming lighter. The Jan Vishwas Act, 2026 turns Legal Metrology "licences" into registration certificates and puts an improvement notice before the first penalty, and the Department of Consumer Affairs told the States in May 2026 that registrations should be granted automatically on submission of documents through its national eMaap portal.
One change goes the other way. The 2026 Act names e-commerce platforms expressly in section 36(1), on packages that don't match their declarations: an improvement notice first, then a penalty of up to Rs 5 lakh, then Rs 25 lakh to Rs 50 lakh for later offences. Marketplaces are likely to push that exposure down to sellers through their seller agreements, so a brand selling online should expect to be asked for its packer registration.
Telecom, online gaming, environment and the local layer
The last group mixes central regimes that rewrote themselves in 2026 with State and municipal approvals that never make the headlines. Founders tend to hear about the first kind from the press and the second kind from an inspector.
Aviation is the one sector here this guide only flags. Scheduled airlines need an Air Operator Certificate and non-scheduled passenger operators an Air Operator Permit from the Directorate General of Civil Aviation, under rules 134 and 134A of the Aircraft Rules, 1937 (continued under the Bharatiya Vayuyan Adhiniyam, 2024). Commercial drone operations above nano size generally need a type-certified drone and a pilot holding a Remote Pilot Certificate under the Drone Rules, 2021.
Telecom authorisations under the Telecommunications Act, 2023
Here's a change that happened quietly this year. Section 3(1) of the Telecommunications Act, 2023 requires an authorisation from the Central Government to provide telecommunication services or to establish, operate or expand a telecom network, and that section came into force only on 23 June 2026. On the same day the Department of Telecommunications notified four sets of rules: principal services (unified, access, internet and long distance), miscellaneous services (including machine-to-machine and enterprise communication), captive services, and migration from old licenses. Network authorisation rules followed on 20 July 2026.
Existing license holders can continue on their license or migrate. A license with a fixed term runs to its expiry, and a holder that wants to migrate has to apply at least 12 months before that date. Providing telecom services or establishing a network without authorisation is punishable under section 42(1) with imprisonment of up to three years, a fine of up to Rs 2 crore, or both.
The short answer for most founders is that none of this applies, and the history explains why. On 5 November 2020 the department abolished registration for Other Service Providers, the category that used to catch call centres and BPOs, and took data-related BPO work out of OSP regulation altogether. The revised guidelines of 23 June 2021 apply only to voice-based BPOs, which still need no registration but must prevent toll bypass and keep call records and system logs for one year.
So when is DoT approval actually needed? When the business itself provides connectivity or voice to others: an internet service provider, an IoT company offering machine-to-machine connectivity, or a virtual network operator reselling capacity. A SaaS company, an outsourced customer support team or a voice BPO that buys connectivity from a licensed operator doesn't. The line moves the day a voice BPO starts reselling that connectivity, because the guidelines say an OSP "shall not engage in the provision of any Telecom Services".
Online gaming after the 2025 Act
The Promotion and Regulation of Online Gaming Act, 2025 received assent on 22 August 2025 and came into force on 1 May 2026. It doesn't license real-money gaming. It prohibits it. Section 5 bars offering online money games, section 6 bars advertising them, and section 7 bars banks and payment intermediaries from processing payments for them, and "online money game" covers games of skill, chance or both played for a stake with an expectation of winnings.
Offering a money game or processing its payments carries up to three years' imprisonment, a fine of up to Rs 1 crore, or both under section 9, and repeat offences carry higher minimums. For a payment aggregator, screening merchants for money gaming is now a criminal-law question rather than a risk-appetite one.
For games that remain legal, the Promotion and Regulation of Online Gaming Rules, 2026 set up registration with the new Online Gaming Authority of India. Registration is compulsory for every game offered as an e-sport, and for a social game only if the Central Government notifies that game or its category; it is per game, per provider, and the certificate lasts up to ten years. The Authority also decides whether a disputed game is a money game, aiming to do so within 90 days. Challenges to the Act's validity are pending in the Supreme Court, with no ruling reported as of September 2026.
Consent to Establish and Consent to Operate
Do all businesses need Pollution Control Board approval? No, and fewer do every year. Section 21 of the Air (Prevention and Control of Pollution) Act, 1981 and section 25 of the Water (Prevention and Control of Pollution) Act, 1974 require the State Board's consent before an industrial plant is established (Consent to Establish) and before it starts operating (Consent to Operate). Since 2016, industries have been sorted into red, orange, green and white categories by a pollution index score.
The white category is now exempt altogether. Notifications of 12 November 2024 under both Acts removed the consent requirement for plants scoring up to 20, on condition they inform the State Board in writing, and a replacement list notified on 8 July 2026 covers 87 sectors. It includes small restaurants without rooms, cloud kitchens, dry-process garment manufacturing and packing of food items without processing, several of them subject to capacity caps. A plant that already holds environmental clearance is exempt from Consent to Establish, but not from Consent to Operate.
For everyone else, the consent guidelines amended on 23 January 2026 make the process lighter. The amended guidelines make Consent to Operate valid until cancelled rather than time-limited, deem Consent to Establish granted for micro and small units in notified industrial estates on a self-certified application, and let States charge a one-time fee. How each State Board implements them varies, so check its portal before assuming a timeline.
