Startup due diligence checklist: what investors and acquirers look for
Authored by - Adv. Pranay Sawant, Senior Executive at Outsource360
In 2022, a car-servicing startup in Gurugram went back to the market for money. It had closed several rounds already, counted some of the best-known venture funds in India among its shareholders, and had raised more than USD 50 million along the way. On paper, it had been through a startup due diligence checklist more than once.
This time the checking went further. The prospective investors' diligence didn't stop at the documents the company handed over: it tested the reported revenue against the records underneath, and reportedly found it inflated. The new money walked away.
On 18 January 2023, one of the co-founders publicly admitted "errors in judgement" on financial reporting and announced that about 70 per cent of staff would be let go, as TechCrunch reported that day. The existing investors said they were "deeply distressed" that facts had been knowingly misstated, and brought in a third-party firm for a forensic audit. In late March 2023 a distressed sale of the business was announced, and the equity investors were written off. The company was GoMechanic.
Here's the detail that makes it a checklist story. One of the investors later said the company had slipped past several rounds of audits and diligence, and that the fund now asks founders to show live online bank statements on a video call. But the documents weren't the weak point. What they were checked against was.
Acquirers get caught the same way. In September 2021 JPMorgan Chase announced it was buying Frank, a US student financial-aid startup, for about USD 175 million, on the strength of a claimed 4.25 million users. When the bank asked to verify them, a third-party data vendor agreed by both sides checked the list and confirmed a file of more than 4.25 million rows. It checked the count and that the fields were filled in, not whether the people were real.
According to prosecutors, the real number was about 300,000, and the list the vendor checked had been built from synthetic data. A jury convicted two of the company's executives in March 2025, and the US Attorney's Office for the Southern District of New York set out the scheme in its sentencing release of 29 September 2025.
Both deals had a checklist, and both checklists were answered. What failed was the column most published checklists leave out: not what the reviewer asks for, but how the answer is verified, and what it then does to the deal. The upside is just as concrete: a company whose numbers trace cleanly to the bank, the GST portal and the product database gives a reviewer nothing to reprice.
A startup due diligence checklist is the list of records, numbers, contracts and approvals an investor or acquirer verifies before committing money. It covers ten workstreams: corporate records and cap table, financial, tax, legal, HR, regulatory licenses, data protection, technology, deal approvals and red flags. Investors test whether the company is what it claims; acquirers also test what transfers.
Every workstream below follows the same pattern: what the reviewer asks for, where it usually breaks, how it's verified, and whether it weighs more with an investor or an acquirer. Two framing questions come first: who is checking, and how deep they go at each stage.
On this page
What a startup due diligence checklist covers, and who is checking
How deep due diligence goes at each stage, from pre-seed to acquisition
Corporate records and the cap table
Financial due diligence checklist: proving the revenue is real
Tax due diligence under the Income-tax Act, 2025
Legal due diligence checklist for India: contracts, IP and litigation
HR due diligence checklist under the labour codes
Regulatory and licensing due diligence: does the target hold what it needs?
Data protection and the data room under the DPDP Act
Technology and product due diligence
What an acquirer checks that an investor does not
Cross-border: what a US, UK or Singapore investor or acquirer adds
Due diligence red flags, and what each one does to the deal
Preparing for due diligence: a founder's 90-day readiness plan
The default throughout is an India-incorporated private limited company, and the Indian rules cited here aren't universal: a later section covers what a US, UK or Singapore party adds. This is the checklist; the process guides on raising a round and on selling a company, each linked where it becomes relevant, cover the steps around it.
What a startup due diligence checklist covers, and who is checking
Due diligence is the buyer's half of a simple bargain. The company makes claims about its revenue, users, ownership and compliance, and the investor or acquirer checks them before any money moves. A startup due diligence checklist is the working list for that check, split into workstreams so that lawyers, accountants and technical reviewers can each take a share.
The common types take their names from the workstream: financial, tax, legal, HR, commercial, technical and regulatory. What sets a startup apart isn't the list but the evidence. An established business brings years of audited accounts, so the reviewer hunts for hidden liabilities. A startup brings a year or two of audits, a fast-moving MIS (the management information pack its board sees) and a forecast, so more effort goes into proving basic claims are true at all.
Investor diligence and acquirer diligence are different exercises
An investor in a priced round buys a minority stake; an acquirer buys control, and with it every liability the company has ever created. That one difference sets the depth, cost and consequences of everything a reviewer finds.
Question | Investor in a priced round | Acquirer buying control |
What is being bought | A minority stake, usually new shares, in a company the founders keep running | Control, usually the existing shares, and every liability that comes with them |
Depth | The claims the valuation rests on, and clean title to the new shares | All of that, plus what transfers: contracts, licenses, people, tax history |
Who pays | The investor, though a term sheet may have the company reimburse agreed legal costs at closing | Each side pays its own advisers; a seller may also commission vendor diligence |
What drives the timeline | Data-room readiness and the lead investor's internal approvals | Readiness, plus third-party consents and regulators' clocks |
What a finding becomes | A condition to fix before funding, a post-closing covenant, a lower valuation, or no deal | A price cut, escrow or holdback, specific indemnity, condition precedent, or walk-away |
The document that closes it | Share subscription agreement (SSA) and shareholders' agreement (SHA), with warranties | Share purchase agreement (SPA), with a disclosure letter against the warranties |
Here's the thing: an investor who finds a problem usually wants it fixed, while an acquirer wants it priced, because the acquirer will own the consequences. How the purchase agreement and the disclosure letter carry that weight is part of the full legal process for an acquisition, and the red-flag tiers later in this checklist show which findings go where. The overlap is still large: nine of the ten workstreams below apply to either kind of buyer.
Confirmatory, full-scope and vendor (sell-side) diligence
Diligence also varies with timing. Before a term sheet or letter of intent, a buyer does exploratory work on the market, team, headline metrics and cap table. After signing, confirmatory diligence tests every claim in the pitch against a record, and an acquirer may run a bring-down check before closing. Fair warning: confirmatory doesn't mean ceremonial, and treating it as paperwork is where most founders go wrong.
Full-scope diligence is the acquisition-grade version, with every workstream at full depth. Vendor diligence reverses the direction: the seller commissions the report and shares it with bidders, who run their own confirmatory checks. And for a founder planning an exit, a vendor report (or at least a private dry run of one) surfaces problems while there's still time to fix them rather than price them.
Who actually does the work? Usually the lead investor, through outside counsel, a chartered accountancy (CA) firm for financial and tax, and sometimes a technical adviser; the rest of the round relies on the lead's reports. An acquirer goes deeper, and brings in forensic accountants when the numbers look too good.
Is it a good sign when a strategic acquirer hands its diligence to an outside firm, as one founder asked on r/Entrepreneur? Usually it means the buyer is spending real money on the deal. The catch? Outside advisers work from a standard request list and a fee budget, so they ask for everything; a tidy data room with a written Q&A log steers them to what applies.
The ten workstreams on every checklist
Here are the ten, in the order this checklist takes them. Each one links to its section.
Corporate records and the cap table: who owns what, and whether the filings prove it.
Financial, which tests whether revenue, cash and receivables are real.
Tax: returns, TDS, GST, open demands and any legacy angel-tax year.
Legal, covering material contracts, the chain of title to IP, and litigation.
HR under the labour codes, from appointment letters to ESOP approvals.
Regulatory licenses: does the company hold what its sector needs, and will each one survive the deal?
Data protection, including how the data room itself is run.
Technology and product: code ownership, security and any AI claims.
What an acquirer adds, from the approvals a deal needs to how findings become terms.
Red flags, sorted by what each one does to the deal.
Two further sections sit outside the ten: what a US, UK or Singapore party adds, and a founder's 90-day plan for getting ready. If a term sheet is already on the table, read the plan first.
How deep due diligence goes at each stage, from pre-seed to acquisition
Depth tracks the size of the cheque and the degree of control. An angel can't justify a forensic audit of a pre-product company; an acquirer buying the whole company can't justify skipping one. So what changes between seed and Series A (the question founders ask most) is less the list than the standard of proof.
Pre-seed and seed: founders, cap table and who owns the code
At pre-seed and seed, the reviewer mostly tests people and ownership: reference calls, the founders' GitHub and the product, any revenue or pilots, a few customer conversations. On paper the ask is short: incorporation documents, the cap table, the founders' agreement, and proof that the code, domain and brand sit with the company. Pre-MVP rounds lean harder still on the founders: are they full-time, does their equity carry leaver terms, and does a former employer or an early contractor have a claim on the code?
What can USD 30,000 of diligence really check at a five-to-ten-person startup, as a founder asked on X and again on r/Entrepreneur? Let's be honest: it buys a lawyer's read of the corporate file and the IP chain and an accountant's tie-out of bank statements to the reported numbers, not a forensic audit. Angels and seed funds differ more in process than in substance (a call and a shared folder against a written request list), but neither will forgive a cap table that doesn't add up.
Series A and later: the numbers have to reconcile to source
At Series A the standard of proof changes: the MIS has to reconcile to the books, the books to the GST returns and bank statements, and the customer list to signed contracts. And later rounds add depth rather than new categories, such as customer calls, a technology review and a harder look at unit economics.
One Indian founder's thread on r/StartUpIndia is worth reading before any term sheet: after signing, the investor added commercial diligence and a new law firm, and the company spent about Rs 4 lakh on compliance clean-up it hadn't budgeted for. A smarter strategy is to fix the diligence scope, a target timeline and a cap on reimbursed legal costs in the term sheet, before agreeing exclusivity. The other trap is cleaning up during diligence: a filing made in week three shows up on the MCA record with its date, and the reviewer will ask what else was fixed that week.
A strategic acquisition: everything above, plus what transfers
An acquirer runs every workstream an investor runs, then asks what survives a change of control. Contracts with change-of-control clauses, licenses that need a regulator's prior approval, option schemes, carried-forward tax losses and the deal's own approvals all become closing conditions.
A warning posted on r/SaaS puts it bluntly: a signed letter of intent means the deal is about half done, not nine-tenths. And where a statutory clock applies, it sets the pace however fast everyone else moves.
Under the Competition Act, 2002, as amended in 2023, the Competition Commission of India (CCI) has 30 days to form a prima facie view on a notified deal and up to 150 days overall. The Reserve Bank of India's Citizen's Charter sets 90 days for approving a change in shareholding or control of an NBFC (non-banking financial company), counted from a complete application. The table below shows how reviewer, scope and deciding documents shift by stage; its durations are indicative practice, not law, since the week counts circulating online have no source and only the regulators' clocks are fixed.
Stage | Typical reviewer | Workstreams in scope | Documents that decide it | What drives the timeline |
Pre-seed and angel | Angel or syndicate lead, sometimes with a lawyer | Founders, cap table, IP ownership | Incorporation papers, cap table, founders' agreement, IP assignments | Speed of producing the basics: typically days to a few weeks |
Seed fund | Fund team, with outside counsel on the corporate file | Adds financial basics, key contracts, filings | Bank statements, MIS, customer contracts, MCA filing history | Data-room readiness and filing gaps: typically a few weeks |
Series A | Lead investor's counsel, a CA firm, sometimes a technical adviser | All but deal approvals, at confirmatory depth | Audited accounts, GST returns, cap table tied to PAS-3, customer contracts | Reconciliation gaps and post-term-sheet scope: typically weeks to a few months |
Series B and later | As Series A, plus commercial and technology specialists | Deeper on unit economics, technology, regulation | Cohort data, source-system exports, license records | Data-room size and open regulator correspondence |
Strategic acquisition | Deal team, counsel, accountants, forensic and technical specialists | All ten, plus what transfers | SPA, disclosure letter, consents, regulatory approvals | Consents plus clocks: CCI 30 days (prima facie), 150 overall; RBI 90 days (NBFC change in control) |
Read the last column as the part you control. Bottom line: everything except a regulator's clock gets shorter when the data room is ready on day one.
