Photo of Utkarsh Bhatnagar

Utkarsh Bhatnagar

Subscribe to Utkarsh Bhatnagar's Posts

Partner in the FinTech and Financial Services & Technology practice at the Mumbai office of Cyril Amarchand Mangaldas. Utkarsh has represented various Indian and multinational fintech, information/ emerging technology companies, and also pharmaceutical, and healthcare companies on transactional, enforcement and regulatory matters. His transactional practice focus is on public & private M&A, commercial agreements and regulatory matters. He can be reached at utkarsh.bhatnagar@cyrilshroff.com

Introduction:

Technology has fundamentally transformed the financial services industry, with many contemporary financial institutions (“FI”) adopting a digital-first or exclusively online business model. With third-party technology service providers handling critical functions for FIs, as outsourced partners, regulators such as the Reserve Bank of India (“RBI”), Securities and Exchange Board of India (“SEBI”) and the Insurance Regulatory and Development Authority of India (“IRDAI”) have issued their respective guidelines on outsourcing/ adoption of cloud services.[i] Additionally, FIs are also required to comply with general data protection laws.[ii]Continue Reading FIG Paper (No. 46 – Series 3): Contracting Considerations for Financial Institutions

FIG Paper (No. 44 - Series 3): RBI Consolidates Directions on Digital Lending: Implications for REs & LSPs

Background:

The Reserve Bank of India (“RBI”) on May 8, 2025, issued the Reserve Bank of India (Digital Lending) Directions, 2025 (“DL Directions”).

The idea of these new directions was to consolidate the various directions and circulars on digital lending by Regulated Entities (“RE”), previously issued by the RBI[1], provide greater clarity on consumer/ customer centric rights from a customer protection point of view and create a repository with the RBI of all digital lending apps/ platforms (“DLA”) provided by REs/ lending service providers (“LSP”).Continue Reading FIG Paper (No. 44 – Series 3): RBI Consolidates Directions on Digital Lending: Implications for REs & LSPs

FIG Paper (No. 40 – Data Law Series 6) Draft Digital Personal Data Protection Rules, 2025 - Key Implications for Financial Services Sector

Background:

  1. India’s first dedicated data privacy law, the Digital Personal Data Protection Act, 2023 (“DPDP Act”)[1], was passed by both houses of Parliament, and received Presidential assent on August 11, 2023. 

Continue Reading FIG Paper (No. 40 – Data Law Series 6) Draft Digital Personal Data Protection Rules, 2025 – Key Implications for Financial Services Sector

FIG Paper (No 35- Payments Series 3)– The new Draft Directions for Regulations of Payment Aggregator

Introduction:

In our previous two FIG Papers of PA/PG Framework (here) and (here), we shared our key learnings in connection with operations of payment aggregator and payment gateway guidelines issued by the Reserve Bank of India (“RBI”) on March 17, 2020 (as amended from time to time) (“PA/PG Guidelines”).Continue Reading FIG Paper (No 35- Payments Series 3)– The new Draft Directions for Regulations of Payment Aggregator

FIG Paper (No. 33 – Series 2): Compulsory Registration of Off-shore Virtual Digital Asset Service Providers with FIU-IND?

Recently, the Financial Intelligence Unit – India (“FIU-Ind”) has issued show-cause notices to several offshore Virtual Digital Asset Service Providers (“VDASP”) for non-compliance with  provisions of the Prevention of Money Laundering Act, 2002 (“PMLA”) and for non-registration with the FIU-Ind, post amendment to PMLA on march 07, 2023, while catering to the Indian customers and operating in the Indian market.Continue Reading FIG Paper (No. 33 – Series 2): Compulsory Registration of Off-shore Virtual Digital Asset Service Providers with FIU-IND?

FIG Paper (No. 27 – Series. 1): Implications of Digital Personal Data Protection Act, 2023, on Payment Service Providers

Introduction:

The Reserve Bank of India (“RBI”) has allowed certain non-banks to operate in the financial ecosystem for payment processing under the Payment and Settlement Systems Act, 2007 (“PSS Act”), in addition to banks. These non-banks are typically operate Cross Border Money Transfer (“MTSS”); Prepaid Payment Instruments (“PPI”); Bharat Bill Payment Operating Units (“BBPOU”); White Label ATM Operators (“WLAO”), etc.Continue Reading FIG Paper (No. 27 – Data Law Series 1): Implications of Digital Personal Data Protection Act, 2023, on Payment Service Providers

FIG Paper (No. 25 – Series 2): Shedding Light on Dark Patterns in FinTech: Impact of DPDP Act

Introduction:

The new draft guidelines titled ‘Guidelines for Prevention and Regulation of Dark Patterns, 2023’[1] (“Draft Dark Pattern Guidelines”), released by the Department of Consumer Affairs in September 2023, define dark patterns as “any practices or deceptive design patterns using UI/UX (user interface/user experience) interactions on any platform; designed to mislead or trick users to do something they originally did not intend or want to do; by subverting or impairing the consumer autonomy, decision making or choice; amounting to misleading advertisement or unfair trade practice or violation of consumer rights”.Continue Reading FIG Paper (No. 25 – Series 2): Shedding Light on Dark Patterns in FinTech: Impact of DPDP Act

FIG Paper (No. 24 – Series 1): New Data Law – Financial Services Implications

(Indian) Digital Personal Data Protection Act, 2023 (“DPDP Act”) received Presidential assent on August 11, 2023, and is awaiting notification by the Indian Government, which is expected soon. This FIG Paper examines: (i) the existing data protection/ privacy framework for the Indian financial services space; (ii) overlays DPDP Act considerations; and (iii) preferred approach to “gap” analysis, basis global learnings.Continue Reading FIG Paper (No. 24 – Series 1): New Data Law – Financial Services Implications

FIG Paper

Pursuant to the Report of the Reserve Bank of India (“RBI”) Working Group on Digital Lending, issued on November 18, 2021, and the RBI Press Release on ‘Recommendations of the Working Group on Digital Lending – Implementation’, dated August 10, 2022 (“August Press Release”), the RBI released the Guidelines on Digital Lending on September 2, 2022 (“Guidelines”). Our Alert examines the key changes introduced and industry implications.Continue Reading FIG Paper (No. 17 – Series 2) – New Digital Lending Guidelines – Industry Implications

Payment System Operators New M&A Implications

Background:

On July 4, 2022, the Reserve Bank of India (“RBI”) clarified to all banks and non-bank payment system operators (“PSOs”) that its prior approval would be required for any (a) takeover/ acquisition of control, which may or may not result in change of management; and (b) sale/ transfer of payment activity to an entity not authorised for undertaking similar activity (“Circular”).Continue Reading FIG Paper (No. 15 – Series 1) – Payment System Operators (PSOs) – New M&A Implications