Shops, trade licenses and the municipal layer
Every business with premises meets two local approvals that no central regulator issues. Shops and establishments registration is under each State's own Act (Karnataka, for example, registers establishments under its Shops and Commercial Establishments Act, 1961 through the Labour Department's e-Karmika portal). The Centre circulated a Model Shops and Establishments Bill in 2016, but it's a template, not a law, so coverage thresholds differ from State to State.
The trade license is municipal. The Greater Hyderabad Municipal Corporation describes it as "a License issued by the Local authority to run the listed business" within its limits, and other cities use other names; Kolkata calls its version a certificate of enlistment. Whether a business needs one turns on the city's list of trades and the premises, not on the sector regulator.
That answers two questions founders often ask. Does an online business need a trade license? Usually only for the premises it operates from, such as an office, a warehouse or a kitchen, and only if its activity is on the city's list. And a home-food business holding an FSSAI registration may still need a trade license from its municipality, because the food regulator and the city license different things.
Foreign-owned companies: the FDI route and the sector license are separate gates
A foreign parent opening an Indian subsidiary usually asks two questions at once: can we own it, and can it do the business? Indian law answers them separately. Exchange control decides whether and how foreign money can come in, and the sector regulator decides whether the company can carry on the activity, and a yes from one says nothing about the other.
That's exactly how the FDI rules are written. The guide to FDI in India covers sectoral caps and reporting in depth, so this section sticks to where the two gates meet.
The automatic route in regulated financial services, and the words "subject to"
Paragraph 5.2.26 of the Consolidated FDI Policy allows 100 per cent foreign investment under the automatic route in "Financial Services activities regulated by financial sector regulators, viz., RBI, SEBI, IRDA, PFRDA, NHB". The next sub-paragraph makes that "subject to conditionalities, including minimum capitalization norms, as specified by the concerned Regulator". And financial activity that no financial regulator regulates, or regulates only in part, goes to the government route.
Insurance joined the list in 2026. The Insurance Act now permits foreign holdings of up to 100 per cent, and DPIIT's Press Note 1 (2026 Series) of 9 February 2026 put insurers and insurance intermediaries on the automatic route, with at least one of an insurer's chairperson, managing director and chief executive required to be a resident Indian citizen. The same Press Note says in plain terms that companies receiving the investment must still obtain the IRDAI license or approval. The practical reality is that the automatic route means no government approval for the money; it never meant no license for the business.
Outside finance the pattern holds. Telecom services are 100 per cent automatic, but the company still needs an authorisation under the Telecommunications Act. Pharmaceuticals are 100 per cent automatic for greenfield projects, while brownfield investment above 74 per cent needs government approval, and the drug licenses are separate again. E-commerce is 100 per cent automatic for the marketplace model and closed to the inventory model, except that Press Note 3 of 2026, dated 23 July 2026, allows an inventory model used only to export goods made in India, with effect from its FEMA notification.
A common question from founders with NRI or overseas investors is whether the Reserve Bank has to approve the investment first. On the automatic route it doesn't: the investment is reported after the shares are issued, through the company's bank. Sector approvals from the Reserve Bank as a regulator are a different matter, which is why a foreign-funded NBFC talks to two departments of the same institution.
Where the government route still applies, and the land-border rule
Press Note 3 of 2020, dated 17 April 2020, sent every investment from an entity or citizen of a country sharing a land border with India, or whose beneficial owner is such a citizen, to the government route, whatever the sector. That rule sits on top of every automatic-route entry described above, including 100 per cent in financial services.
It was eased in 2026. The Cabinet approved changes on 10 March 2026, and Press Note 2 (2026 Series) of 15 March 2026 rewrote the paragraph so that "beneficial owner" takes its meaning from the Prevention of Money-laundering Act and its rules, tested at the level of the investor entity. According to the Cabinet's release, investors with non-controlling beneficial ownership from a land-border country of up to 10 per cent can use the automatic route, subject to reporting to DPIIT, and proposals in specified manufacturing sectors are to be decided within 60 days.
What most people miss is that even an exempt investment isn't invisible. The new paragraph requires any investment from an investor entity with direct or indirect land-border ownership that doesn't need approval to be reported under DPIIT's procedure, and a later transfer that brings the ownership back within the restriction needs prior approval. A US fund with a small Asian limited partner is exactly the case to check before closing.
A wholly owned subsidiary still needs its own license
A foreign company's wholly owned subsidiary is an Indian company in law, and every license in this guide attaches to it as it would to a founder-owned start-up. The parent's license at home counts for nothing here. A UK payments firm's Indian subsidiary applies for payment aggregator authorisation with its own Rs 15 crore of net worth, and a Singapore lender's Indian NBFC needs its own certificate of registration and its own Rs 10 crore of net owned fund.
Some regulators add ownership-specific tests. The Reserve Bank's rules (the 2025 NBFC Directions and the 2026 payment system authorisation Directions) keep new investors from jurisdictions that the Financial Action Task Force lists as non-compliant below 20 per cent of voting power in NBFCs and payment system operators. Insurance intermediaries with majority foreign ownership must be limited companies with a resident Indian citizen among the chairman, chief executive, principal officer or managing director.