Corporate records and the cap table
The corporate file answers the most basic question in any deal: who owns the shares being bought or diluted. Reviewers test it against filings under the Companies Act, 2013, not the founders' spreadsheet, and it's where Indian startups most often find holes, which makes it the workstream worth fixing first.
What they ask for | Where it usually breaks | How they verify it | Investor / acquirer weight |
Incorporation certificate, MoA and AoA with every amendment | Special resolution never filed on MGT-14 (due in 30 days) | Filed copies and filing history on the MCA portal | Both |
Register of members (s.88), share certificates | Register not updated after a secondary sale; certificates unstamped | Register tied to the cap table and to stamp-duty proof | Both |
Each allotment: resolutions, offer letter, separate bank account, PAS-3 | PAS-3 filed late; money not kept separate | Allotment matched to resolution, bank credit and filing | Investor: core |
Demat status and depository holdings (Rule 9B) | Shares still physical after 30 June 2025 | Depository statement showing every holding in demat | Acquirer: CP |
Significant beneficial owner declarations (BEN-1, BEN-2) | Investor crossed 10% via a fund structure; nothing filed | Ownership chains checked against filings | Both |
Charges (CHG-1) and the Registrar's charge register | Venture debt never registered; repaid loans never marked satisfied | Loan agreements matched to the register both ways | Acquirer: CP |
Related-party transactions (s.188) | Founder-controlled vendor paid without the required approvals | Ledger scan for shared addresses, directors, surnames | Acquirer: price |
The documents on every first request list
The first request list barely changes between reviewers: the certificate of incorporation, the memorandum and articles with every amendment, the register of members kept under section 88, share certificates, every shareholders' agreement and side letter, and board and general meeting minutes. Which MCA forms do investors actually check? Mainly PAS-3, MGT-14, SH-7 for any change in authorised capital, the annual AOC-4 and MGT-7 or MGT-7A, CHG-1 and BEN-2. PAS-3 is due within 15 days of an allotment made by private placement under section 42(8) of the Act, and within 30 days for other allotments.
Stamp duty belongs to the same chain: under Article 56A of Schedule I to the Indian Stamp Act, 1899, an issue of shares attracts duty of 0.005 per cent and a delivery-based transfer 0.015 per cent, and a reviewer wants proof on every issue and transfer. The MCA record is the reviewer's first stop precisely because the founder didn't prepare it, so pull the master data and filing history yourself before the room opens: anything you can't explain becomes a written question.
Where the cap table stops matching the register
A cap table is a summary, and diligence tests it against the records that create the shares, which is why reconciling the cap table to the four records behind it comes first in any raise. Under Rule 9B of the Companies (Prospectus and Allotment of Securities) Rules, 2014, private companies that weren't small companies as at 31 March 2023 had to facilitate dematerialisation of their securities by 30 June 2025, and a holder can't transfer those securities until they're dematerialised. In August 2026 a Registrar of Companies order penalised a company and four of its officers for a physical share transfer. So a cap table still partly on paper is a closing problem, not a tidy-up item.
Worth flagging: the December 2025 change to the small-company limits (paid-up capital up to Rs 10 crore, turnover up to Rs 100 crore) doesn't plainly answer whether a newly small company drops out of Rule 9B, so a reviewer will want the company's position, and its reasoning, in writing.
Investors also check founder vesting, which in an Indian company is usually contractual: leaver terms in the shareholders' agreement that require a departing founder to transfer unvested shares at a set price. A co-founder who left early with a large block and no leaver terms is dead equity, and the new investor is being asked to dilute around it.
Beneficial ownership, charges and related-party flows
The beneficial-ownership check is newer than most founders assume. Under the MCA's Companies (Significant Beneficial Owners) Rules, notified in June 2018 under section 90 of the Act, an individual who holds or controls 10 per cent or more, directly or indirectly, declares it to the company on BEN-1, and the company files BEN-2 with the Registrar. And layered fund structures are exactly where those declarations get missed.
Is FEMA checked when every investor today is Indian? Yes: a single non-resident angel in an early round, or shares once held by an overseas entity, brings the company within the FEMA (Non-debt Instruments) Rules, 2019, with pricing rules and an FC-GPR due within 30 days of the issue under the RBI's reporting directions. An uncompounded contravention from years ago stays with the company, and with whoever invests in it or buys it next.
Frankly, charges get less attention than they deserve. Venture debt, working-capital lines and equipment finance are usually secured, and each charge needs a CHG-1 filed within 30 days of creation under section 77 of the Act, extendable on payment of additional fees. An unregistered charge isn't taken into account by a liquidator or any other creditor, so lenders watch the register as closely as reviewers do.
Related-party flows get the closest reading from acquirers. Payments to a vendor a founder controls, a relative on the payroll or a founder's other company renting space to this one are tested against section 188. It requires board approval and, above prescribed thresholds, shareholder approval, unless the transaction is in the ordinary course of business and on arm's length terms. The practical reality: disclosed on day one, such a flow reads as a governance point; found in week four, a trust problem.
Financial due diligence checklist: proving the revenue is real
If the corporate file answers who owns the company, the financial workstream answers what they actually own. It's where both of the opening cases broke, and this financial due diligence checklist runs on a single rule: every material number gets traced to a record the founder didn't produce.
What they ask for | Where it usually breaks | How they verify it | Investor / acquirer weight |
Audited accounts and the latest MIS | MIS runs ahead of the books; revenue booked on invoice, not delivery | MIS reconciled to the trial balance and audited accounts | Both |
Revenue by customer, with contracts and invoices | Expired or unsigned contracts; billing on terms nobody signed | Sample of contracts traced to invoices and bank receipts | Both |
GSTR-1 and GSTR-3B for every registration | Return turnover doesn't match book revenue | Returns pulled from the GST portal, reconciled monthly | Investor: core |
Bank statements for every account | Selected months sent as PDFs; an unmentioned account | Live net-banking view, or statements direct from the bank | Both |
Receivables ageing | Old or related-party dues carried as collectable | Direct confirmation from sampled customers | Acquirer: price |
Burn, runway and the cash forecast | Committed spend and deferred salaries left out | Burn rebuilt from bank outflows | Investor: core |
Debt, venture debt and covenants | Covenant breaches; change-of-control defaults; lender warrants off the cap table | Loan agreements checked against the charge register and lender confirmations | Acquirer: CP |
Quality of revenue, and why MIS is not evidence
MIS is what the company tells its board: fast, useful and entirely self-reported, so a reviewer treats it as the claim under test rather than as evidence. In GoMechanic's case, according to the first information report (FIR) registered in October 2023 on the investors' complaint, as reported by Inc42, the November 2022 MIS showed gross revenue of Rs 194.11 crore against actual revenue of about Rs 100 crore. Those are allegations, not findings of any court.
Quality of revenue is the next layer, and the real question is whether the revenue will still be there next year. Is it recurring or one-off, gross or net (a marketplace booking the full order value when it keeps only a commission is the classic error), and does it lean on one customer, related parties or discounts? An acquirer often commissions a quality of earnings report to answer exactly this, restating reported earnings to what the business can sustain.
Diligence isn't an audit, and a clean audit report doesn't settle it. A statutory audit gives an opinion, for the shareholders, on whether a past year's accounts are true and fair, based on sampling. Diligence tests the specific claims a buyer is paying for, usually including the months since the last audit, for the buyer's benefit.
And when an investor asks management to certify the accounts (a question that surfaces on r/Entrepreneur), what does that mean in practice? Usually a warranty in the subscription or purchase agreement, backed by an indemnity, giving the investor a contractual claim against whoever gave it if the accounts prove wrong. Sign only what you've checked, and disclose anything you're unsure of in writing.
Verifying from the source system, not the spreadsheet
The GoMechanic lesson is procedural: go to the system that produced the number, and watch the founder open it. For an Indian company, the most productive single test is GST: the reviewer pulls GSTR-1 (outward supplies) and GSTR-3B (the summary return on which tax is paid) from the GST portal for every registration and reconciles turnover to revenue in the books, month by month. Differences such as exports, timing, credit notes and exempt supplies have explanations, but the explanations have to exist.
The usual findings are GSTR-1 and GSTR-3B returns that disagree, input tax credit claimed on spend that doesn't qualify, and supplies from a state where the company holds no registration. The same logic runs across the finance stack: gateway dashboards such as Razorpay or Stripe show settled collections an MIS can't invent, the accounting system's audit trail shows when entries were made and changed, and receivables and lender balances get confirmed directly with the counterparty.
This is the part founders underestimate: the request for read-only access is itself a test. A founder who offers it before being asked signals that the numbers will hold; a founder who sends curated PDFs instead invites the forensic version of the same exercise.
Customer and user existence tests
Frank, the acquirer-side case above, failed a different test. A count check tells you the file is the size claimed. An existence check tells you the users are real, and an activity check tells you they do something.
Here's what that actually looks like. Trace a random sample of the claimed users or customers into the product database, the login and transaction logs and the payment records. Test deliverability too: when JPMorgan Chase sent a test email to 400,000 of Frank's supposed customers in January 2022, only 28 per cent were delivered and 1.1 per cent of those were opened, according to the bank's lawsuit. For a B2B company, call customers from a list the reviewer picks, never one the founder curates.
A buyer on Reddit described being told monthly churn was 2 per cent, then finding 9.4 per cent in the raw export, and a gap like that doesn't need fraud to exist. Churn depends on its definition (logo or revenue, gross or net, which cohort, what counts as cancelled), and a seller's dashboard tends to show the kindest one. So recompute it from the raw export on a definition agreed in writing, and have the deal's warranty state which definition of each metric was represented.
Burn, runway, venture debt and what is off the balance sheet
Burn and runway sound like the investor's problem, since new money resets both. But they're diligence items because they show whether the forecast is honest: a reviewer rebuilds monthly burn from bank outflows, not from the model, and looks for committed spend the model leaves out, such as signed offers, annual contracts and deferred founder salaries.
Venture debt deserves a separate pass. Read every loan agreement for financial and information covenants, events of default triggered by a change of control or a new round, and warrants issued to the lender, which belong on the fully diluted cap table.
Then come the commitments that never reach the balance sheet: corporate guarantees for a group company, founders' personal guarantees a lender will want replaced, leases, earn-outs from an earlier acqui-hire, customer advances that could turn into refunds, and unprovided statutory dues such as TDS or provident fund (the tax and HR sections cover those). Each one is a claim on future cash that an acquirer inherits.
There's a second-order cost to this rigour. Every source-system request above hands personal data to a third party, and once the main obligations of the Digital Personal Data Protection Act, 2023 and the DPDP Rules 2025 apply from 13 May 2027, the company is answerable for that sharing. That's why the data-protection section below builds the request list aggregate-first.
So what does this mean for a founder getting ready? Run the reconciliations yourself first: MIS to books, books to GST and bank, customer list to contracts, metrics to raw exports. A gap you found and explained costs far less than one the reviewer found.
Tax due diligence under the Income-tax Act, 2025
Tax is where a startup's history catches up with it. An investor subscribing for new shares wants comfort that no old claim will drain its money, while an acquirer buying existing shares inherits every open year and prices what it finds. And the Income-tax Act, 2025 replaced the 1961 Act on 1 April 2026, renumbering every section, though most years under review were assessed under the old one.
