Legal Due Diligence on Indian Startups: A Checklist for US Investors

US investors have poured billions into Indian startups, and most of those deals worked out well. But many investors also have a story about a problem discovered too late: an unreported foreign investment, an ESOP pool that was never properly approved, or code that the company didn’t actually own.

Legal due diligence on Indian startups is different from diligence on a US company. The records sit in different places, different regulators matter, and the deal-breakers are often hidden in foreign exchange and IP formalities. This checklist explains what US investors should review and how to protect themselves in the transaction documents.

Corporate records, cap table and founders

Begin by agreeing a scope and timeline with the company, and ask for a virtual data room organized by topic, so the review runs efficiently. Start with the basics. Indian companies file their key records with the Ministry of Corporate Affairs, so review the company’s public filings: incorporation documents, articles of association, share allotments, director appointments, charges and annual returns. Compare them with the cap table the company presents. Gaps between the two are a common red flag.

Ask also for minutes of board and shareholder meetings, statutory registers and share certificates, because Indian startups sometimes have filings that don’t match their internal records. Shareholders’ agreements and articles from earlier rounds deserve close reading too, because existing investors’ veto rights, anti-dilution protections, liquidation preferences and information rights will shape what a new US investor can negotiate.

Check the ESOP plan carefully. Under Indian company law, an ESOP scheme must be approved by a special resolution of shareholders and comply with specific rules, including a minimum one-year vesting period. Options granted without a valid scheme can create disputes and dilution surprises; see our guide to ESOPs for Indian startups. Review convertible instruments, such as convertible notes, CCPS and CCDs, and confirm their conversion terms; see our guide to SAFE and convertible notes in India.

Then look at the founders. Are there founder agreements with vesting and IP assignment? Is founder equity subject to transfer restrictions reflected in the articles of association? Are any founders’ personal assets, such as domain names, trademarks or code repositories, actually held in their own names rather than the company’s? See our guide to founders’ agreements in India.

FEMA and foreign investment compliance

For US investors, foreign exchange compliance is the area most often overlooked. Every past foreign investment into the company should have been priced in line with FEMA rules and reported to the RBI, for example through Form FC-GPR within 30 days of allotment. Missing or late filings must be regularized before you invest, because your own investment will rely on the same compliance chain.

Check sectoral rules. Most technology sectors allow 100% foreign investment under the automatic route, but some sectors have caps or require government approval. If any existing investor is from a country sharing a land border with India, Press Note 3 may have required government approval for that investment.

If the company has a foreign parent or subsidiaries, or Indian founders hold shares in foreign entities, review overseas investment compliance too. Founders who own shares in an offshore holding company may have reporting obligations under India’s overseas investment rules. Where the structure may flip back to India, see our guides to reverse flips from Delaware to India and reverse flipping in India.

IP, data protection, tax and labor

Intellectual property is often the core asset, so confirm the chain of title. Under Indian copyright law, work by employees in the course of employment generally belongs to the employer, but freelancers and agencies own what they create unless they assign it in writing, and assignments must meet specific statutory requirements; see our guide to IP assignment in India. Review employment and contractor agreements, trademark registrations in India and abroad, and any patents; see our guides to registering a US trademark in India and software patents in India.

For deep-tech startups, check patent filings and any obligations to universities or research institutions where founders developed the technology. Check data protection readiness. India’s Digital Personal Data Protection Act, 2023 applies its main obligations from May 13, 2027, with penalties of up to ₹250 crore for security failures. A consumer startup with poor data practices today carries real future risk. See our DPDP Act compliance checklist, and check also for compliance with CERT-In’s cyber incident directions; see our guide to the CERT-In 6-hour rule.

Ask for the company’s tax residency position and transfer pricing documentation if it has foreign affiliates. Tax and labor round out the core review. Look for GST and withholding compliance, tax assessments and disputes, and whether the company relies on startup tax incentives that require specific certification; see our guide to the Income-tax Act 2025 for startups. Review compliance with India’s labor codes, in force since November 21, 2025, including salary structures, social security and the treatment of contractors and gig workers; see our guides to the new labour codes and gig and platform workers.

Litigation, regulatory licenses and sector risks

Search for litigation in Indian courts, tribunals and consumer forums, including insolvency proceedings before the NCLT and any criminal complaints involving the company or founders. Indian court records are increasingly searchable online, but coverage varies, so combine searches with management disclosures.

Due diligence on Indian startups should also cover related-party transactions, especially where founders own other businesses that trade with the company, and any loans or guarantees involving founders. Confirm the licenses and registrations the business needs. Fintech companies may need RBI authorizations or must operate through regulated partners. Crypto businesses must register with FIU-IND under the PMLA; see our guide to FIU-IND registration. Online gaming businesses face India’s 2025 ban on online money games; see our guide to the Online Gaming Act 2025. Healthcare, education and food businesses have their own regulators.

Environmental, social and governance questions are increasingly part of due diligence on Indian startups too, particularly for funds with their own ESG commitments. Finally, look at regulatory trends that could affect the business model, such as consumer protection rules on dark patterns, data protection, platform regulation and any sector-specific rules. These are often more important than past compliance.

Protecting US investors in the deal, and quick answers

Diligence findings should shape the transaction documents. Use conditions precedent to require fixes before closing, such as regularizing FEMA filings, executing IP assignments, or approving ESOP schemes properly. Negotiate warranties and specific indemnities for known risks, and consider escrow or holdbacks for larger issues.

For dispute resolution, arbitration seated in a New York Convention country is generally preferable to relying on US court judgments, because India enforces foreign arbitral awards under the Arbitration and Conciliation Act, while the US isn’t a “reciprocating territory” for direct enforcement of court judgments, so a US judgment would generally need to be sued on afresh in India. Confirm that the US remains outside India’s list of reciprocating territories under Section 44A of the Code of Civil Procedure when you document the deal. Thorough due diligence on Indian startups, followed by well-drafted protections, is what turns India’s opportunity into a sound investment.

Quick answers

What is the biggest diligence risk in Indian startups?

Foreign exchange compliance gaps, such as unreported or mispriced foreign investment, are among the most common and must be fixed before closing.

Can US court judgments be enforced in India?

Not directly. The US isn’t a reciprocating territory, so a fresh suit is generally needed. Foreign arbitral awards are easier to enforce.

Should we check IP ownership?

Yes. Contractors own their work in India unless they’ve assigned it in writing, so review assignments carefully.

Related reading: the UK-India trade deal checklist; also due diligence for UK investors in Indian start-ups; also enforcing a UK judgment or award in India; also open-source licence audits for US startups; also AI training data provenance audits after Bartz.

Final word

Halverton & Co. is an Indian law firm that advises on Indian law, including legal due diligence, FEMA compliance and transaction documents for US investors in Indian startups. We practice in Jharkhand, Maharashtra and before the Supreme Court of India, and we work alongside US counsel, who advise on US law. Halverton & Co.: Where tech needs law! If you have a question about Indian law, write to us at office@halvertonandco.com, or get in touch.

This article reflects developments reported up to early October 2026. It is for general information only, is not legal advice, and does not create an attorney-client relationship. Halverton & Co. is an Indian law firm and does not advise on US law.