So the sequence for a foreign-owned company is: confirm the FDI route and any land-border issue, incorporate, capitalise to the sector's entry threshold, apply for the license, and only then start the regulated activity. The steps for company registration in India for foreign founders are the first half of that sequence; the license is the second.
After the license: change in control, going abroad and the compliance calendar
Getting the license is the start of a supervisory relationship, not the end of an application. Three events after launch catch licensed businesses most often: a new investor or owner, an expansion outside India, and a filing date nobody owned. Each one has its own rules, and the first two need permission before they happen.
Change-in-control approvals
A license belongs to the regulated entity, but regulators care who owns and runs it, and the approvals that follow from that surprise founders mid-fundraise. For NBFCs the trigger is in paragraph 6 of the Reserve Bank of India (Non-Banking Financial Companies - Acquisition of Shareholding or Control) Directions, 2025.
Prior written permission is needed for any takeover or acquisition of control, whether or not management changes, and for any change in shareholding, "including progressive increases over time", that results in 26 per cent or more of paid-up equity changing hands.
Management has its own test. Paragraph 10 of the NBFC Governance Directions, 2025 requires prior permission for any change that would replace more than 30 per cent of the directors, excluding independent directors and those re-elected on retirement by rotation. Every other change of directors or management still has to be reported.
The progressive-increase wording is the one that catches venture-backed NBFCs. Three rounds in which a single investor takes 9, 9 and then 10 per cent reach the threshold on the third round, even though no single round looked like a change of control. A smarter strategy is to model the cap table before a term sheet is signed, because a funding round that crosses 26 per cent can't close until the Reserve Bank has said yes. After permission comes a public notice in one national and one local vernacular newspaper at least 30 days before the transfer takes effect.
Payment companies run on a different circular. Paragraph 7(c) of the Payment Aggregator Directions applies the Reserve Bank's circular of 4 July 2022 on non-bank payment system operators, which requires prior approval for a takeover or acquisition of control, and 15 calendar days' public notice once it's approved. A change of directors needs no approval, but it must be reported within 15 calendar days.
How long does the Reserve Bank take? Its Citizen's Charter lists 90 days for both an NBFC shareholding or control approval and a payment operator takeover, counted from a complete application. The 2022 circular said the Reserve Bank would "endeavour" to respond in 45 days, and deal timetables built on that older figure tend to slip. For a buyer, the regulatory approval is a condition precedent to completion, which is one of the ways acquiring a licensed company differs from buying an ordinary one.
Setting up a subsidiary abroad when you're a regulated entity
Success at home often leads to the same next step: a subsidiary in Singapore, Dubai or London. For an ordinary Indian company that's overseas direct investment under the automatic route, filed on Form FC through an authorised dealer bank, as explained in the guide to setting up a subsidiary abroad from India. A regulated financial entity has an extra gate in front of that process.
Paragraph 16 of the NBFC Undertaking of Financial Services Directions, 2025 says an NBFC "shall obtain prior approval of the RBI" before opening a subsidiary or joint venture abroad or investing abroad. Paragraph 17 limits that investment to the financial sector, in entities whose core activity is regulated by a financial regulator in the host country. The same paragraph sets the eligibility conditions an NBFC has to meet on the day it applies.
Condition for an NBFC investing abroad | What the 2025 Directions require |
Profitability | In profit for the last three financial years, with satisfactory performance |
Asset quality | Net non-performing assets not more than 5 per cent of net advances |
Size of the investment | Aggregate overseas investment within 100 per cent of net owned fund, and within 15 per cent of owned funds in any single entity including its step-down subsidiaries |
Capital after investing | Capital adequacy or leverage and net owned fund still at regulatory levels |
Structure | No multi-layered, cross-jurisdiction structure; at most one intermediate holding entity |
For a subsidiary | No parent guarantee or letter of comfort from India; liability limited to the equity or fund-based commitment; not a shell; not used to raise money for assets in India |
Afterwards | An annual statutory auditor's certificate to the Reserve Bank's Department of Supervision |
The exchange control rules add a parallel test for any Indian entity. Schedule I, paragraph 2(1) of the Foreign Exchange Management (Overseas Investment) Rules, 2022 lets an Indian entity engaged in financial services make ODI in a foreign financial services entity only if it has posted net profits in the preceding three financial years, is registered with or regulated by a financial services regulator in India, and holds the approvals required from the regulators in India and the host country. An Indian company that isn't in financial services can invest in a foreign financial services business too (except banking and insurance), provided it has three years of net profits.
In practice, then, the order is the Reserve Bank's no-objection first, the host regulator's approval in parallel, and only then the Form FC filing and unique identification number through the bank. The Reserve Bank's no-objection is independent of the host regulator's decision, and neither replaces the other. One trap is specific to the new exemption: an Unregistered Type I NBFC that wants to invest overseas in financial services has to register first and then seek prior approval, and it may not invest overseas outside the financial sector at all.
The recurring filings that keep a license alive
The 2026 reforms removed most renewals, and that's good news with a catch. A license that no longer expires can still be suspended, and the triggers are now an unpaid annual fee, a missed return or a capital figure that slipped, none of which announces itself the way an expiry date does.