What they ask for | Where it usually breaks | How they verify it | Investor / acquirer weight |
Returns, assessments and notices, every open year | Unread notices in the e-filing account | Portal proceedings and demands against provisions | Both |
TDS and TCS compliance | Salary TDS on ESOP exercise; no withholding on foreign vendors | TDS returns against payroll and vendor ledger | Both |
GST registrations and returns | A State with a place of business but no registration | Registrations by State; GST portal notices | Both |
Open demands and proceedings | A demand under appeal with no provision | Status of each demand; each seller's position under section 499 of the 2025 Act | Acquirer: indemnity |
Legacy angel-tax years | Pre-AY 2025-26 premium on a thin valuation | Valuation report per priced round; open assessments | Both |
Transfer pricing | Foreign affiliate, no study or accountant's report | Intercompany agreements, study and filed report | Acquirer: price |
Carried-forward losses and MAT credit | Losses priced in that lapse on closing | Shareholding history against section 119 of the 2025 Act; MAT credit schedule | Acquirer: price |
Every section number in the old diligence template changed on 1 April 2026
Most tax request lists, and the tax warranties in agreements signed before this year, still cite the 1961 Act. The table maps what a diligence report actually uses.
1961 Act section | Income-tax Act, 2025 section | What a diligence report uses it for |
79 | 119 | Loss carry-forward after a change in shareholding |
72A | 116 | Losses on an amalgamation |
56(2)(viib) | No successor | Angel tax on share premium, legacy years only |
17(2)(vi) | 17(1)(d) | ESOP perquisite on exercise, and its salary TDS |
192(1C) | 392(3), with the trigger in 289(3) | 60-month ESOP tax deferral for an eligible start-up |
139 | 263 | Return filing and due dates |
115JB | 206 | MAT at 14% from 1 April 2026; any MAT credit asset |
195 (withholding) | 393(2) | Non-resident withholding, including on a seller of shares |
281 | 499 | Transfers made while tax proceedings are pending |
170 | 313 | Seller's unpaid tax on a business takeover |
50CA | 79 | Unquoted shares transferred below fair market value |
Now, here's where it gets interesting. Section 79 was the loss-forfeiture rule under the 1961 Act and is the fair-value rule on unquoted share transfers under the 2025 Act, while section 195 went from non-resident withholding to unexplained income. So a 2026 share purchase agreement indemnifying against "losses disallowed under section 79" covers the wrong risk unless it says which Act it means. The fix is to name the Act in every tax citation and give both numbers where a period straddles 1 April 2026; the guide to what the Income-tax Act, 2025 changed covers the wider transition.
Frankly, the MAT row is the one most reviewers skip. The Finance Act, 2026 cut the rate to 14 per cent and stopped new MAT credit accruing, and with legacy set-off unsettled, a MAT credit asset is a question rather than a number.
Carried-forward losses, and the shareholding test the deal itself can fail
For a company in which the public are not substantially interested, section 119(3)(a) of the Income-tax Act, 2025 (the old section 79) keeps carried-forward losses only if holders of at least 51 per cent of the voting power on the last day of the loss year still hold 51 per cent on the last day of the set-off year. What most people miss is that a fresh round can fail that test as surely as a sale.
The eligible start-up relief in section 119(3)(b) of the 2025 Act is harder still: every shareholder with voting shares in the loss year must still hold them, and the loss must fall within ten years of incorporation, so it survives neither a trade sale nor one early angel selling out. An acquirer buying 100 per cent should assume the losses lapse on closing (for amalgamations, see the M&A guide linked earlier).
TDS, GST and open proceedings
Section 499 of the 2025 Act (the old section 281) turns a seller's tax problem into a buyer's title problem. A transfer of assets, expressly including shares and securities, made while tax proceedings against the transferor are pending, or after they end but before a recovery notice is served, is void against the resulting tax claim, unless made for adequate consideration without notice or with the Assessing Officer's prior permission. The rule applies where the tax exceeds Rs 5,000 and the assets Rs 10,000. So an acquirer asks each seller, not just the company, for evidence of pending proceedings, and makes a clean position or that permission a closing deliverable.
Section 313 of the 2025 Act (the old section 170) works on the asset side: a buyer that succeeds to a business, as in a slump sale, can be pursued for the seller's unpaid tax for the year of succession and the year before, where it cannot be recovered from the seller. Section 79 of the 2025 Act (the old section 50CA) catches founder secondaries, taxing unquoted shares sold below prescribed fair market value as if sold at that value, with a mirror-image charge on the buyer in section 92(2)(m) (formerly 56(2)(x)).
TDS is where ESOP and vendor habits show up: salary withholding, including tax on the ESOP perquisite, now sits in section 392 of the 2025 Act, and payments to non-residents in section 393(2). GST findings are quieter (an unregistered State, a show-cause notice answered late), and reconciling returns to the books belongs to the financial section.
How should a founder handle an outstanding demand before diligence? A smarter strategy is to schedule every demand from the portal with its status, amount paid and provision, and put it in the data room unasked. A demand the buyer finds tends to become a specific indemnity backed by escrow, while one already scheduled and provisioned becomes a line in the disclosure letter. One caution: paying off a small demand just before diligence rarely helps if the same adjustment waits in later open years.
Legacy angel tax: what is still open, and what is not
So is angel tax still a diligence issue in 2026? The short answer: only for the past. Section 56(2)(viib) of the 1961 Act stopped applying to all closely held companies from assessment year 2025-26 under the Finance (No. 2) Act, 2024, not only to startups recognised by the Department for Promotion of Industry and Internal Trade (DPIIT). The 2025 Act has no successor, whatever two better-known Indian checklists still say.
What's left is legacy exposure, for rounds priced in years still open to assessment or reassessment. An open year whose premium sits well above its valuation report is a candidate for a specific indemnity.
And here's what most checklists skip: DPIIT recognition is not the Inter-Ministerial Board certificate that section 140 of the 2025 Act requires before a company counts as an eligible start-up. That certificate gates the section 140 deduction (the old 80-IAC), the start-up loss relief above and the 60-month ESOP tax deferral under section 392(3). A company that deferred its employees' ESOP tax on DPIIT recognition alone has a salary TDS shortfall to explain.
Legal due diligence checklist for India: contracts, IP and litigation
Legal diligence asks three questions founders tend to blur together: does the company own what it sells, can it keep the contracts that produce its revenue, and is anyone pursuing it? For a minority investor the answers mostly feed the warranties in the subscription agreement. For an acquirer they decide whether a customer, a code base or a brand actually comes with the shares.
How do you prepare for legal due diligence before a first round? Start with what a reviewer opens first and a founder can fix fastest: IP assignments, material contracts and a clean litigation position. At seed the request list is short (incorporation papers, IP assignments, any investor agreements), by Series A it covers every material contract and trademark filing, and an acquirer adds a schedule of every consent a change of control needs.
What they ask for | Where it usually breaks | How they verify it | Investor / acquirer weight |
Material contracts: top customers, key vendors, lenders | Unsigned versions; expired terms still performed | Signed copies against the revenue ledger; counterparty confirmations | Both |
Change-of-control, assignment, exclusivity, MFN and non-solicit clauses | A top customer can exit on a sale; restrictions reaching affiliates | Keyword search of the full set; clause-by-clause schedule | Acquirer: CP |
IP assignments from founders, employees, contractors and former team members | Pre-incorporation code; unassigned contractor work | A signed assignment per contributor, against commit history | Both |
Trademarks and domains | Filed in a founder's name, the wrong class, or not at all | Trade marks register; registrar account ownership | Acquirer: CP |
Open-source license obligations | Copyleft code in a distributed product | Dependency scan (technology section) | Acquirer: price |
Litigation, legal notices and regulator correspondence | Notices in a founder's inbox, never minuted | Court and tribunal searches; management certificate of notices | Acquirer: indemnity |
NDAs, leases and data-sharing agreements | Leases unstamped or unregistered; lapsed NDAs | Executed, stamped originals | Investor: light |
Material contracts and the change-of-control search
The change-of-control search (every contract, every counterparty whose consent a sale needs) is an acquirer's first contract task, and the acquisition process guide sets out the method. A top customer's consent then becomes a condition precedent, because no buyer pays for revenue that can walk out on closing day.
What that search usually misses are clauses that bind in the other direction. An exclusivity clause covering "the company and its affiliates" binds the acquirer's whole group after closing, since the acquirer has just become an affiliate. A most-favoured-customer (MFN) clause can import the buyer's own price list into the target's contract, and a non-solicit covering affiliates' customers can stop the buyer's sales team calling accounts it already serves.
Think of it this way: a SaaS target that gave an Indian reseller exclusivity "for the company and its group" is fine standalone and a real problem for an acquirer already selling in India through a subsidiary. The answer is a waiver as a condition precedent, or a lower price. Investors weight all this lighter, since a minority stake rarely amounts to control under a contract's definition of affiliate.
Chain of title to the IP
Make no mistake: for a technology company, the IP file is the asset. The reviewer lists everyone who wrote code, designed the product or created the brand, and asks each for a signed assignment. Founders need one for pre-incorporation work, because an offer-letter clause assigning work done "in the course of employment" doesn't reach an engine written before the company existed.
Employees and contractors aren't the same case. Section 17 of the Copyright Act, 1957 makes an employer the first owner of work an employee creates under a contract of service, but a contractor on an invoice sits outside that rule (the funding-round checklist linked above sets out the gap). The departed engineer is the practical problem, because the signature has to come from someone who may no longer reply, and the time to find them is before a term sheet.
The brand has the same gap. A small-business thread on Reddit asked the question most founders skip: did the designer who made your logo ever sign over ownership? Often not, leaving a registered mark whose artwork the company never owned. The trade marks register tests the mark itself (right name, classes and owner; a mark in a founder's name is a founder asset until assigned), and a trademark filed in the company's own name is the only version an acquirer will pay for without holding money back.
Litigation, notices and regulator correspondence
Litigation searches are cheap, and reviewers run them whatever the company discloses: case status in the district courts and High Courts through the eCourts services, the cause lists of the National Company Law Tribunal for insolvency and oppression petitions, and the charge and director records on the Ministry of Corporate Affairs portal. Each search runs against the company, its directors and its founders.
But searches only find filed cases, not a former employee's legal notice in a founder's inbox, a GST show-cause notice or a regulator asking why a product needs no license. So reviewers pair them with a management certificate listing every notice received, and a notice that surfaces after signing is treated as a breach of warranty rather than a late disclosure.
The most useful hour a founder can spend here is running the same searches on their own company, and on their own names as directors of earlier ventures. A quantifiable claim then becomes a specific indemnity, often with escrow, while an open-ended one (a regulator questioning the business model) can become a condition precedent or a reason to walk, as the red-flag tiers later in this checklist set out.
HR due diligence checklist under the labour codes
People liabilities are the ones founders underestimate, because most don't show in the accounts until someone recomputes them. An investor checks that the team is hired and paid lawfully and the option pool is valid, while an acquirer inherits every employment relationship and prices the unfunded ones. In September 2026 that review runs against the four labour codes and the Central and State rules made under them, not the Acts most checklists still list.
