SaaS for RBI Regulated Fintech India
Regulatory framework for SaaS platforms serving RBI-regulated entities — outsourcing guidelines, data localisation and audits
AMLEGALS advises on saas for rbi regulated fintech india — regulatory framework for saas platforms serving rbi-regulated entities — outsourcing guidelines, data localisation and audits.
The issues that decide the outcome
SaaS platforms operating in India face a layered regulatory landscape that extends well beyond the DPDPA 2023. The IT Act 2000 and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 impose due diligence, content moderation and grievance redressal obligations on SaaS intermediaries. CERT-In Directions of April 2022 require all service providers, intermediaries and data centres to report cyber security incidents within 6 hours, maintain logs for 180 days, synchronise system clocks with NTP and maintain KYC records of VPN and cloud service subscribers. Sector-specific regulators add further layers — RBI outsourcing guidelines for fintech SaaS, SEBI CSCRF for capital market SaaS, IRDAI guidelines for insurance-tech SaaS, and NMC/ABDM standards for health-tech SaaS.
The regulatory environment is evolving rapidly. The IT (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules 2026 (in force from 20 February 2026) introduce mandatory labelling of synthetically generated information (SGI) with provenance metadata, takedown timelines of 3 hours (standard) and 2 hours (high-risk including NCII and deepfakes), and automated verification obligations for Significant Social Media Intermediaries (SSMIs) with more than 5 million users. The Competition Act 2002 is increasingly applied to SaaS markets, with the CCI examining abuse of dominance through tying, bundling and self-preferencing in digital markets. The Consumer Protection (E-Commerce) Rules 2020 apply to SaaS platforms offering services to consumers — requiring a grievance officer, transparent refund policies and a prohibition on dark patterns.
How AMLEGALS acts
IT Act intermediary compliance
Implementing due diligence, content moderation, grievance officer appointment and compliance reporting under the IT Rules.
CERT-In compliance
Establishing 6-hour incident reporting, 180-day log retention, NTP synchronisation and subscriber KYC for CERT-In Directions.
Sector-specific compliance
Advising SaaS platforms serving RBI, SEBI, IRDAI or healthcare-regulated entities on outsourcing guidelines and audit obligations.
Competition law advisory
Analysing SaaS market practices for abuse of dominance, tying, bundling and self-preferencing risks under the Competition Act 2002.
Consumer protection compliance
Implementing grievance redressal, refund policies and dark pattern avoidance under the Consumer Protection (E-Commerce) Rules 2020.
EdTech regulatory compliance
Advising EdTech SaaS platforms on NEP 2020 alignment, UGC guidelines and student data protection obligations.
Frequently asked questions
01Is a SaaS platform an intermediary under the IT Act?
A SaaS platform that enables third parties to create, upload, share or transmit information is an intermediary under Section 2(1)(w) of the IT Act 2000. Intermediaries benefit from safe harbour under Section 79 if they comply with due diligence obligations under the IT (Intermediary Guidelines) Rules 2021, including appointing a grievance officer, publishing a compliance report and removing content within the prescribed timelines upon receipt of a court order or government notification.
02What are the CERT-In reporting obligations?
Under the CERT-In Directions of 28 April 2022, all service providers, intermediaries and data centres must report cyber security incidents to CERT-In within 6 hours of becoming aware. Reportable incidents include data breaches, ransomware, denial-of-service attacks, identity theft, spoofing and unauthorised access. Entities must also maintain logs for 180 rolling days within Indian jurisdiction and synchronise system clocks with NTP servers.
03Do RBI outsourcing guidelines apply to SaaS vendors?
Yes, if the SaaS platform provides services to RBI-regulated entities (banks, NBFCs, payment system operators). The RBI Master Direction on Outsourcing of IT Services (2023) requires regulated entities to ensure that cloud and SaaS vendors comply with data localisation requirements, permit RBI inspection and audit, implement business continuity and disaster recovery, and maintain data within India where mandated.
04What are dark patterns under Indian law?
The Guidelines for Prevention and Regulation of Dark Patterns 2023, issued under the Consumer Protection Act 2019, identify 13 categories of dark patterns including false urgency, basket sneaking, confirm shaming, forced action, subscription trap, hidden costs and nagging. SaaS platforms offering consumer-facing services must ensure their UI design, pricing pages and subscription flows do not employ these practices.
05Does an initial discussion create a lawyer-client relationship?
No. No engagement is treated as accepted until conflicts, scope and terms are confirmed in writing. An initial discussion is confidential and is used only to understand the matter and assess fit.
Request a confidential assessment
Share the key facts for a confidential preliminary assessment of your India matter.