Obligation | Who it applies to | When | If it's missed |
FSSAI annual fee | Every registered or licensed food business | Every year (can be prepaid for several years) | License or registration deemed suspended until paid |
FSSAI annual return | Manufacturers, repackers, relabellers, importers, manufacturer-exporters | By 31 May | Rs 100 a day, up to five times the annual license fee; deemed suspension |
IEC update | Every IEC holder | April to June every year | IEC deactivated until updated |
IRDAI annual fee | Brokers, corporate agents, web aggregators, insurance marketing firms and common public service centres | Before 31 January | Certificate suspended from 1 April; cancelled if unpaid with 20 per cent extra within three months |
Fresh IRDAI certificate | The same intermediaries, if registered before the 2026 amendment | Before 31 January 2027 | Must stop acting after 31 March 2027 |
Adviser or analyst deposit revision | SEBI-registered investment advisers and research analysts | By 30 April, based on the previous year's peak client count | Breach of the regulations |
Net owned fund glide path | Existing NBFC-ICCs | Rs 10 crore by 31 March 2027 | Not eligible to hold a certificate of registration |
Net worth step-up | Payment aggregators (Rs 25 crore) and PPI issuers (Rs 15 crore) | By the end of the third financial year after authorisation | Breach of authorisation conditions |
Board resolution on Type I status | Unregistered Type I NBFCs | Start of every financial year | Exemption conditions not met |
Cosmetics import registration retention fee | Holders of Form COS-2 | Before each five-year period ends | Late fee, then deemed cancellation after 180 days |
Branches multiply these obligations. Food licenses and drug sale licenses are granted premises by premises, a business in two or more States also needs a Central FSSAI license for its head office, and moving a pharmacy or a kitchen to a new address usually means a new or modified license rather than a change of letterhead. As a rule these licenses are granted to a named entity for named premises, so a buyer of the business's assets usually applies afresh, while a sale of the licensed company itself runs into the change-in-control approvals described above.
Most of these dates sit outside the company law calendar that a secretarial team already runs, which is why they get missed. We'd recommend putting every regulator date into the same compliance calendar as the annual ROC filings, with one named owner. The capital tests belong with the finance function: a quarterly check of net worth or net owned fund against each regulator's floor is the kind of work a virtual CFO can run on a fixed monthly scope, and it's far cheaper than discovering a shortfall at audit.
A regulated entity that has also set up a subsidiary abroad adds the overseas investment calendar on top, including the Annual Performance Report due every 31 December and, for an NBFC, the auditor's annual certificate to the Reserve Bank on its overseas investments.
Penalties for operating without a license
Should you start trading and pay the penalty later? It's a question that turns up on Quora, usually from someone whose product is ready and whose application isn't. The honest answer is that the statutory penalty is rarely the largest cost, and in the financial sectors it isn't even the most likely one.
Law | Operating without the license or registration | Maximum exposure (September 2026) |
RBI Act, 1934, s.58B(4A) | Carrying on NBFC business without a certificate of registration | Imprisonment of 1 to 5 years and a fine of Rs 1 lakh to Rs 25 lakh; separately, an RBI penalty of Rs 10 lakh or twice the amount involved under s.58G |
Payment and Settlement Systems Act, 2007, s.26(1) | Operating a payment system without authorisation | Imprisonment of 1 month to 10 years, or a fine up to Rs 1 crore, or both, plus up to Rs 1 lakh a day |
SEBI Act, 1992, ss.15EB and 24 | Acting as an investment adviser or research analyst without registration | Penalty up to Rs 1 crore under s.15EB; prosecution under s.24 carries up to 10 years or Rs 25 crore, or both |
Insurance Act, 1938, s.105BA | Acting as an insurance intermediary without registration | Rs 1 lakh to Rs 10 lakh; Rs 10 lakh to Rs 1 crore for anyone who appoints or transacts through the unregistered intermediary |
Drugs and Cosmetics Act, 1940, s.27(b)(ii) | Selling or making drugs without a license | Imprisonment of 3 to 5 years and a fine of at least Rs 1 lakh or three times the value of drugs confiscated; not compoundable |
Food Safety and Standards Act, 2006, s.63 | Carrying on a food business that needs a license without one | Penalty up to Rs 10 lakh (no imprisonment since 8 November 2023) |
Telecommunications Act, 2023, s.42(1) | Providing telecom services or a network without authorisation | Imprisonment up to 3 years, or a fine up to Rs 2 crore, or both |
Online Gaming Act, 2025, s.9 | Offering an online money game (banned, not licensable) | Imprisonment up to 3 years, or a fine up to Rs 1 crore, or both; advertising one, up to 2 years or Rs 50 lakh |
Financial services: the heaviest exposure
The financial regulators combine criminal provisions with civil powers, and the civil powers move faster. Alongside prosecution under section 58B(4A), section 58G of the Reserve Bank of India Act lets the Reserve Bank itself penalise an unregistered NBFC and add up to Rs 1 lakh for every day the default continues, with no court involved.
SEBI's toolkit reaches the money directly. Section 15EB caps the penalty for adviser and analyst defaults at Rs 1 crore, but section 11B lets SEBI direct disgorgement of wrongful gains, and the December 2025 order impounded about Rs 546 crore and froze accounts on a prima facie finding, before any final hearing, although the appellate tribunal later cut the required deposit to Rs 100 crore. That's the real exposure: a business that loses access to its bank accounts and the market while the case runs.
