Indian fintech startup RBI verification should answer a narrow question: which Reserve Bank of India permission does the startup claim, which legal entity holds it, and what does the RBI's own published record say about that entity today? "RBI-approved", "RBI-licensed" and "regulated by RBI" are not one status. A payment aggregator authorisation, a prepaid-instrument authorisation, an NBFC certificate of registration and a partnership with a regulated bank are different things, published in different places, with different meanings.
Use the RBI list that matches the exact permission, match the legal entity rather than the brand, record the status wording and the date of the list you checked, and keep the startup's wider claims in separate columns. This is a public-record research method, not legal, regulatory, investment or financial advice.
Start with the exact claim
Before searching anything, write down the sentence the startup actually uses. "We are an RBI-authorised payment aggregator" points to one list. "Our loans are given by an RBI-registered NBFC" points to another. "Backed by RBI" or "RBI-compliant" is too vague to verify and should be recorded as unresolved until the startup names the permission and the entity.
Most fintech claims fall into a small number of RBI record types:
| Claim wording | Where to check first | What the record can confirm |
|---|---|---|
| Authorised payment aggregator, PPI issuer or other payment system operator | RBI publication: Certificates of Authorisation issued under the Payment and Settlement Systems Act, 2007 | The entity name, principal office, authorised payment system and date of issue shown in RBI's list |
| "Our licence application is with RBI" or "in-principle approval received" | RBI: Status of applications received under the Payment and Settlement Systems Act, 2007 | Whether RBI lists the application as in-principle, under process, returned, withdrawn or refused, and whether that table says the entity can operate |
| "We are an RBI-registered NBFC" | RBI: List of NBFCs and ARCs registered with the RBI | Whether the legal entity appears in RBI's published registration list, and whether it appears in the separate cancelled-registration list |
| "Our NBFC partner accepts deposits" | RBI Common Person site: NBFC lists | Whether the entity appears in the list of NBFCs permitted to accept public deposits, rather than the non-deposit list |
| "Our lending app is listed with RBI" | RBI website, Citizen's Corner: directory of digital lending apps deployed by regulated entities | Whether a regulated entity has reported that app as its digital lending app |
If the claim does not fit any row, do not force it into one. Ask the startup which regulated entity and which permission the claim refers to.
Read RBI status wording literally
The most common error is treating an application stage as an authorisation. RBI's status page for applications under the Payment and Settlement Systems Act, checked on 11 October 2026 with an "as on 01.10.2026" date, separates payment aggregator applications into tables. For online payment aggregation, one table covers existing entities that can operate. Another covers new applicants that have been granted in-principle authorisation or are still under process, and that table heading says they cannot operate. A third covers returned, withdrawn or refused applications, which also cannot operate. The page notes that existing aggregators whose applications were returned were advised to stop online payment aggregation and close nodal or escrow accounts within 180 days. Parallel tables exist for cross-border and physical payment aggregation, and for prepaid payment instrument issuer applications.
The practical rule is simple: copy the table heading and the remark next to the entity, word for word. "In-Principle Authorisation Granted" in a table titled "Cannot operate" is not a licence to run that payment business. "Application Under Process" is not approval. A returned application is not a pending one.
The separate Certificates of Authorisation publication, dated 30 September 2026 when checked, lists authorised payment system operators with the payment system authorised and the date of issue. The same publication has later sections for certificates revoked by the RBI and for authorised entities whose payment system operations have ceased. Search all of those sections, not only the first match.
Match the legal entity, not the brand
RBI lists name companies, not app names or marketing brands. A startup known by one name may operate through a private limited company with a different name, and the regulated activity may sit with a partner bank or NBFC rather than with the startup itself.
Get the legal entity name from a first-party source: the startup's terms of use, privacy policy, grievance-officer page, invoices or app-store developer details. Then confirm that the company exists and is active using the Ministry of Corporate Affairs record; our guide to checking MCA company status and annual filing records explains how to do that without overreading the result. Only after the company is identified should you search the RBI list.
Keep three entities separate in your notes:
- The brand the public sees.
- The operating company that runs the product.
- The regulated entity that holds the RBI permission, if it is a different company.
A startup that says "loans are disbursed by our NBFC partner" is making a claim about the third entity. A match for the partner proves something about the partner. It does not make the startup itself an NBFC.
Separate the record from the claim
An RBI record and a performance or safety claim are different evidence layers. Keep them in separate columns.
| Evidence | A bounded conclusion | What it does not prove |
|---|---|---|
| Entity appears in the Certificates of Authorisation list | RBI's list showed that entity authorised for the stated payment system on the list date | That every product, brand or partner of the entity is covered |
| Entity appears in an application-status table | RBI showed that application stage and remark on the list date | That the entity can operate, unless the table says so |
| NBFC registration list match | The company appeared in RBI's published registration list | Its loan pricing, recovery conduct, solvency or suitability for any borrower |
| Partner bank or NBFC named on the startup's site | The startup states that relationship | That the partner confirms it, or that the arrangement covers every product |
| Digital lending app listed by a regulated entity | That entity reported the app to RBI | That the app's interest rates, fees or practices are fair |
| No match found | The search did not find the entity under the name tried | That the startup is acting unlawfully; a name variant or a newer list may explain it |
A safe sentence looks like this: "RBI's Certificates of Authorisation list dated 30 September 2026 showed [legal entity] authorised as [payment system], issued [date]. We checked on 11 October 2026." An unsafe sentence is "RBI-certified fintech, fully compliant."
