Banks, NBFCs to reset partnership terms with fintech firms | Finance News

Banks and non-banking financial companies (NBFCs) are weighing a wholesale reset of their current terms of engagement with financial technology (fintech) companies. Stakeholders involved have opened talks with top-notch legal, consulting and regulatory technology (regtech) firms. 

The Reserve Bank of India’s (RBI’s) draft Guidance on Regulatory Expectations for Data Governance and the need to comply with the Digital Personal Data Protection (DPDP) Act, 2023; the DPDP Rules, 2025; and other applicable laws and rules, as amended from time to time, have catalysed this move. 

The RBI’s draft said regulated entities (REs) should put in place a data governance framework (DGF) and align it with their risk management framework. The REs’ boards are to oversee the DGF and review the reports and metrics annually or more frequently, as required. On partnerships, the draft said REs should assess and put in place controls to mitigate data-related risks arising from third-party arrangements. 

Feedback on the RBI’s draft closed on August 17. 

Senior bankers said their existing arrangements with fintechs have to be reviewed in light of the regulatory expectations and the governance premium, which has moved up many notches. “The Indian Banks’ Association and the Finance Industry Development Council (the RBI-approved self-regulatory organisation, or SRO, for NBFCs) are expected to play a role, as some of the changes may take time,” said a banker. 

A concern legacy entities — banks and NBFCs — have is that their data resides in silos, “and reworking this architecture will be time-consuming. Onboarding independent directors is also a factor”, said another banker. 

Sugandh Saxena, chief executive officer of the Fintech Association for Consumer Empowerment (FACE), told Business Standard that “the partnerships between financial entities (legacy or digital-first) and fintechs are being revisited, with contracts being reworked”. She added, “We are engaging with our members to support their compliance with the DPDP Act. The RBI’s  draft on regulatory expectations for data governance will shape partnerships.” FACE is the first Mint Road-approved SRO for the sector. 

Penalties under the DPDP Rules, 2025, range from ~50 crore to ~250 crore and can extract a severe price on the reputational front. The penalty architecture reinforces the need for stronger internal controls and clearer contractual allocation between data fiduciaries and data processors, although the data fiduciary remains primarily responsible for compliance under the DPDP Act, observed Jishnu Sanyal, partner — technology, media, and telecommunications practice, at Trilegal. “The RBI’s outsourcing norms require REs to flow down appropriate risk-based obligations to fintech partners, calibrated to the functions outsourced and the risks involved,” he said. 

“Many partnerships are undergoing diagnostics and compliance evaluation. It is reset time for the industry, as the stakes are much higher now,” said Rohan Lakhaiyar, partner, financial services (risk advisory), Grant Thornton Bharat.

“The conversations we have with founders and compliance teams today aren’t about navigating regulatory gaps anymore. They’re about embedding compliance into the product from day one. Because retrofitting (compliance) costs more, not just operationally but in trust and in partnerships that don’t materialise,” said Raghuveer Kancherla, cofounder, Sprinto, a governance, risk, and compliance automation platform. 

For fintechs, funding woes may increase. Data from Tracxn, a data provider, shows that fintechs raised $822.9 million in calendar year (CY) 2026 to date; this compares with $2.4 billion in CY 2025 and $2.2 billion in CY 2024. Funding may appear to be holding up, but a granular reading shows the number of rounds lower for these timeframes at 379, 296, and 60. This is indicative of the desire of investors — private equity and venture capital — to anchor in safe harbours. With the West Asia crisis and a shift in business models around AI in developed markets, there is an even bigger question mark over incremental fintech funding.