What they ask for | Where it usually breaks | How they verify it | Investor / acquirer weight |
Appointment letters in the prescribed format | Offer emails only; no letter before the start date | Letters sampled against joining dates | Both |
Worker classification and contractor arrangements | Engineers treated as non-workers; contractors doing employee work | Duties and pay against the Rs 18,000 supervisory line | Acquirer: price |
Wage structure, gratuity and leave provisions | Allowances above half of pay; fixed-term staff past one year unprovided | Wages and provisions recomputed | Acquirer: price |
PF and ESI registrations and challans | Late registration; contributions on a narrow base | Challans matched to payroll month by month | Both |
POSH Internal Committee and annual report | No committee at 10 or more employees; no annual report | Constitution order, annual report, complaints log | Both |
ESOP scheme approvals | Grants before the special resolution | Resolution and MGT-14 dates against the first grant | Investor: core |
Key-person terms and restrictive covenants | Post-exit non-competes relied on as protection | Key-person agreements; retention terms | Acquirer: CP |
Appointment letters, worker classification and the 2026 Central Rules
The four labour codes came into force on 21 November 2025: the Code on Wages, 2019, the Industrial Relations Code, 2020, the Code on Social Security, 2020 and the Occupational Safety, Health and Working Conditions Code, 2020, with four sets of Central Rules following on 8 May 2026. They subsumed older Acts such as the EPF Act, 1952 and the Industrial Disputes Act, 1947.
The item a 2026 reviewer opens first is the appointment letter. Section 6(1)(f) of the OSH Code requires one in the prescribed form for every employee, and the window for staff already on the roll closed on 21 February 2026. Rule 6 of the OSH Central Rules, which dropped the draft's three-month cushion, goes further: no employee shall be employed unless an appointment letter in the prescribed format has been issued. The Central Rules bind establishments for which the Central Government is the appropriate government, and most startups answer to their State's rules, so check which set governs the target.
So the test is binary, and cheap. The reviewer samples joiners from the payroll register and asks for the letter issued before each start date, and an offer email or signed NDA doesn't count (yes, even for the first engineers hired on a handshake). Our recommendation is to run that sample yourself first.
Classification is where job titles mislead. The Industrial Relations Code excludes from "worker" people employed mainly in a managerial or administrative capacity, and supervisors earning more than Rs 18,000 a month, so most engineers, designers and support staff are workers whatever their designation. That status carries the retrenchment terms in section 70 (one month's notice or pay in lieu, and 15 days' average pay per completed year of service), which an acquirer planning a restructuring must cost before signing.
The full obligations list is in the labour codes compliance checklist. Diligence asks only whether the company has run its people processes as if the codes applied since November 2025.
Wages, gratuity, PF and ESI: the liabilities that get priced
The Code on Wages defines wages broadly, then lets certain allowances be excluded only up to half of total remuneration, adding back anything above 50 per cent. It's a cap on exclusions, not a rule that basic pay must be half of cost to company, which is how it's often misread.
Here's the thing: gratuity and leave encashment are computed on wages. A startup paying 30 per cent basic and 70 per cent allowances has been provisioning on a base the codes no longer recognise, so what a 2024 review called a "policy gap" is now a number. The shortfall in provisions is an accrued liability an acquirer deducts from the price.
Fixed-term employees now earn gratuity pro rata after one year under section 53 of the Code on Social Security, against five years for permanent staff, so rolling one-year contracts may have built a liability nobody provided for. What's underappreciated is that thresholds bite at small headcounts too: EPF registration at 20 employees and ESI at 10 (20 in some States, with a Rs 21,000 wage ceiling), and the reviewer compares the month each was crossed with the month of registration.
Then the challans, matched to payroll month by month, with exits tested against the Code on Wages requirement that full and final settlement is paid within two working days. Unglamorous, but it converts straight into a price adjustment.
POSH, ESOP approvals and key-person terms
The Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 requires an Internal Committee at every workplace with 10 or more employees, with a penalty of up to Rs 50,000 for failing to constitute one. A missing committee reads as a governance signal as much as a legal one.
A private company can issue shares under an option scheme only after a special resolution under section 62(1)(b) of the Companies Act, 2013 read with Rule 12 of the Companies (Share Capital and Debentures) Rules, 2014, filed on MGT-14. Investor and acquirer alike check the resolution date against the first grant, so if the pool was set up informally, read how the ESOP scheme should have been approved before a reviewer does.
Can a scheme that skipped the special resolution be ratified afterwards? Treat that as a question for counsel. Shareholders can approve a scheme today, but options granted before approval lacked the authority the Act requires, so a reviewer will want them re-granted, disclosed or covered by a specific indemnity.
Key-person risk (a worry one founder with two engineers raised on Reddit) shows up in terms more than price. An acquirer makes retention agreements with the people holding the product in their heads a closing condition, and an investor wants documentation and shared access so the code doesn't live on one laptop.
Neither can lean on a post-employment non-compete. The Delhi High Court held on 25 June 2025 (FAO 167/2025) that a three-year post-termination non-compete was unenforceable under section 27 of the Indian Contract Act, 1872, while confirming that confidential information is a protectable interest. The Supreme Court, on 14 May 2025, upheld a minimum-service bond with liquidated damages, because it operated during employment and the sum was a genuine pre-estimate of recruitment and training cost.
The practical reality is that retention terms and confidentiality protect key people, not covenants that end at the exit door. A selling founder's non-compete on the sale of the business is different, and belongs in the purchase agreement.
If your people records need the same scrutiny before a buyer or investor applies it, Outsource360 runs an HR due diligence review that maps appointment letters, wage structures, gratuity provisions and POSH compliance against the labour codes, alongside legal and financial due diligence support.
Regulatory and licensing due diligence: does the target hold what it needs?
Clean books, a reconciled cap table and signed IP assignments don't help if the business isn't allowed to run. Sector-specific licenses in India are granted to an entity for an activity, and the National Single Window System lists more than 325 central and 2,364 State approvals in its Know Your Approvals module (as displayed in September 2026). The real question is whether the target holds the one its revenue depends on, and whether it survives the deal.
Experienced reviewers check the date on the last licensing opinion first. On 28 November 2025 the Reserve Bank issued 244 Master Directions and withdrew 9,445 circulars, so an older memo cites instruments that no longer exist, including the old change-in-control rules.
The sector-specific licenses a reviewer looks for
The guide to sector-specific licenses in India, regulator by regulator covers each regime in full. The table keeps to the reviewer's question.
Sector | License | Regulator | The diligence question | Where to verify |
Food | FSSAI | Right tier for turnover since 1 April 2026 (registration to Rs 1.5 crore, State to Rs 50 crore, Central above)? Every premises covered? | FoSCoS FBO search | |
Lending | RBI | Certificate, or Unregistered Type I? Rs 10 crore net owned fund (glide path to 31 March 2027)? | RBI NBFC and cancelled lists | |
Payments | RBI | Right category? Net worth Rs 15 crore for a payment aggregator (Rs 25 crore by year three), Rs 5 crore for a PPI issuer? | RBI operator list | |
Investment advice and research | SEBI | SEBI registration matching what it does? Paid stock calls are research, not education | SEBI IA and RA lists; SEBI Check | |
Insurance distribution | IRDAI | Commission under a registration? Fee paid? Fresh application filed? | Certificate; fee receipt | |
Drugs and medical devices | State drug controllers; CDSCO | Sale license for every place of sale or stock? Registered pharmacist for retail? | License per premises | |
Telecom | DoT | Connectivity or voice for others (ISP, M2M, virtual network operator)? Old license still valid, or migrated? | Authorisation; migration status | |
Online gaming | Online Gaming Authority of India | Online money game revenue (prohibited since 1 May 2026, not licensable)? E-sports titles registered? | Certificate per game; revenue by title | |
Imports and exports of goods | DGFT | Annual April-June update filed? If not, the IEC is deactivated | IEC record |
A software, consultancy or agency business usually needs none of these. But what catches technology companies is product drift: a checkout holding customer money, pay-later at the till, or paid stock calls sold as education.
How to check whether a business actually holds the license it claims
Most of this takes minutes, because regulators publish their registers. Run it in this order:
List every regulated activity in the revenue, not the licenses the website claims.
For a lender, confirm the NBFC registration on the Reserve Bank's list of registered NBFCs and its cancelled list, noting the snapshot date (currently 30 June 2026): the list is periodic, not live.
For payments, find the company on the Reserve Bank's list of authorised payment system operators under the right category: PA-Online, PA-Physical, PA-Cross Border or prepaid instruments.
Run the company and its brands against the Reserve Bank's Alert List, which says it "is not exhaustive", so absence proves nothing.
For food, enter the 14-digit number into the FBO search on FSSAI's FoSCoS portal, confirm the name, address and tier of the FSSAI license, and check it isn't deemed suspended for an unpaid annual fee or missed return.
For advisers and analysts, match the name and registration number on SEBI's lists of investment advisers and research analysts, then run the UPI ID or bank account collecting fees through SEBI Check.
For insurance distribution, ask for the IRDAI certificate and latest annual-fee receipt, and check that an intermediary registered before the 2026 amendment has applied afresh (due before 31 January 2027).
Finally, ask for each certificate and its last compliance filing, and check the legal name is the company being bought, not a sister company or a founder's earlier firm.
Since 1 July 2026 a company with no public funds, no customer interface and assets under Rs 1,000 crore can operate as an Unregistered Type I NBFC, so absence from the NBFC list isn't proof of wrongdoing. The thing to test is whether it takes public money or deals with customers.
Change-in-control approvals: the license that does not transfer by itself
For NBFCs, paragraph 6 of the Reserve Bank of India (Non-Banking Financial Companies - Acquisition of Shareholding or Control) Directions, 2025 requires prior written permission for any takeover or acquisition of control, whether or not management changes. It also catches any change in shareholding, "including progressive increases over time", that results in 26 per cent or more of paid-up equity changing hands.
That wording catches venture-backed lenders: 9 per cent at seed, 9 per cent in Series A and 10 per cent in Series B reach 28 per cent on the third tranche, and that round can't close until the Reserve Bank says yes. Paragraph 10 of the NBFC Governance Directions, 2025 adds a management test: prior permission for replacing more than 30 per cent of the directors, excluding independent directors and those re-elected on rotation.
After permission, the NBFC gives at least 30 days' notice in one national and one vernacular newspaper before the transfer takes effect. A payment aggregator needs prior approval for a takeover or acquisition of control under the Reserve Bank's circular of 4 July 2022, as applied through the payment aggregator directions, then 15 calendar days' public notice. The Citizen's Charter clock in the stage section above covers both, so the approval is a condition precedent, not a post-closing filing.
Does the structure change the answer? Yes. A share purchase keeps the license in the company, behind the change-in-control approval and alongside any pre-closing liability, while an asset buyer escapes those liabilities (subject to the tax section's successor rule) but gets no license. Premises-based licenses such as FSSAI and drug sale licenses usually have to be applied for afresh.
What operating without a license costs
Law | What it penalises | Maximum exposure (September 2026) |
Unlicensed food business | Civil penalty up to Rs 10 lakh; no imprisonment since 8 November 2023 | |
Reserve Bank of India Act, 1934, s.58B(4A) | NBFC business without registration | 1 to 5 years' imprisonment and a Rs 1 lakh to Rs 25 lakh fine |
Unauthorised payment system | 1 month to 10 years' imprisonment, or a fine up to Rs 1 crore, or both, plus up to Rs 1 lakh a day |
The penalties for operating without a license split sharply by sector, and food is the outlier: the Jan Vishwas (Amendment of Provisions) Act, 2023 turned the unlicensed-food offence into a civil penalty. But unlicensed lending and unauthorised payment systems remain criminal.
Bottom line: the statutory maximum is rarely the whole cost. Section 58G of the Reserve Bank of India Act lets the Reserve Bank penalise an unregistered NBFC directly (Rs 10 lakh or twice the amount involved, whichever is more, plus up to Rs 1 lakh a day while the default continues). But a buyer's bigger number is the revenue that stops when the regulator notices. That's why unlicensed activity sits among the deal-killers in the red-flag table.