Insurance now penalises both sides of an unregistered arrangement. Under section 105BA of the Insurance Act, the unregistered intermediary faces Rs 1 lakh to Rs 10 lakh, but the insurer that used it faces Rs 10 lakh to Rs 1 crore, and every director or officer who was knowingly a party is separately liable.
Food, drugs and gaming
Food and drugs now sit at opposite ends. An unlicensed food business faces a civil penalty with no prison term, and a small business that should have registered but didn't sits outside section 63 of the Food Safety and Standards Act altogether, so it may attract a penalty of up to Rs 2 lakh under the general provision in section 58 instead.
Drugs are still firmly criminal. Unlicensed sale or manufacture under section 27(b)(ii) of the Drugs and Cosmetics Act carries a minimum of three years' imprisonment and isn't among the offences that can be compounded. A pharmacy start-up that opens an unlicensed dark store is taking a criminal risk, not a regulatory one.
Online money gaming isn't licensable at all, and the offences of offering it or processing its payments are cognizable and non-bailable.
What decriminalisation did, and did not, change
The Jan Vishwas (Amendment of Provisions) Act, 2023 decriminalised or rationalised 183 provisions across 42 central Acts, commencing Act by Act. It turned the food license offence into a civil penalty, removed imprisonment from several Legal Metrology offences, converted two lesser payment-system offences into Reserve Bank penalties, and extended compounding to more drug offences. It also builds in inflation: fines and penalties in the scheduled Acts rise by 10 per cent of the minimum amount every three years.
The Jan Vishwas (Amendment of Provisions) Act, 2026 went further, amending 784 provisions across 79 central Acts, 717 of them decriminalised. It's law, but each part starts on its own notified date: its Drugs and Cosmetics Act changes, which move minor cosmetic and record-keeping lapses to adjudication, take effect only on 30 June 2027.
Neither Act took imprisonment out of the core offences in this guide. Unlicensed NBFC business, operating an unauthorised payment system and unlicensed drug sales are all still punishable with jail, and unregistered securities advice still exposes a business to SEBI's penalties, disgorgement and prosecution. Decriminalisation made paperwork lapses cheaper. It didn't make operating without a license any safer.
How to check whether a business actually holds the license it claims
Verification matters from both sides of a deal. A founder choosing a lending partner, payment provider or insurance distributor needs to know the partner is licensed, and so does an investor doing diligence, and every regulator in this guide publishes enough to check in a few minutes.
RBI lists: NBFCs, payment operators, lending apps and the Alert List
For NBFCs, the Reserve Bank publishes the list of NBFCs registered with it, with a separate list of companies whose certificates were cancelled; the list is a periodic snapshot (the current one is dated 30 June 2026), not a live register. For payments, the Reserve Bank's page of authorised payment system operators lists wallet issuers and payment aggregators by category, including PA-Online, PA-Physical and PA-Cross Border.
Two Reserve Bank lists need reading with care. The Alert List of unauthorised forex trading platforms named 95 entities at its last update on 19 November 2025, and it warns that it "is not exhaustive", so absence from it proves nothing. And the directory of digital lending apps is compiled from lenders' own reports and published without Reserve Bank verification, so a listed app isn't endorsed by the regulator.
One more caution applies from July 2026. A company missing from the NBFC list may be a lawful Unregistered Type I NBFC with no public funds and no customers, so absence isn't proof of wrongdoing on its own. What such a company can't lawfully do is take public money or lend to customers, which is the thing to check.
SEBI advisers and analysts, and the @valid payment handle
How do you know whether a Telegram tip channel is SEBI-registered? Search SEBI's registered intermediaries lists for investment advisers and research analysts, which in September 2026 held over 1,000 and over 2,000 names respectively, and match the registration number and name to the channel. Then check how it takes payment. Since 1 October 2025 investor-facing registered intermediaries have offered UPI IDs on the exclusive "@valid" handle for collecting payments, with a type suffix such as "ia" or "ra", and SEBI's SEBI Check tool verifies a UPI ID or bank account before you pay.
But the @valid handle only proves the payee is registered. It doesn't prove that a specific recommendation is compliant, and a registered adviser can still breach the rules.
FSSAI licenses on FoSCoS
Food licenses are the easiest to check. Enter the 14-digit number printed on the label or bill into the FBO search on FSSAI's FoSCoS portal, which also has a separate search for e-commerce food businesses, or scan the QR code on newer certificates with the Food Safety Connect app. A number that doesn't resolve, or resolves to a different business or address, is the answer.
Sector-specific licenses in India: the order to apply in
Most of the expensive mistakes in this guide are sequencing mistakes: shares issued before the FDI route was checked, launch before the certificate arrived, capital raised in a form the regulator doesn't count. The order below keeps every gate in front of the activity it controls.
The ten steps, in order
Map every activity, not the product. List what the business will do with money, food, medicines, data, networks and packaged goods, run the Know Your Approvals questionnaire on the National Single Window System, and test each activity against its regulator.
