Fintech self-regulator issues code of conduct for regtech companies

FACE, the self-regulatory organisation for fintechs, has issued a code of conduct for regulatory technology (regtech) companies, asking them to cooperate with regulators and government authorities during inspections by providing access to IT systems, data, and documents, including those handled by subcontractors.

 

Members of FACE (Fintech Association for Consumer Empowerment) that provide regulatory technology products must implement the code within six months. Such companies are not directly regulated by financial sector regulators.

 

The code covers multiple policy themes such as engagement with regulators, innovation, data privacy and security, partnerships, employee training and conduct, and grievance redressal.

 

A process for reporting and resolving security incidents, data breaches, or system failures must be established, along with conducting third-party audits of systems, it says. Similarly, sensitive data is required to be secured with encryption, access controls, and regular audits of systems. 

 

 

The code asks companies to develop internal policies to comply with India’s data protection laws and sectoral regulations, flagging matters such as obtaining user consent, managing data, and handling sensitive personal information.

 

“This initiative is a signal of maturity and intent — not just for FACE but for the broader fintech and regtech ecosystem. As regulatory technologies scale in scope and impact, the code sets a much-needed foundation for self-regulation, enabling companies to build with trust, accountability, and integrity,” said Sugandh Saxena, chief executive officer of FACE.

 

Regtech companies serve regulated entities, such as banks and non-banks, for compliance with aspects such as verification, data protection, and fraud prevention. They also assist pharma, energy, real estate and health care companies and startups, among others.

 

FACE, which is recognised by the Reserve Bank of India, said the code does not substitute existing regulations. Such regulations take precedence in the event of a conflict, it said. The code requires companies to regularly conduct due diligence of all their partnerships.

 

Stakeholders such as customers and employees should have accessible channels to report grievances.