Data protection and the data room under the DPDP Act
A data room is a transfer of personal data. Payroll files, customer lists, support tickets and user tables all identify people, and under the Digital Personal Data Protection Act, 2023 the company holding them is the data fiduciary, answerable for what happens to them. So diligence tests what the target does with personal data, and what the diligence process itself does with it. Investors mostly test the first; acquirers test both, because on closing they answer for the same data.
What the DPDP Rules 2025 require, and from when
The Digital Personal Data Protection Rules, 2025 were notified as G.S.R. 846(E) on 13 November 2025 and commence in three steps. Rules 1, 2 and 17 to 21 came into force on publication; rule 4, on consent managers, applies from 13 November 2026; and rules 3, 5 to 16, 22 and 23 apply from 13 May 2027. That last group carries most day-to-day duties, including the detailed breach report to the Data Protection Board that rule 7(2)(b) requires within 72 hours.
The Act's schedule sets the exposure: up to Rs 250 crore for failing to take reasonable security safeguards, and up to Rs 200 crore for failures on breach notification and children's data. And that's why a data indemnity is worth negotiating on its own terms rather than inside the general cap.
Two dates in circulation are wrong. January 2025 was the draft Rules, not the final ones (at least one ranking checklist still says otherwise), and a January 2026 proposal to compress the timeline to 12 months has not been gazetted, so 13 May 2027 stands.
In practice, though, a reviewer in late 2026 is testing readiness: is there a gap plan against May 2027, who owns it, and what will it cost? A deal signed now often closes or integrates after that date, when the acquirer answers for the data the room is exposing today.
A DPDP-safe request list: aggregate first, identify at closing
Clean teams and redaction are process questions, covered in the acquisition guide. The request list is where the risk is actually created, and the design that works has three columns: what can be answered in aggregate, what needs identified data about a particular person, and what can wait for closing.
Most commercial questions belong in the first: churn by cohort, revenue by customer band, pay by grade and support volumes name nobody. Identified data is for questions about someone specific, such as the terms of the ten people a buyer wants to retain, and the raw user table, full payroll and support history wait until the acquirer is the fiduciary in fact.
But existence tests from the financial due diligence section can still run. The reviewer designs the sample, and the company's own team or a clean team runs it against the live database while the reviewer watches, with no bulk export.
Is it normal for an investor's lawyers to ask for a founder's full email? It's rarely proportionate or necessary. The better approach is a targeted search by keyword, custodian and date range, run and reviewed by the company's own counsel, because a mailbox is full of other people's personal data and privileged advice.
Staging the room answers the fear founders raise most bluntly on Reddit: a competitor posing as a buyer to learn costs, code and funnel. Aggregated and redacted material goes in before a letter of intent, commercially sensitive detail after exclusivity and a signed NDA, and source code and pricing mechanics only through a clean team or supervised review late in confirmatory diligence. Access logs and view-only settings won't stop a determined bad actor, but they make a leak attributable, which often deters one.
The mistake to avoid is the week-two export: an unredacted user table uploaded because a reviewer asked quickly and nobody pushed back. Once it's out the company can't recall it, and it stays answerable as fiduciary whatever the deal documents say.
Consent architecture as a valuation question
Acquirers now run the opposite test too: whether the data can lawfully be used the way the buyer intends after closing. A consumer app whose notices describe a narrow purpose, such as delivering the service, can't simply feed the buyer's cross-selling, analytics or model training. That needs fresh notice and, where consent is the basis, fresh consent from users who may decline.
The catch? It's a valuation question, not only a compliance one. If the buyer's model assumes the dataset combines with its own and the consent record says it can't, part of what's being paid for doesn't exist. So the reviewer asks for the notices in force at each collection point over time, the consent records behind them and how withdrawal is handled, with the consent-manager rule adding a layer from 13 November 2026.
Investors weight this lighter, since they fund the current business under its current notices. But a founder planning an exit should read DPDP compliance for SaaS and fintech founders with a buyer's question in mind: every notice written today limits what a future acquirer can do with the data.
Technology and product due diligence
For a software company the code is most of what's being bought, yet at seed the technology review is often a single call with the CTO. An acquirer paying for a platform, or for the team that built it, goes further: it wants to know what it'll cost to keep that product running, secure and legally clean once the founders stop answering questions. AI claims get their own subsection below, because a demo proves so little.
What they ask for | Where it usually breaks | How they verify it | Investor / acquirer weight |
Repository access and a list of every committer | Contractors and ex-employees with no IP assignment | Commit authors matched to signed assignments | Both |
Open-source inventory (a software bill of materials) | Copyleft code in distributed products; no license register | Automated license scan of the dependency tree | Acquirer: price |
Secrets management | Keys and passwords left in the commit history | Secret scan of the full history | Both |
Admin access to code, cloud, domains and app stores | A departed co-founder or agency still holds admin rights | Live screen-share of admin consoles | Acquirer: CP |
Architecture and key-person dependency | One engineer understands the system; nothing documented | Walkthrough with more than one engineer | Investor: core |
Security policies, incident history, SOC 2 or similar | Policies written for a sales questionnaire; incidents never logged | Access reviews, penetration tests, incident log, closed tickets | Both |
AI claims: automation rate, model provenance, training-data rights | The demo does what production does not | Production logs, human-review share, model contracts | Both |
Code ownership, open-source licenses and security posture
Ownership comes first, because nothing else matters if the company doesn't own its code. The reviewer matches every commit author to a signed assignment and closes any gap through the chain-of-title check in the legal section above.
Most open-source components carry permissive licenses that ask for little beyond attribution. Copyleft is different: it can oblige a company that distributes software built on it to release its own source code on the same terms, and some versions reach software offered over a network. So the reviewer wants a software bill of materials from a scanning tool, plus a note on how each copyleft component is used.
An API key committed three years ago and deleted last week still sits in the repository's history, which is why a reviewer's scanner reads all of it. Fair warning: deleting the key doesn't close the problem, because anyone who cloned the repository still has it. Revoke and replace it first, then clean the history and log both steps, so the reviewer sees a handled incident rather than an open one.
So how does a tech diligence call actually run? The CTO shares a screen and walks the reviewer through the architecture, the deployment pipeline and the repository, live rather than on slides. "Code review" usually means automated scans plus a sample read of the core modules, not a line-by-line audit. Run the same scans yourself a month before, and the call becomes a conversation about fixes already made.
SOC 2 isn't expected at seed: no law or standard makes it mandatory, though some investors ask about it and enterprise buyers often want it in procurement. Put simply, a reviewer weighs evidence that controls operate (access reviews done, a penetration test's findings closed) above a certificate a ten-person company can't yet justify.
Testing AI claims without a demo
A demo is a curated path through a product. But what a reviewer needs is how much production work gets done without a person stepping in, and that number lives in logs.
The enforcement record shows why. On 9 April 2025, the SEC and federal prosecutors in the Southern District of New York charged the founder of Nate, a shopping app, with raising over USD 42 million on the claim that the app completed online purchases using AI "without human intervention". Prosecutors allege the automation rate was effectively zero and that contract workers completed the orders; the founder has pleaded not guilty, the case is pending, and the allegations are unproven.
Instead, an investor should ask for the automation rate from production logs over a stated period, the share of tasks that pass through human review, model provenance (own model, fine-tuned, or a provider's API) and training-data rights: the licenses, consents and terms under which the data was collected. Get the answers in writing before the call, so the call tests them.
Then dependence. If the product runs on a third-party model, the reviewer reads the provider's terms on pricing, rate limits and termination, and asks what happens if the model is changed or withdrawn. For a product sold into the European Union, what the EU AI Act already requires adds a regulatory layer.
Founders on r/startups and r/venturecapital have asked whether EU AI Act exposure or AI copyright risk is moving Series A valuations; there's no reliable data on that yet. The uncomfortable truth is that an honest automation rate can look modest next to a competitor's marketing. Still, an understated capability is a pricing conversation, while an overstated one ends deals.
What an acquirer checks that an investor does not
The investor-versus-acquirer comparison near the top of this checklist explains why a buyer of control digs deeper. So what does a due diligence checklist for acquisition of a private company in India add? Three layers: the approvals the deal needs, what happens to employees and their options, and a method for turning each finding into price, escrow, indemnity or a condition. The deal process itself is in the M&A guide linked earlier; this is what a buyer verifies before it signs.
The approvals the deal itself needs
Most regulatory approvals attach to the company's business. The ones below attach to the transaction, and each sets a clock the closing date has to fit around.
Approval | When it applies | Clock | Consequence of missing it |
Competition Commission of India, under the Competition Act, 2002 | Deal value over Rs 2,000 crore with substantial business operations in India, or asset and turnover thresholds crossed; targets with up to Rs 450 crore of assets or Rs 1,250 crore of turnover in India are exempt under standing Rules with no end date, but not from the deal-value test | Prima facie view within 30 days; 150 days overall | No closing before approval; closing early is gun-jumping and draws a penalty |
Exchange control under the Foreign Exchange Management (Non-debt Instruments) Rules, 2019, read through the RBI Master Direction on foreign investment | Any transfer of shares between a resident and a non-resident | Form FC-TRS within 60 days of the transfer or of payment, whichever is earlier, under the RBI Master Direction on reporting under FEMA | A transfer to a non-resident below fair value is a contravention; a late filing needs a late submission fee within 3 years of the due date, then compounding or penal action |
The sector regulator, for example the RBI for an NBFC or a payment aggregator | A license that needs prior approval for a change in control (see the licensing section above) | NBFC: 90 days from a complete application, under the RBI Citizen's Charter | In practice, a condition precedent |
Government route for land-border investors: Press Note 3 of 2020, now in the Consolidated FDI Policy, as rewritten by Press Note 2 (2026 Series) | An investor or beneficial owner from a country sharing a land border with India; non-controlling beneficial ownership up to 10% may use the automatic route with reporting (Cabinet release of 10 March 2026) | No statutory clock; 60 days for specified manufacturing sectors (same release) | Investing without approval contravenes the FDI rules; settle it before the term sheet |
The FEMA row is where Indian founders' questions cluster, and the guide to FDI routes and reporting sets out the full reporting chain. The real question for the deal is narrower: whether this transfer is priced at fair value and reported on time, and whether any earlier contravention (see the corporate records section) has been regularised.
Worth flagging: several 2024 law-firm notes say the small-target exemption expires in March 2026, but that date belonged to a March 2024 notification. Since 10 September 2024 the exemption has sat in section 5 of the Competition Act itself, with its values in standing Rules that carry no end date. And a data-rich startup with modest revenue is caught by the deal-value test whatever its size. The better approach, in our view, is to run that test first and name every approval in the term sheet.
Employees, ESOPs and key people on a change of control
A change of control can accelerate options, cash them out or roll them into the buyer's plan (the acquisition guide walks through all three). Diligence asks what the scheme document says about a change of control, and how long a leaver has to exercise.
One tax line changes the arithmetic. Where shares from exercised options are cashed out through a buy-back, section 69 of the Income-tax Act, 2025 adds an additional income-tax on a seller who is a promoter. Section 69(3)(b)(ii) treats anyone holding, directly or indirectly, more than 10 per cent of an unlisted company as a promoter. An early engineer with a large grant can cross that line, so the buyer should model it on the actual cap table, not on the founders' holdings alone.
Key people are a retention question rather than a covenant one, because a post-employment non-compete won't hold (the HR section above explains why). So part of the value is usually made to depend on them staying, through retention terms or deferred consideration.
How findings become price, escrow, indemnity or conditions
Every finding ends up in one of four places: fixed before closing (a condition precedent), priced (a lower number or money held back), covered by a specific indemnity, or the end of the deal. The red-flag tiers below sort common Indian findings into those buckets.