Choose the entity with the license in mind. Payment aggregators must be companies incorporated in India, foreign-majority insurance intermediaries must be limited companies, and words such as "bank" or "insurance" in a company name need a declaration at incorporation that the regulator's requirements have been met.
If any shareholder is foreign, confirm the FDI route, the sectoral conditions and any land-border beneficial ownership before a single share is issued.
Incorporate, open the bank account, and take the general registrations: PAN, GST where it applies, professional tax and shops registration.
Capitalise to the regulator's entry threshold in the form it counts: net owned fund for an NBFC, net worth for a payment aggregator or portfolio manager, a deposit for an adviser, capital for a broker.
Appoint the people the license depends on: the principal officer, the qualified adviser, the registered pharmacist, the compliance officer, and a director with banking or NBFC experience for a lender.
Secure the premises approvals: trade license, fire and building approvals, pollution consent or white-category intimation, and a separate FSSAI or drug license for each premises.
File the sector application complete, with every attachment, because the regulator's clock starts only on a complete application.
Add the trade-level registrations before the first shipment or pack: the Importer-Exporter Code, BIS certification for notified products, and Legal Metrology packer or importer registration.
Launch only after the license is in hand, then put every recurring fee, return, capital test and change-in-control trigger into one compliance calendar with one owner.
Step 2 overlaps with the general incorporation process, which the guide on how to register a startup in India covers document by document.
How long it takes, and what goes wrong when the order slips
How long do sector licenses take? The honest range runs from minutes to many months. An FSSAI registration can issue instantly, and FSSAI's ordinary timelines are 7 days for a registration and 60 days for a license. The Reserve Bank's Citizen's Charter commits to 90 days for an NBFC certificate or a payment system's in-principle authorisation, counted from a complete application, and CDSCO has up to six months to decide a cosmetics import registration.
Those are the regulator's clocks, not the project's. In practice, the time goes on steps 3, 5 and 6: an FDI structure that has to be unwound, capital that has to be re-infused as equity because the regulator doesn't count it, or a principal officer who hasn't cleared the examination. Build the plan backwards from the launch date with those steps first.
Order also has consequences that no penalty table shows. A refused payment system application can bring a one-year cooling period that also binds new entities set up by the same promoters. An investor who crosses 26 per cent of an NBFC without approval has created a problem only the Reserve Bank can fix. And a business that launches first hands its regulator the easiest possible case, as the SEBI order at the top of this guide shows.
If mapping licenses, capital thresholds and a regulator's filing calendar is pulling your team away from launch, Outsource360's company registration and compliance service handles incorporation and application paperwork, its legal team supports fintech compliance and regulatory contracts, and its virtual CFO service tracks net worth and net owned fund against each regulator's floor. Book a consultation to work out which approvals your business actually needs.
Frequently asked questions
Does every business in India need a sector-specific license?
No. A software firm, consultancy or agency usually needs only general registrations such as GST, professional tax and shops registration. A sector license is needed before a business starts a regulated activity like food, lending, payments, securities advice, insurance distribution or medicines.
What is the difference between a registration and a license in India?
The labels aren't a reliable guide. An NBFC or SEBI "registration" involves capital tests and ongoing supervision, while an FSSAI registration for a small food business is a light enrolment. What matters is what the regulator checks before granting it and what it can take away.
What is the difference between FSSAI registration and an FSSAI license?
From 1 April 2026, turnover up to Rs 1.5 crore needs registration (Rs 100 a year), up to Rs 50 crore a State license (Rs 5,000) and above that a Central license (Rs 7,500). Importers and e-commerce food businesses need a Central license at any turnover.
Do I have to renew my FSSAI license?
No. Since the 2026 amendment, a license or registration stays valid until suspended, cancelled or surrendered. But the annual fee is still due, and an unpaid fee or a missed return means the license is deemed suspended until the business pays or files.
Must every NBFC register with RBI?
Most must, under section 45-IA of the RBI Act, with net owned fund of Rs 10 crore for an investment and credit company. From 1 July 2026, an NBFC with no public funds, no customer interface and assets below Rs 1,000 crore is exempt.
Do wallets and in-app balances need RBI approval?
Only if they work beyond the issuer's own goods and services. A closed wallet with no cash-out needs no authorisation. A wallet usable at other merchants needs authorisation and net worth of Rs 5 crore, rising to Rs 15 crore by the end of the third financial year.
Does a lending app need its own RBI license?
No. The Reserve Bank licenses the lender, not the app. The app acts as a lending service provider for a bank or NBFC, which stays responsible for it and reports it on RBI's CIMS portal, and a listing in RBI's app directory is not an endorsement.
Can I sell stock tips as "education" without SEBI registration?
No. Stock-specific calls, targets and stop-losses are research or advice whatever the course is called. A December 2025 SEBI interim order treated such paid "education", prima facie, as unregistered advice and impounded about Rs 546 crore, later cut to a Rs 100 crore deposit.
Do I need SEBI registration if I only advise clients outside India?
An investment adviser serving only clients based outside India is exempt under regulation 4(i) of the Investment Advisers Regulations. Advising a single non-resident Indian or person of Indian origin ends the exemption, and research analysts have no equivalent exemption.
How do I get an insurance broker license in India?