A seven-step verification method
- Capture the claim. Save the exact wording, page URL and date where the startup makes the RBI claim.
- Name the permission. Decide whether the claim is about payment aggregation, a prepaid instrument, another payment system, NBFC registration, deposits or a digital lending app. If you cannot tell, the claim stays unresolved.
- Identify the legal entity. Use first-party legal pages and the MCA record. Note any partner bank or NBFC separately.
- Search the matching RBI list. Use the exact legal name and common variants such as "Private Limited" and "Pvt. Ltd.". Record the list's own date, not just your check date.
- Search the negative sections. Check revoked certificates, ceased operations, returned or refused applications and cancelled NBFC registrations.
- Copy the status literally. Record the table heading and remark exactly as RBI publishes them. Do not upgrade "in-principle" to "licensed".
- Publish only the narrow conclusion. State what the record showed, when, and for which entity. Leave anything else marked as unverified.
When records do not reconcile
Mismatches are common and are not automatically evidence of wrongdoing. RBI lists are periodically updated documents, so a very recent change may not appear yet. Company names change. Some products rely on a partner's permission rather than the startup's own.
Handle each case the same way: record what you searched, which list date you used, what you found and what is still missing. Ask the startup for the exact regulated entity and permission. If the claim cannot be matched after that, describe it as unverified rather than false. If you believe a scheme is unauthorised, use the RBI's own reporting channels rather than publishing an accusation.
Signals that deserve more scrutiny
- The claim says "RBI-approved" with no entity or permission named.
- The only evidence offered is a logo, a screenshot or a certificate image rather than a match in RBI's published list.
- An entity listed as in-principle or under process is described as fully licensed.
- The named partner bank or NBFC cannot be found in the relevant RBI list.
- The legal entity on the terms of use differs from the one named in the RBI claim, with no explanation.
- The entity appears in a revoked, ceased, returned, refused or cancelled section.
None of these signals is proof on its own. Each one is a reason to keep the claim out of a public profile until it is resolved.
How this fits a startup profile
Founders listing a fintech product can make verification faster by naming the regulated entity, the exact RBI permission and the list it appears in, with a link to RBI's page rather than a copied certificate image. The same discipline applies to other registration claims; see what Udyam registration and DPIIT recognition each prove and how an Importer-Exporter Code record differs from export performance.
Researchers can use the SuperLaunch directory to discover companies, then follow the source-first verification workflow and return to the RBI for any regulatory claim. SuperLaunch's editorial policy explains its approach to sources, corrections and commercial separation.
Founder and researcher checklist
- Save the exact RBI claim and where it appears.
- Identify the permission type being claimed.
- Confirm the legal entity behind the brand.
- Note any partner bank or NBFC separately.
- Search the matching RBI list using the legal name and variants.
- Record the date printed on the RBI list.
- Check revoked, ceased, returned, refused and cancelled sections.
- Copy RBI status wording exactly.
- Treat in-principle and under-process stages as not authorised to operate unless the RBI table says otherwise.
- Keep pricing, safety and performance claims in separate evidence columns.
- Mark unmatched claims as unverified, not false.
- Publish only the conclusion the record supports, with the check date.
FAQ
Does "in-principle authorisation" mean a payment aggregator can operate?
Not for the applicants in RBI's "cannot operate" tables. Copy the table heading and remark exactly, and do not describe that stage as a licence.
If a startup's NBFC partner is registered, is the startup regulated by RBI?
Not necessarily. The registration belongs to the NBFC. Record the partner's status separately from the startup's own role.
Why can't I find a company I believe is authorised?
Try the exact legal name and its variants, check the list date, and confirm whether a partner holds the permission. Record the search as unresolved rather than concluding the claim is false.
Is an RBI list match proof that a product is safe?
No. A list match confirms a regulatory status on a date. It says nothing about pricing, conduct, security or suitability.
The practical rule
Treat an RBI claim as a pointer to a specific public record, not a badge. Match the exact permission to the exact list, the brand to the legal entity, and the status wording to RBI's own table. When the record reconciles, cite it with the list date and your check date. When it does not, keep the gap visible.
Sources checked on 11 October 2026
- RBI: Certificates of Authorisation issued under the Payment and Settlement Systems Act, 2007 (publication dated 30 September 2026)
- RBI: Status of applications received under the Payment and Settlement Systems Act, 2007 (as on 1 October 2026)
- RBI: List of NBFCs and ARCs registered with the RBI, and NBFCs whose registration has been cancelled
- RBI Common Person site: NBFC lists, including deposit-taking and non-deposit-taking NBFCs