Where a non-resident is party, the money held back has a hard ceiling. Rule 9(6) of the Non-debt Instruments Rules caps consideration that is deferred, held in escrow or set aside against indemnity claims at 25 per cent of the total, for no more than 18 months, counted from the transfer agreement (or, for an indemnity, from payment in full). This gets overlooked more than it should: escrow terms are often agreed in the term sheet before anyone checks who sits on the other side, which forces a renegotiation at the worst moment.
The seller's answer to the warranties is the disclosure letter: the known exceptions, warranty by warranty (the pending notice, the late filing, the customer who can terminate). In the usual drafting anything fairly disclosed can't later be claimed as a breach, which is why a buyer turns each disclosed item it cares about into a specific indemnity or a price change before signing.
In practice, exclusivity is where sellers lose ground. A founder on r/startups described signing 90 days' exclusivity in a letter of intent and watching two more buyers appear a month later, which is exactly the trade the clause makes. Size it to the longest approval clock in the table above and agree in writing what extends it, since diligence can be extended only by agreement, usually alongside exclusivity.
Walking away late does happen. PhonePe reportedly held about six months of talks to acquire the buy-now-pay-later platform ZestMoney and ended them in March 2023 in the latter stages of due diligence. Reports cited bad loans, valuation and a shareholding structure that placed the Indian operating company under a Singapore parent (Business Today and Inc42, 30 March 2023).
Cross-border: what a US, UK or Singapore investor or acquirer adds
A US fund investing in an Indian company still runs the Indian checklist, but a foreign acquirer, or a parent abroad, adds a second legal system to the file. So which regime applies? It depends less on the buyer's nationality than on where the company, its parent and its subsidiaries sit.
Flipped structures and the Indian founders behind a foreign parent
A flipped company is an Indian operating business owned by a foreign holding company, usually in Delaware or Singapore. For a reviewer that means two corporate files, two cap tables that must agree, intercompany agreements that decide where the IP and the revenue sit, and transfer pricing as a tax item of its own.
There's a personal angle for Indian founders, too: their own position counts. An Indian resident holding shares in a foreign parent holds them under the Foreign Exchange Management (Overseas Investment) Rules, 2022, so a reviewer asks for the founders' own overseas investment filings, and the same rules' limits on layering test the flip itself.
Late filings are fixable, within limits. A reporting delay can be regularised with a late submission fee for up to three years, then only by compounding, and until then the resident can't make a further financial commitment abroad. The guide for Indian residents holding a foreign parent sets out the forms and the fee arithmetic.
A Delaware parent adds US items. Delaware computes franchise tax by default on the authorised-shares method, which for 10 million authorised shares comes to USD 85,165 a year, so a reviewer checks the parent's good standing and how its franchise tax was computed. One item has gone: FinCEN's final rule, announced on 11 August 2026 and in force on publication on 14 August 2026, exempts companies formed in the US from beneficial ownership reporting.
A Singapore parent raises the same questions, and the ZestMoney talks above show a buyer can read a layered structure as a risk in itself. A recurring founder question is whether to flip before raising. Diligence won't decide that, but it does price it: every flip doubles the corporate file, and a reverse flip (covered in the same M&A guide) is easier to plan before the flip than after.
UK NSI Act, US CFIUS and HSR for foreign buyers
When the target or a group subsidiary sits in the UK or the US, the buyer's own government may need to clear the deal. Like Press Note 3, these checks belong on the approvals list before exclusivity starts.
In the UK, the National Security and Investment Act 2021 treats an acquisition of control as a trigger event when a holding crosses 25, 50 or 75 per cent of the shares or voting rights (section 8). If the target is active in one of the 17 sectors in the notifiable acquisition regulations (SI 2021/1264), the acquisition is notifiable, and completing it without approval makes it void under section 13. That comes on top of an offence carrying up to five years' imprisonment and penalties of up to 5 per cent of worldwide turnover or GBP 10 million, whichever is higher. Sector changes the government confirmed in March 2026, after a 2025 consultation, aren't yet in force.
In the US, a foreign buyer of a US business may have to file a mandatory declaration with the Committee on Foreign Investment in the United States under 31 CFR 800.401 at least 30 days before completion. Missing one can cost up to USD 5 million or the value of the transaction, whichever is greater. The Hart-Scott-Rodino size-of-transaction threshold has been USD 133.9 million since 17 February 2026. A court vacated the expanded 2025 HSR form in February 2026 and the FTC now accepts the earlier form, but the appeal is only paused until the end of 2026, so confirm which form applies before filing.
Most of this won't touch a purely Indian company. But in the UK the sanction is voidness, and no indemnity or escrow can repair a transaction the law treats as never having happened.
Due diligence red flags, and what each one does to the deal
Founders selling small software businesses (on Indie Hackers, among other places) ask whether buyers walk away more over hard flags, such as inflated numbers, or soft ones, such as customer concentration. The short answer: hard flags end deals because they undermine trust in everything else in the file, while soft flags usually move the price. The table sorts ten common Indian findings by tier and typical contractual answer.
Finding | Tier | Typical contractual answer |
A regulated activity carried on without the license it needs | Deal-killer | Walk away, or restructure so the buyer never takes on the activity |
Revenue, users or churn that don't reconcile to source systems | Deal-killer | Walk away; a small, explained gap becomes a price change and a specific warranty |
FC-GPR never filed for a past foreign round | Condition precedent | Late submission fee (Rs 7,500 + 0.025% x amount x years, within 3 years of the due date) paid and form filed before closing; after that, compounding or penal action and a specific indemnity |
ESOP scheme granted without the special resolution | Condition precedent | Regularised before closing; specific indemnity for grants that can't be fixed |
Code, designs or brand not assigned to the company | Condition precedent | Signed assignments and a trademark in the company's name before closing |
Physical shares in a company required to dematerialise under Rule 9B of the Companies (Prospectus and Allotment of Securities) Rules, 2014 | Condition precedent | Dematerialise first; the shares can't be transferred otherwise |
Unpaid statutory dues (PF, ESI, TDS, GST) | Price adjuster | Paid before closing or deducted from the price, plus an indemnity for interest and penalties |
A top customer can terminate on a change of control | Condition precedent | Written consent before closing; if refused, re-price or walk away |
Open tax proceedings against a seller (section 499 of the Income-tax Act, 2025) | Specific indemnity | Assessing Officer's prior permission, or the proceedings closed, before closing; escrow and indemnity for the company's own demands |
Founder-controlled related-party payments | Price adjuster | Ended or re-papered at arm's length; price cut for past leakage; a deal-killer if concealed |
Tiers aren't fixed, and this is the part sellers tend to underrate. A late filing disclosed on day one is a condition precedent, while the same filing found by the reviewer after the founders called the file clean is a credibility problem, which is the case for the fix-or-disclose rule in the readiness plan below.
Deal-killers
Deal-killers are rarely about size. They're about whether the buyer can still believe the rest of the file, the lesson of both cases at the top of this checklist. Operating a regulated business without its license is the other kind: for lending and payments the penalties include imprisonment (the licensing section above sets them out), so no buyer takes that on an indemnity. A missing food license, by contrast, now draws a civil penalty and usually becomes a condition precedent instead.
Threads on r/smallbusiness and r/businessbroker ask what kills deals the owner never saw coming. From the reviewer's side, it's usually a small item found late: a customer contract with a change-of-control exit, a license held in a founder's name, code written by someone who never assigned it. None is fatal in week one, but each can be in week eight, with exclusivity running out and no time left to fix it.
Price adjusters
Price adjusters are findings a buyer can put a number on: unpaid PF, ESI or TDS, under-provided gratuity (the 50 per cent wage definition in the HR section above can raise the base), churn higher than represented, heavy customer concentration. Each becomes a lower price, a holdback or a specific indemnity sized to the exposure.
When is it fair to renegotiate after diligence? When a finding changes a number the price was built on, and a seller who disclosed early has usually absorbed most of it already. But re-trading without a finding is a negotiating tactic, plain and simple, and the seller's defence is a Q&A log and disclosure record showing the buyer knew.
Founders also ask the reverse, whether the valuation can go up before closing. It can be raised, but the term sheet usually fixed the price subject only to diligence, so the seller's real bargaining power is timing (a competing offer before exclusivity is signed), not argument after it.
Now, here's where it gets interesting for cross-border deals. Holdbacks and earn-outs count against the 25 per cent FEMA ceiling described above where a non-resident is party, so a large adjuster sometimes has to be a straight price cut rather than money parked in escrow.
Conditions precedent and specific indemnities
A condition precedent is something that has to happen before closing: a filing made, a consent received, an assignment signed, an approval granted. A representation and warranty is a statement of fact made at signing (and usually repeated at closing), and a breach gives the buyer a damages claim afterwards, subject to the agreement's caps, thresholds and time limits.
Because a disclosed problem is normally carved out of the warranties (see the disclosure letter above), the buyer needs either a condition that fixes it or a specific indemnity that pays for it, rupee for rupee, if it crystallises. Think of it this way, using the unfiled FC-GPR from the table: the late filing and the fee become conditions precedent, but past the three-year window the compounding outcome is unknown at signing, so it moves into a specific indemnity, often backed by escrow inside the FEMA ceiling.
And the weak point in a lot of closings is administrative rather than legal. A conditions list with no named owner per item drifts, and the long-stop date doesn't care whose job it was, so a smarter strategy is to put a name and a date against every condition on the day of signing.
Preparing for due diligence: a founder's 90-day readiness plan
Everything above is the startup due diligence checklist seen from the reviewer's side of the table, and this section turns it round. The request list arrives soon after a term sheet is signed, and practitioners suggest starting three to six months ahead, with the cap-table clean-up done months before the raise, so 90 days is the floor rather than the ideal.
Why a plan rather than a scramble? Because most findings are cheaper to fix than to disclose, and cheaper to disclose than to have found. The three pieces are the index, the fixes and the log, and the plan at the end puts them in order.
Build the data-room index around the reviewer's workstreams
Index the room in the order the reviewer works, so each adviser finds their whole workstream in one folder: corporate records and cap table, financial, tax, legal (contracts, IP and litigation), HR, regulatory licenses, data protection, technology, and Q&A. Number the folders, name files consistently and keep a one-page index listing every document with its date. The compliance tracker goes in the corporate folder as an exhibit, due dates and actual filing dates side by side, built from the annual ROC compliance calendar.
Open nothing before an NDA that covers the data room is signed, because a term-sheet confidentiality clause usually protects the negotiation, not the documents. But angels often decline to sign NDAs at all. With an angel, share the deck and headline numbers, and keep the room closed until there's a term sheet.
Then stage access as the data-protection section above describes, so a competitor posing as a buyer sees enough to price the business but not enough to copy it. A shared drive is often good enough for a seed round; for a Series A or a sale, a virtual data room earns its fee through per-folder permissions, view-only watermarked files and an access log showing who opened what, which matters the day a deal dies.
Fix, disclose or explain: the decision rule
Every gap the self-audit finds goes into one of three buckets. Fix it if it can be fixed before signing at a known cost: late ROC filings with additional fees, a FEMA filing still inside the late-fee window, missing IP assignments, appointment letters. Disclose it if it can't be fixed in time or at all: pending litigation, an open tax demand, a compounding application in progress. Explain it up front if it looks worse than it is: a one-off revenue spike, a related-party lease at market rent, a founder loan already repaid.
The disclosed items become the disclosure letter, so draft it as you go, tying each item to the warranty it qualifies and the document that proves it. And keep a Q&A log from the first question (question, answer, date, document reference) so two people never give two answers.