Apply to IRDAI with minimum capital of Rs 75 lakh (direct broker), Rs 4 crore (reinsurance) or Rs 5 crore (composite), and a qualified principal officer who has passed the broker examination. Registration no longer lapses, but an annual fee is payable.
Is it legal to sell medicines online in India?
There is no dedicated online pharmacy license: draft e-pharmacy rules from 2018 were never notified. An online model has to run through ordinary drug sale licenses, one for each premises where drugs are stocked, with a registered pharmacist supervising retail supply.
How long do sector licenses take in India?
From instant to several months. An FSSAI registration can issue instantly, with 60 days the ordinary timeline for a license. RBI commits to 90 days for an NBFC certificate from a complete application, and a cosmetics import registration can take six months.
Can I start operating and apply for the license later?
No. Every regime here requires the license first. Unregistered NBFC business carries up to five years' imprisonment and an unauthorised payment system up to ten, and SEBI can impound funds and freeze accounts before any final hearing.
Do I need separate licenses for each branch or state?
Often, yes. FSSAI licenses and drug sale licenses are granted premises by premises, and a food business in two or more States also needs a Central license for its head office. An NBFC certificate, by contrast, attaches to the company, not its branches.
How do I check whether a company is really RBI or SEBI registered?
Search RBI's lists of registered NBFCs and authorised payment system operators, and SEBI's lists of registered investment advisers and research analysts. SEBI-registered intermediaries offer UPI IDs on the "@valid" handle, which the SEBI Check tool verifies.
Do foreign-owned companies need extra licenses in India?
They need the same sector licenses as an Indian-owned company, plus compliance with the FDI route. Regulated financial services allow 100 per cent FDI on the automatic route, but only subject to each regulator's own conditions and license.
References
Food Safety and Standards Act, 2006, sections 31, 58 and 63, as amended by the Jan Vishwas (Amendment of Provisions) Act, 2023 (in force for this Act from 8 November 2023, S.O. 4834(E)), fssai.gov.in.
Food Safety and Standards Authority of India: FSS (Licensing and Registration of Food Businesses) Amendment Regulations, 2026, notified 10 March 2026, egazette.gov.in; order on revised turnover thresholds, 13 March 2026; FAQs on the 2026 amendment regulations, 27 March 2026; FoSCoS kind-of-business eligibility and fee table updated 1 April 2026, foscos.fssai.gov.in; order on e-commerce and the ONDC model, 18 March 2026; advisory on e-commerce food businesses, 3 December 2024; advisory on annual return submission, 16 April 2024; orders of 8 June 2021 and 30 September 2021 on license numbers in invoices; order of 1 July 2024 on processing timelines.
Food Safety and Standards (Labelling and Display) Regulations, 2020, regulation 5(7), fssai.gov.in.
Reserve Bank of India Act, 1934, sections 45-I, 45-IA (including the Explanation defining net owned fund), 58B and 58G, indiacode.gov.in.
Reserve Bank of India (Non-Banking Financial Companies - Registration, Exemptions and Framework for Scale Based Regulation) Directions, 2025, 28 November 2025, paragraphs 6, 38 to 43 and 65A, as amended by the Amendment Directions of 29 April 2026 (in force 1 July 2026), rbi.org.in; companion Directions of the same date on Acquisition of Shareholding or Control (paragraph 6), Governance (paragraphs 8 and 10), Undertaking of Financial Services (paragraphs 16 to 18), Credit Facilities (Chapter III, digital lending), Peer to Peer Lending Platform and Account Aggregator; Housing Finance Companies Directions, 2025; circular of 28 November 2025 withdrawing 9,445 circulars.
Reserve Bank of India, payment systems: Payment and Settlement Systems Act, 2007, sections 4, 26 and 30; Master Direction on Regulation of Payment Aggregators, 15 September 2025, rbi.org.in; Master Directions on Prepaid Payment Instruments, 27 August 2021 (updated 27 December 2024), and draft Master Direction released 22 April 2026; Master Directions on Authorisation to operate a Payment System, 15 June 2026; circular of 4 July 2022 on takeover and change in management of non-bank payment system operators.
Reserve Bank of India: Citizen's Charter, rbi.org.in; list of registered NBFCs; list of authorised payment system operators; Alert List of unauthorised forex trading platforms, updated 19 November 2025.
Foreign Exchange Management (Overseas Investment) Rules, 2022, Schedule I, paragraph 2, rbi.org.in; Reserve Bank of India, Master Direction - Overseas Investment, 24 July 2024.
Securities and Exchange Board of India Act, 1992, sections 11B, 12, 15EB, 15HB and 24, sebi.gov.in.
Securities and Exchange Board of India: Investment Advisers Regulations, 2013 and Research Analysts Regulations, 2014, as amended to 25 November 2025; guidelines for investment advisers and research analysts, 8 January 2025; circular of 12 August 2025 on the form of deposit; recognition of BSE Limited as the administration and supervisory body, 12 July 2024; Portfolio Managers Regulations, 2020, regulations 9 and 23; Alternative Investment Funds Regulations, 2012, regulations 10 and 19D to 19F, as amended to 14 July 2026; Intermediaries Regulations, 2008, regulation 16A; circulars of 22 October 2024, 29 January 2025 and 8 May 2026 on association with unregistered persons and price data for education; circular of 11 June 2025 on validated UPI handles; Stock Brokers Regulations, 2026, sebi.gov.in.
