Fintech has too many moving pieces: Arbitrage window is closing fast

India's data-protection rules are narrowing fintech's regulatory arbitrage, raising compliance costs while creating new opportunities in regtech, cyberrisk and governance

Five years ago, a Reserve Bank of India (RBI) working group on “Digital lending, including lending through online platforms and mobile apps” held that an effective regulatory regime should prevent the emergence of gaps and arbitrages that might arise from new service providers and innovative products. “The same regulatory conditions and supervision should apply to all actors who seek to innovate and compete on fintech: Incumbent banks, startups (in fintech) and big tech firms. These efforts should be towards better consumer protection and market integrity,” said the group’s report. 

We now have the next phase of the Digital Personal Data Protection Act, 2023; DPDP Rules, 2025 (with penalties on institutions ranging from ₹50 crore to ₹250 crore) and Mint Road’s draft “Guidance on Regulatory Expectations for Data Governance” released on July 15. Taken together, Mint Road’s signalling in its working group report (November 18, 2021) is now playing out in full flow. 

Data protection 

“DPDP and regulatory expectations on model risk management and data governance will galvanise the industry on data governance. These regulations are bringing foundational shifts in taking, using, sharing and handling data,” says Sugandh Saxena, chief executive officer (CEO) of the Fintech Association for Consumer Empowerment (FACE), the first RBI-approved self-regulatory organisation (SRO) for the sector. Other important aspects include fit-for-purpose proportionality, cultivating a culture of capacity and good practices at the ecosystem level. “As an SRO, we will converge and channel industry thinking and action in these areas.” 

“A chunk of fintechs’ advantage over legacy banks and non-banking financial companies (NBFCs) came from lighter-touch regulation…in the case of banks, they operate under RBI’s stricter data localisation, audit and security norms, while fintechs (especially non-lending-licence ones) moved faster with fewer compliance overheads,” notes Pushpa Marwal, banking analyst at Forrester’s Financial Services Practice. “DPDP is a horizontal law. It applies to a bank (legacy NBFCs too) and a three-year-old fintech. This flattens one dimension of the regulatory arbitrage. But on a net basis, DPDP doesn’t erase the fintech edge; it removes the ‘move fast, worry about compliance later’ playbook that many relied on.” 

Take banks: They are fuelled by depositors and are custodians of public trust. They cannot act like private equity (PE) or venture capital-funded fintechs. But the gap between legacy financial entities and fintechs has closed. The former now have both the data and tech muscle. To that extent, the chatter about whether banks can become as tech-savvy as fintechs is largely in the rear-view mirror. The earlier distinction between the two genres is more a matter of nomenclature. 

The stakes are going up for banks and NBFCs, too. “Although banks, NBFCs and payment systems continue to operate within a more stringent regulatory framework overall, the compliance gap in data governance between regulated entities (REs) and fintechs has narrowed,” notes Jishnu Sanyal, partner, technology, media and telecommunications practice, at law firm Trilegal. “In parallel, the RBI’s outsourcing norms require REs to flow down appropriate risk-based obligations to fintech partners, calibrated to the functions outsourced and the risks involved.” 

It leads us to fintech funding and valuations. 

Fintechs have raised $822.9 million in 2026 (to date), according to data provider Tracxn. This compares to $2.2 billion in 2024 and $2.4 billion in 2025. Funding may appear to be holding up at the aggregate level, but the number of rounds is narrowing for these timeframes: 379, 296 and 60 (or a smaller pool of firms is cornering it). Amid the West Asia crisis and developed markets preferring AI-powered business models, there is an even bigger question mark over incremental funding. 

What’s the mood now? “The more material impact of the DPDP Act is that it shall rationalise monetisation opportunities from customer data use, as levers for doing so may come under pressure,” feels Rohan Lakhaiyar, partner, financial services (risk advisory), Grant Thornton Bharat. As he views it, customer lifetime value could reduce if fintechs are unable to freely leverage existing data. Marketing and customer acquisition costs will rise as fresh consent becomes necessary for new products and partnerships. Lead-generation models, financial service distribution businesses and marketplaces that rely on extensive customer profiling will also be impacted. 

“It is important to note that the DPDP Act does not reduce fintechs’ value proposition, but it does reduce the regulatory and data-governance arbitrage that existed between regulated financial institutions and them. Along with changes in the operating environment, fintechs will adapt swiftly and new business models will emerge,” says Lakhaiyar. 

“What has changed is what capital is looking for. Look at how diligence has changed. A few years ago, investor conversations started with user growth and ended with unit economics. Today, the early questions are about licences, data practices, regulatory relationships and audit trails,” points out S Anand, founder and CEO, PaySprint, a banking, fintech and regtech firm. As he views it, a clean compliance posture accelerates a funding round; a regulatory surprise can end it. “I would put it this way: Compliance has become part of the cost of capital. The company that has engineered it raises faster, on better terms and from better investors. Because it has removed the single largest unquantifiable risk from the deal.” 

This is happening even as fintech investors are finding it difficult to exit via the public markets through a listing. They have two options: Pump in more funds and wait for better times, or say no and, in effect, write off their investments. Now put the penalties under the DPDP Act in the mix. You may well see fintech blowouts happening: Most were not making profits; valuations were drawn from a closed circle: PE funds and venture capitalists or high net-worth individuals. If a fintech were to be hit with a penalty under the DPDP Act — at the lower or the higher end of the spectrum — it will struggle, if not go belly up. And as data security and compliance get foregrounded, spending on this will take priority over that on advertising and marketing. 

New business fields 

“The most important shift is the regulatory moat is becoming part of the competitive moat, not a separate compliance obligation sitting next to it,” says Jaya Vaidhyanathan, founder of Capetal Labs, a risk management, compliance and AI-solutions firm. And what of the next phase? “It belongs to whoever can integrate all three — not treat them as three separate problems solved by three separate teams.” This, in turn, is creating new business lines around: Regtech, cyberrisk, identity, consent management, and governance, risk, and compliance. Because “governance functions are no longer support functions for fintech; they are becoming fintech infrastructure in their own right, because the compliance burden itself is now large enough to be a business.” 

Where does that leave valuations? “This is the most interesting implication, and I did push back on the instinctive framing of the question. The likely outcome isn’t lower valuations across the board; it’s a sharper differentiation between fintechs that used to look similar,” feels Vaidyanathan. And “a more interesting question than ‘are valuations going up or down’ is ‘which fintech’s valuations deserve to go up, and why?’ This is a much better market to be underwriting than one where growth alone was enough”. 

What we are set to witness may be along the lines of what Coatue (run by hedge fund and portfolio manager Philippe Laffont) said in its report “Fintech and the pursuit of Prize: Who stands to Win over the Decade (October 2022)”. It was categorical that “the next generation of enduring fintech requires a focus on owning the balance sheet, maniacal re-bundling, a business-to-business leaning, and building high-margin sub-verticals.” 

The chessboard looks very interesting.