A founder question that surfaces on r/startups is whether to disclose moonlighting or a side business. Disclose it: director records on the MCA portal show other directorships, and a reviewer who finds a side company unaided reads it as concealment, whatever the activity turns out to be.
What most people miss is that quiet fixing carries its own risk. A filing made in week three that contradicts a document uploaded in week one looks like a cover-up unless the Q&A log explains it, so fix loudly: tell the reviewer what changed, when and why.
The 90-day plan, in order
Here's the sequence, with a target day for each step. The order matters more than the exact dates.
Run a self-audit: by day 10, check every workstream against your own records and list each gap with an owner and a date.
Reconcile the cap table: by day 25, tie it to the register of members, allotment filings, share certificates and resolutions, and confirm demat status where Rule 9B applies.
Close filing gaps: by day 40, file late ROC forms, any FC-GPR or FC-TRS still inside the late-fee window, and pending GST and TDS returns.
Collect IP assignments: by day 45, get them signed by founders, employees, contractors and designers, and file trademarks in the company's name.
Fix HR documents: by day 50, issue appointment letters in the prescribed format, reconcile PF, ESI and gratuity, and confirm the ESOP scheme approvals.
Build the license register: by day 55, list every license held or needed, with its number, its issuer and whether it survives a change in control.
Design a DPDP-safe room: by day 60, decide which requests get aggregated data, which get redacted samples and which wait for closing.
Build the index: by day 70, set up folders in the reviewer's workstream order and add the compliance tracker as an exhibit.
Dry-run the Q&A: by day 80, have an adviser send a mock request list, answer it from the room alone and fix what the answers expose.
Open the room: by day 90, grant staged access once the NDA is signed, and start the dated Q&A log.
Two things drive the order. The cap table goes first because every other workstream refers back to it, and the room opens last because a room opened before its index is finished invites the same question twice. The step founders most want to skip is the dry run, which is a mistake: it's the cheapest on the list.
Frequently asked questions
What is a startup due diligence checklist?
It's the list of records, numbers, contracts and approvals an investor or acquirer verifies before committing money. It covers corporate records and the cap table, financial, tax, legal, HR, licenses, data protection, technology, deal approvals and red flags.
Does due diligence happen before or after the term sheet?
Mostly after. An investor screens the company before a term sheet and runs full diligence once it's signed, with the findings feeding the final agreements. An acquirer often does a lighter review before the letter of intent and a confirmatory one after it.
What is confirmatory due diligence?
It's the check run after price and main terms are agreed, to confirm that what the company has represented is true. It tests documents against source records rather than the business case, and its findings usually become conditions, price changes or indemnities.
What documents do investors ask for in due diligence?
Incorporation documents, the register of members and cap table, allotment filings, audited accounts and MIS, tax and GST returns, material contracts, IP assignments, employment papers, licenses, and any notices or litigation. Acquirers add what the deal needs to close.
What is the difference between legal and financial due diligence?
Legal diligence checks what the company owns and owes in law: title to shares and IP, contracts, licenses and disputes. Financial diligence checks whether the numbers are real, reconciling revenue, cash and liabilities to bank, tax and source records.
Does a change in control of an NBFC need RBI approval?
Yes. The RBI's 2025 directions on acquisition of shareholding or control require prior permission to acquire control of an NBFC or 26 per cent or more of its shares, including stakes built up in stages, and a public notice 30 days before the transfer.
How long does due diligence take for a startup?
No law fixes a period. It depends mostly on how ready the data room is and on any regulatory clock the deal triggers, such as the Competition Commission's 30-day prima facie review or the RBI's 90-day service standard for an NBFC change in control.
Who pays for due diligence in a round or an acquisition?
By market practice, each side pays its own advisers. In a priced round the term sheet may have the company reimburse the lead investor's agreed legal costs at closing. In an acquisition the buyer normally bears its own diligence costs.
Is it normal for an investor to charge a due diligence fee?
No, as a matter of market practice rather than law. Institutional investors normally bear their own diligence costs, though a term sheet may have the company reimburse agreed legal costs at closing. An up-front fee demanded before any term sheet is a common scam pattern.
Can a startup share customer data during due diligence under the DPDP Act?
Share aggregated or redacted data first, and identified data only when a question needs it, usually near closing. The DPDP Rules phase in, with consent-manager rules from 13 November 2026 and most obligations from 13 May 2027.
What is a red flag report?
A short diligence report that lists only the material problems found, ranked by what each does to the deal, instead of describing everything reviewed. Buyers use it to decide quickly whether to proceed, re-price or add conditions.
What is a quality of earnings report?
An accountant's analysis of whether reported earnings are real and repeatable. It strips out one-off and related-party items and ties revenue to cash and source records, and it's more common in acquisitions and later rounds than at seed.
Is angel tax still a due diligence issue in 2026?
Only for earlier years. Section 56(2)(viib) of the Income-tax Act, 1961 stopped applying to all closely held companies from AY 2025-26, and the Income-tax Act, 2025 has no successor, so only open assessments for earlier years matter.
What happens if an FC-GPR was never filed?
It can be regularised by paying a late submission fee of Rs 7,500 plus 0.025 per cent of the amount for each year of delay, within three years of the due date. After that the route is compounding or penal action, and a buyer will make it a condition.
Can a deal fall through after the term sheet because of due diligence?
Yes. A term sheet binds mainly on exclusivity, confidentiality and costs, so an investor or acquirer can walk away if diligence finds something material. PhonePe reportedly ended talks to buy ZestMoney in 2023 in the late stages of diligence.
Should founders do due diligence on the investor?
Yes. Check the fund's registration and track record, speak to founders it has backed, including ones whose companies failed, and treat any request for an up-front fee as a warning sign. If a land-border rule could apply, ask who the fund's beneficial owners are.
References
Companies Act, 2013, sections 42 and 62 (private placement and further issue of shares, including employee stock option schemes under section 62(1)(b), and Form PAS-3 within 15 days of a private placement under section 42(8)), section 77 (registration of charges on Form CHG-1), section 88 (register of members), section 90 (significant beneficial owners), section 117 (filing of resolutions on Form MGT-14 within 30 days) and sections 186, 188 and 2(76) (loans, investments and related-party transactions), establishing the corporate records a reviewer rebuilds, mca.gov.in.
Companies (Prospectus and Allotment of Securities) Rules, 2014, rule 9B as amended by G.S.R. 131(E) of 12 February 2025 (dematerialisation by non-small private companies by 30 June 2025, and securities to be dematerialised before any transfer) and rule 12 (Form PAS-3 within 30 days for allotments other than a private placement), with the order of the Registrar of Companies, Bangalore, of 19 August 2026 under section 450 of the Companies Act, 2013 penalising a physical share transfer, mca.gov.in.
Companies (Share Capital and Debentures) Rules, 2014, rule 12, on employee stock option schemes approved by special resolution, mca.gov.in.
Companies (Significant Beneficial Owners) Rules, 2018, on the 10 per cent threshold and Forms BEN-1 and BEN-2, mca.gov.in.
Companies (Specification of Definition Details) Amendment Rules, 2025, G.S.R. 880(E) of 1 December 2025, raising the small company limits to Rs 10 crore of paid-up capital and Rs 100 crore of turnover; higher limits are only proposed in the Corporate Laws (Amendment) Bill, 2026, mca.gov.in.
Indian Stamp Act, 1899, section 9A and Schedule I, Article 56A, on duty of 0.005 per cent on an issue and 0.015 per cent on a delivery-based transfer of securities, collected through depositories, indiankanoon.org.
Income-tax Act, 2025 (Act No. 30 of 2025), in force 1 April 2026: section 119 (carry-forward of losses, with the 51 per cent voting-power test in section 119(3)(a) and the eligible start-up relaxation in section 119(3)(b), formerly section 79), section 116 (losses on amalgamation, formerly section 72A), section 499 (transfers during pending proceedings void against the tax claim, formerly section 281), section 313 (recovery from a successor to a business, formerly section 170), section 79 (unquoted shares transferred below fair market value, formerly section 50CA) and section 393(2) (withholding on payments to non-residents, formerly section 195), incometaxindia.gov.in.
Income-tax Act, 2025: section 17(1)(d) (the ESOP perquisite, formerly section 17(2)(vi)), sections 392(3) and 289(3) (the 60-month deferral for an eligible start-up, formerly section 192(1C)), section 140 (eligible start-up status, which requires an Inter-Ministerial Board certificate rather than DPIIT recognition alone), section 263 (returns, formerly section 139), section 206 (minimum alternate tax, formerly section 115JB) and section 69 as substituted by the Finance Act, 2026, including the promoter definition in section 69(3)(b)(ii), incometaxindia.gov.in.
Income-tax Act, 1961, section 56(2)(viib), and the Finance (No. 2) Act, 2024, which switched the angel-tax provision off for all closely held companies from assessment year 2025-26; the Income-tax Act, 2025 has no successor, incometaxindia.gov.in.
Central Goods and Services Tax Act, 2017 and the GSTR-1 and GSTR-3B returns used to test reported revenue against filed tax records, Goods and Services Tax Network.
Code on Wages, 2019, Industrial Relations Code, 2020, Code on Social Security, 2020 and Occupational Safety, Health and Working Conditions Code, 2020, in force 21 November 2025, and the four sets of Central Rules notified on 8 May 2026, including rule 6 of the Occupational Safety, Health and Working Conditions (Central) Rules, 2026 (no employee to be employed without an appointment letter in the prescribed format), the Rs 18,000 supervisory line in the worker definition, gratuity for fixed-term employees after one year, and EPF and ESI coverage at 20 and 10 employees, Ministry of Labour and Employment.
Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013, on the Internal Committee required at 10 or more employees, Ministry of Women and Child Development.
High Court of Delhi, judgment of 25 June 2025 in FAO 167/2025, holding a three-year post-termination non-compete unenforceable under section 27 of the Indian Contract Act, 1872.
Supreme Court of India, judgment of 14 May 2025, upholding a minimum-service bond with liquidated damages of Rs 2,00,000 that operated during employment.
Reserve Bank of India (Non-Banking Financial Companies - Acquisition of Shareholding or Control) Directions, 2025, RBI/DOR/2025-26/340 of 28 November 2025, paragraphs 6 to 9 and 12, on prior permission for acquiring control or 26 per cent or more of an NBFC, including progressive increases, and the 30-day public notice, rbi.org.in.
Reserve Bank of India (Non-Banking Financial Companies - Governance) Directions, 2025, RBI/DOR/2025-26/344 of 28 November 2025, paragraph 10, on a change of more than 30 per cent of the directors, excluding independent directors and retirement by rotation, rbi.org.in.
Reserve Bank of India (Non-Banking Financial Companies - Registration, Exemptions and Framework for Scale Based Regulation) Directions, 2025, as amended by the Amendment Directions of 29 April 2026, on registration and the Unregistered Type I NBFC exemption from 1 July 2026, rbi.org.in.
Reserve Bank of India, list of registered NBFCs (a periodic snapshot, dated 30 June 2026 when checked) and the list of cancelled registrations, rbi.org.in.
Reserve Bank of India, certificates of authorisation issued under the Payment and Settlement Systems Act, 2007 (the authorised payment system operator list, page dated 8 September 2026), rbi.org.in.
Reserve Bank of India, Master Directions on Authorisation to operate a Payment System, RBI/DPSS/2026-27/401 of 15 June 2026, rbi.org.in.
Reserve Bank of India, Alert List of unauthorised forex trading platforms, which the RBI describes as not exhaustive, rbi.org.in.