Securities and Exchange Board of India, ex parte interim order cum show cause notice dated 4 December 2025, sebi.gov.in; Securities Appellate Tribunal, judgment of 22 January 2026 in Appeal No. 545 of 2025; Supreme Court of India, order of 16 March 2026 in Civil Appeal No. 3153 of 2026.
Insurance Act, 1938, sections 2(10B), 2C, 3AA, 42D and 105BA, as amended by the Sabka Bima Sabki Raksha (Amendment of Insurance Laws) Act, 2025, egazette.gov.in.
Insurance Regulatory and Development Authority of India: Insurance Brokers Regulations, 2018; Registration of Corporate Agents Regulations, 2015; Insurance Web Aggregators Regulations, 2017; Insurance Intermediaries (Amendment) Regulations, 2026, published 30 July 2026, egazette.gov.in; FAQs on the 2026 amendment regulations, irdai.gov.in.
International Financial Services Centres Authority Act, 2019, sections 13(1) and 13(5) and the First Schedule, dea.gov.in.
Drugs and Cosmetics Act, 1940, sections 18(c), 27 and 32B, and Drugs Rules, 1945, rules 61, 62, 64 and 65, Central Drugs Standard Control Organisation, cdsco.gov.in; draft rules on sale of drugs by e-pharmacy, G.S.R. 817(E), 28 August 2018; Ministry of Health and Family Welfare reply in the Rajya Sabha, 8 August 2023; S.O. 3286(E), 22 June 2026, on commencement of the 2026 amendments.
Medical Devices Rules, 2017, including G.S.R. 777(E) of 14 October 2022 and G.S.R. 744(E) of 14 August 2026; Cosmetics Rules, 2020, rules 12 to 14, 23 and 27, cdsco.gov.in.
Directorate General of Foreign Trade, Foreign Trade Policy 2023, paragraph 2.05, dgft.gov.in; Handbook of Procedures 2023, Chapter 2; Appendix 2K.
Bureau of Indian Standards Act, 2016, sections 16 and 17; Electronics and Information Technology Goods (Requirement of Compulsory Registration) Order, 2021, egazette.gov.in; Transition Facilitation (Quality Control) Order, 2026, 25 June 2026.
Legal Metrology Act, 2009, sections 19 and 36, and Legal Metrology (Packaged Commodities) Rules, 2011, rule 27; Department of Consumer Affairs releases of 20 May 2026 and 28 May 2026, pib.gov.in.
Telecommunications Act, 2023, sections 3 and 42, egazette.gov.in; S.O. 3368(E), 23 June 2026; G.S.R. 510(E) to 513(E), 23 June 2026, and G.S.R. 644(E), 20 July 2026, Department of Telecommunications; Other Service Provider guidelines, 5 November 2020 and 23 June 2021.
Promotion and Regulation of Online Gaming Act, 2025, sections 2, 5 to 7, 9 and 10, meity.gov.in; S.O. 1994(E), 22 April 2026; Promotion and Regulation of Online Gaming Rules, 2026, G.S.R. 303(E).
Air (Prevention and Control of Pollution) Act, 1981, section 21, and Water (Prevention and Control of Pollution) Act, 1974, section 25; Ministry of Environment, Forest and Climate Change notifications G.S.R. 702(E) and 703(E), 12 November 2024, G.S.R. 598(E) and 599(E), 8 July 2026, and consent guidelines as amended by G.S.R. 62(E) and 63(E), 23 January 2026, pib.gov.in.
Karnataka Shops and Commercial Establishments Act, 1961 (e-Karmika); Greater Hyderabad Municipal Corporation, trade license; Ministry of Labour and Employment, Model Shops and Establishments Bill, 2016.
Aircraft Rules, 1937, rules 134 and 134A, continued under the Bharatiya Vayuyan Adhiniyam, 2024; Drone Rules, 2021, as amended in 2022.
Department for Promotion of Industry and Internal Trade: Consolidated FDI Policy, paragraphs 3.1.1, 5.2.14, 5.2.15, 5.2.22, 5.2.26 and 5.2.27, dpiit.gov.in; Press Note 3 (2020 Series), 17 April 2020; Press Note 1 (2026 Series), 9 February 2026; Press Note 2 (2026 Series), 15 March 2026; Press Note 3 (2026 Series), 23 July 2026; Cabinet decision of 10 March 2026.
National Single Window System, nsws.gov.in; DPIIT Year End Review 2025.
Jan Vishwas (Amendment of Provisions) Act, 2023 (Act No. 18 of 2023), egazette.gov.in, and Jan Vishwas (Amendment of Provisions) Act, 2026 (Act No. 8 of 2026), egazette.gov.in.
Disclaimer
This article is for educational and general business information purposes only and does not constitute professional legal, financial, or tax advice. It describes the Indian regulatory position as it stood on the date at the top of this page, and licensing rules, thresholds, fees and penalties change by notification, circular and amendment, sometimes with little notice. The SEBI matter described in the introduction was pending at the time of writing, and its findings were prima facie. Before starting a regulated activity, applying for a license or relying on an exemption, consult a qualified professional and check the regulator's current instruments.
Comments