Regulatory change management for Indian fintechs: who is reading the circulars?

If you're regulated by the RBI, SEBI or IRDAI, or you sell technology to someone who is, new requirements arrive constantly: master directions, circulars, FAQs, clarifications, extensions. Add CERT-In's directions on incident reporting and the DPDP Rules, and the volume is beyond what one person can track casually.

Most fintechs don't fail on regulatory change because the rules are hard. They fail because nobody owns the intake, so a circular becomes an audit finding before it becomes a task.

I've worked on RBI, IRDAI and SEBI CSCRF compliance programs, and the pattern repeats. The engineering is rarely the problem. The problem is that a requirement sat unread in someone's inbox for four months.

What lands on your desk in a typical year

The RBI's Master Direction on IT governance, risk, controls and assurance practices, effective April 2024, reset expectations for regulated entities' IT and cyber governance. The RBI's 2023 directions on outsourcing IT services changed how banks assess you if you sell to them. SEBI's Cybersecurity and Cyber Resilience Framework, issued in August 2024, came with compliance dates that were extended more than once. CERT-In's April 2022 directions still require cyber incidents to be reported within six hours and logs to be kept for 180 days.

Each of these arrived with follow up FAQs and clarifications. Missing a clarification can be as costly as missing the original.

The WhatsApp problem

In many fintechs the regulatory change process is a WhatsApp group named "Compliance updates" with one active member.

If you've ever forwarded a circular with "is this relevant to us?" and accepted silence as a no, you've seen the whole process fail in a single message.

A process that fits a small team

Intake: one named owner subscribes to the regulators' publications and logs every new item, with the date.

Applicability: within a week, a yes or no with a one line reason. "Applies to NBFCs above a certain size; we're not one" is a perfectly good answer, as long as it's written down.

Gap check: for every yes, compare the requirement to what you do today and note the gap.

Task: every gap becomes a task with an owner and a deadline tied to the regulator's effective date, not to someone's best guess.

Evidence: when it's done, keep proof. The regulator or your client's auditor will ask how you implemented it, and "we discussed it" won't be accepted.

Where tools help

Most global GRC platforms were built around US frameworks first, and Indian regulators tend to arrive as an afterthought or a custom framework you build yourself. That's one reason we built regulatory change tracking into Steppe from the start: publications from Indian regulators come in, the ones that apply turn into tasks against the controls they affect, and nothing lives only in a chat thread.

Whatever you use, the test is whether you can answer, for any circular in the last twelve months, whether it applies to you and what you did about it.

The circular you didn't read still applies to you, and the auditor will assume you read it.