Reserve Bank of India, Master Direction on Regulation of Payment Aggregators, RBI/DPSS/2025-26/141 of 15 September 2025, on net worth of Rs 15 crore rising to Rs 25 crore by the end of the third year, rbi.org.in.
Reserve Bank of India, circular of 4 July 2022 on takeover, acquisition of control and change in management of non-bank payment system operators, requiring prior approval for a takeover, rbi.org.in.
Reserve Bank of India, Master Directions on Prepaid Payment Instruments, RBI/DPSS/2021-22/82 of 27 August 2021 as updated, rbi.org.in.
Reserve Bank of India, Citizen's Charter, on the 90-day service standard, counted from a complete application, for an NBFC change in control, rbi.org.in.
Reserve Bank of India, circular of 28 November 2025 issuing 244 Master Directions and withdrawing 9,445 circulars, rbi.org.in.
Reserve Bank of India Act, 1934, section 45-IA (registration of NBFCs) and section 58B(4A) (imprisonment and fine for contravening section 45-IA), indiacode.gov.in, and section 58G (a penalty of Rs 10 lakh or twice the amount involved, whichever is more, plus up to Rs 1 lakh a day while the default continues), indiacode.gov.in.
Payment and Settlement Systems Act, 2007, section 4 (authorisation to operate a payment system), indiacode.gov.in, and section 26(1) (imprisonment, or fine, or both, for operating without authorisation), indiacode.gov.in.
Food Safety and Standards Act, 2006, section 31 (license and registration) and section 63 (carrying on a food business without a license), fssai.gov.in; this copy shows the unamended section 63, which now carries a civil penalty of up to Rs 10 lakh.
Jan Vishwas (Amendment of Provisions) Act, 2023 (Act No. 18 of 2023), substituting the civil penalty in section 63 of the Food Safety and Standards Act, 2006 with effect from 8 November 2023, egazette.gov.in.
Food Safety and Standards Authority of India, FoSCoS FBO search by 14-digit license or registration number, foscos.fssai.gov.in.
Food Safety and Standards Authority of India, kind-of-business eligibility and fee table updated on 1 April 2026 (registration up to Rs 1.5 crore of turnover, State license up to Rs 50 crore, Central license above), foscos.fssai.gov.in.
Securities and Exchange Board of India, SEBI Check, verifying the UPI handle or bank account of a registered intermediary, siportal.sebi.gov.in.
Securities and Exchange Board of India, public lists of registered Investment Advisers, sebi.gov.in, and Research Analysts, sebi.gov.in.
Securities and Exchange Board of India (Investment Advisers) Regulations, 2013, last amended on 25 November 2025, sebi.gov.in.
Sabka Bima Sabki Raksha (Amendment of Insurance Laws) Act, 2025 (Act No. 40 of 2025), amending the Insurance Act, 1938, including section 105BA on unregistered intermediaries, egazette.gov.in.
Insurance Regulatory and Development Authority of India (Insurance Intermediaries) (Amendment) Regulations, 2026, gazetted 30 July 2026, egazette.gov.in.
Drugs and Cosmetics Act, 1940 and Drugs Rules, 1945, Central Drugs Standard Control Organisation, cdsco.gov.in.
Telecommunications Act, 2023 (Act No. 44 of 2023), section 3 (authorisation, in force from 23 June 2026), egazette.gov.in.
Promotion and Regulation of Online Gaming Act, 2025 (Act No. 32 of 2025), in force from 1 May 2026, meity.gov.in, and the Promotion and Regulation of Online Gaming Rules, 2026, G.S.R. 303(E) of 22 April 2026, egazette.gov.in.
Foreign Trade Policy 2023, Chapter 2, paragraph 2.05 (Importer-Exporter Code), Directorate General of Foreign Trade, dgft.gov.in.
National Single Window System, Know Your Approvals module (325+ central and 2,364 State approvals as displayed in September 2026), Department for Promotion of Industry and Internal Trade, nsws.gov.in.
Digital Personal Data Protection Rules, 2025, G.S.R. 846(E) of 13 November 2025, made under the Digital Personal Data Protection Act, 2023: rules 1, 2 and 17 to 21 in force on publication, rule 4 from 13 November 2026, rules 3, 5 to 16, 22 and 23 from 13 May 2027, and the 72-hour detailed breach report in rule 7(2)(b), meity.gov.in.
Press Information Bureau backgrounder of 17 November 2025 on the DPDP framework, on penalties under the Schedule to the Digital Personal Data Protection Act, 2023 of up to Rs 250 crore for failure to take reasonable security safeguards, pib.gov.in.
Foreign Exchange Management (Non-debt Instruments) Rules, 2019, including the pricing guidelines and rule 9(6) (deferred, escrowed or indemnity consideration capped at 25 per cent of the total for 18 months), as set out in the Reserve Bank of India's Master Direction - Foreign Investment in India, updated 15 June 2026, rbi.org.in.
Reserve Bank of India, Master Direction - Reporting under the Foreign Exchange Management Act, 1999, updated 24 June 2026: Form FC-GPR within 30 days of issue, Form FC-TRS within 60 days, and a late submission fee of Rs 7,500 plus 0.025 per cent x amount x years, capped at the amount involved and available for up to three years from the due date, rbi.org.in.
Consolidated FDI Policy, paragraph 3.1.1, carrying Press Note 3 (2020 Series) of 17 April 2020 on the government route for investment from countries sharing a land border with India, Department for Promotion of Industry and Internal Trade, dpiit.gov.in.
Press Note 2 (2026 Series) of 15 March 2026, rewriting paragraph 3.1.1 so that beneficial ownership is tested at the level of the investor entity, Department for Promotion of Industry and Internal Trade, dpiit.gov.in.
Press Information Bureau, Cabinet release of 10 March 2026 on non-controlling land-border beneficial ownership of up to 10 per cent on the automatic route with reporting, and 60-day decisions in specified manufacturing sectors, pib.gov.in.
Foreign Exchange Management (Overseas Investment) Rules, 2022, G.S.R. 646(E) of 22 August 2022, and the related Regulations, on overseas investment by Indian residents, late submission fees within a three-year window and the bar on further financial commitment until a reporting delay is regularised, rbi.org.in.
Competition Act, 2002, as amended by the Competition (Amendment) Act, 2023 with effect from 10 September 2024: section 5(d) (the Rs 2,000 crore deal-value threshold for a target with substantial business operations in India, as specified in the Competition Commission of India (Combinations) Regulations, 2024), section 5(e) (the small-target exemption, which does not apply to the deal-value test), section 29(1B) (prima facie opinion within 30 days) and sections 6(2A) and 31(11) (150 days overall), cci.gov.in.
Competition (Minimum Value of Assets or Turnover) Rules, 2024, G.S.R. 547(E) of 9 September 2024, in force 10 September 2024, made for section 5(e) of the Competition Act, 2002: the small-target exemption at Rs 450 crore of assets or Rs 1,250 crore of turnover in India, with no end date and no later amending notification on the Competition Commission of India's notifications list as checked on 18 September 2026, cci.gov.in.
National Security and Investment Act 2021 (United Kingdom), section 8 (acquisition of control at 25, 50 and 75 per cent), section 13 (a notifiable acquisition completed without approval is void), and sections 32, 39 and 41 (the offence, up to five years' imprisonment, and penalties of up to 5 per cent of worldwide turnover or GBP 10 million, whichever is higher), legislation.gov.uk.
National Security and Investment Act 2021 notifiable acquisition regulations, SI 2021/1264, specifying the 17 notifiable sectors; the changes confirmed in the government's consultation response of 12 March 2026 await secondary legislation and are not yet in force, legislation.gov.uk.
31 CFR 800.401 (mandatory declarations, at least 30 days before completion) and 31 CFR 800.901(b) (penalties of up to USD 5 million or the value of the transaction, whichever is greater), United States Department of the Treasury, ecfr.gov.
Federal Trade Commission, Hart-Scott-Rodino current thresholds from 17 February 2026 (size-of-transaction threshold of USD 133.9 million), ftc.gov; and the decision of the US District Court for the Eastern District of Texas of 12 February 2026 vacating the expanded premerger notification form introduced in 2025, after which the Fifth Circuit refused a stay in March 2026, the FTC accepts the pre-2025 form, and the appeal is stayed to 31 December 2026 while the agencies consider revisions.
United States Securities and Exchange Commission, Litigation Release No. 26282, on charges filed on 9 April 2025 against the founder of Nate over claimed AI capability, sec.gov, and the United States Attorney's Office, Southern District of New York, press release of 9 April 2025 on the parallel indictment, justice.gov; allegations only, with a not-guilty plea entered and the case pending.
United States Attorney's Office, Southern District of New York, press release of 29 September 2025 on sentencing in the Frank case, as reposted by the Federal Deposit Insurance Corporation Office of Inspector General, fdicoig.gov.
TechCrunch, 18 January 2023, on GoMechanic's admission of errors in financial reporting and its layoffs, techcrunch.com.
TechCrunch, 28 March 2023, on the distressed sale of GoMechanic to a Lifelong Group-led consortium, techcrunch.com.
Inc42, on the GoMechanic sale, inc42.com; 22 August 2023, on the investors' push for an Economic Offences Wing investigation, inc42.com; and 25 October 2023, on the contents of the FIR as reported, inc42.com.
Business Today, 21 January 2023, on the diligence findings at GoMechanic; Business Today, businesstoday.in, and Inc42, inc42.com, both 30 March 2023, on PhonePe ending acquisition talks with ZestMoney; TechCrunch, 15 May 2023 and 5 December 2023, on ZestMoney.
Press coverage of the Frank case: CNBC, 12 January 2023 and 29 September 2025; Fortune, 28 March 2025; American Banker, 27 January 2023; Associated Press, 5 November 2025. Press coverage of the Nate charges: TechCrunch, 10 April 2025; Fortune, 11 April 2025.
State of Delaware, Division of Corporations, how to calculate franchise taxes (assessment based on authorised shares by default: USD 175 for up to 5,000 shares, USD 250 for up to 10,000 and USD 85 for each further 10,000, capped at USD 200,000, with the assumed par value capital method as the alternative), corp.delaware.gov; Financial Crimes Enforcement Network, final rule announced on 11 August 2026 and published and in force on 14 August 2026 (91 FR 52508), removing beneficial ownership reporting for companies formed in the United States and for US persons, federalregister.gov, and FinCEN's release of 11 August 2026, fincen.gov.
Durations for due diligence, exclusivity and readiness, and the market practice described on diligence fees, cost reimbursement, escrows, disclosure letters and indemnities, are practitioner observations of typical deals, not statutory periods or legal requirements; the only fixed clocks stated are those set by statute, regulation or a regulator's published service standard.
Disclaimer
This article is for educational and general business information purposes only and does not constitute professional legal, financial, or tax advice. It describes the position for an India-incorporated private company, with a limited US, UK and Singapore overlay, as it stood on the Last verified date at the top of this page. Indian company, tax, labour, exchange-control and data-protection rules change by notification, circular and amendment, and the durations and market practice described here are practitioner observations rather than law.
Five points are still moving and should be rechecked before relying on them: the phase-in of the DPDP Rules to 13 November 2026 and 13 May 2027; whether a company that became a small company on 1 December 2025 leaves Rule 9B; whether the Corporate Laws (Amendment) Bill, 2026 has been passed; the appeal over the expanded US premerger notification form; and the UK's changes to the notifiable sectors, confirmed in March 2026 but not yet in force. Verify any threshold, form, rate or deadline against the issuing regulator's current text, and consult a qualified lawyer, company secretary or chartered accountant before acting on anything set out here.
Comments