Banking Controls and Authorised Signatory Checklist for Indian Startups: Founder Guide to Bank Mandates, Payment Approvals, UPI, Cards and Investor Diligence
An Indian startup should treat its bank account as a governance system, not just a place where customer money lands and salaries go out. The founder question is simple: who can move money, how much can they…
Direct answer for founders
An Indian startup should treat its bank account as a governance system, not just a place where customer money lands and salaries go out. The founder question is simple: who can move money, how much can they move, which approvals are needed, how are payment proofs stored, who reviews bank access, and what happens when a founder, finance head or operations manager exits.
Many early companies run with one founder’s mobile number, one debit card, one net-banking login and a few WhatsApp approvals. That may work for the first month. It becomes risky when the company starts paying vendors, collecting customer advances, using payment gateways, creating virtual accounts, taking loans, receiving investor money, issuing cards to employees or operating across cities.
The legal and compliance base is not one single “startup banking law”. It comes from company authority, banking KYC, payment security and internal governance. Section 179 of the Companies Act, 2013 recognises Board powers and the need for Board discipline on key matters: https://www.indiacode.nic.in/show-data?actid=AC_CEN_22_29_00008_201318_1517807327856&orderno=183. Section 118 deals with minutes and written records of Board decisions: https://www.indiacode.nic.in/show-data?actid=AC_CEN_22_29_00008_201318_1517807327856&orderno=121§ionId=1309§ionno=118. RBI’s KYC FAQ explains that banks carry out KYC at account opening and that V-CIP may be used for authorised signatories and beneficial owners of legal entity customers: https://www.rbi.org.in/commonman/english/Scripts/FAQs.aspx?Id=3782. RBI’s Master Direction on Digital Payment Security Controls is addressed to regulated entities, but founders can borrow the same control mindset for company internet banking, mobile banking and payment products: https://www.rbi.org.in/scripts/NotificationUser.aspx?Id=12032&Mode=0.
The Best CS Firm In India approach is to make banking authority visible in Board records, bank mandates, payment approvals, accounting entries and the investor data room.
Why startup bank controls fail
Banking problems usually do not start with fraud. They start with convenience.
| Convenience habit | Later risk |
|---|---|
| One founder owns all bank access | Business continuity breaks if the founder is unavailable or exits |
| Finance team uses founder OTP | Personal-device dependence and weak audit trail |
| Debit card shared across teams | Expenses cannot be linked to a responsible person |
| Vendor payments approved on chat | No durable approval evidence during dispute or diligence |
| Bank mandate not updated after role change | Former employee or founder may still have authority |
| Investor money received without tagging | FEMA, accounting and cap table reconciliation becomes messy |
| Payment gateway settlement not reconciled | Revenue, GST and receivable records drift |
| Cash withdrawals not controlled | Expense evidence and tax treatment become weak |
Founders often tighten bank controls only after a loss. A better trigger is scale: once monthly payments, collections or payroll become material, bank authority should be documented like any other Board-level control.
Build a payment approval matrix
Write the payment matrix before a dispute appears.
| Payment type | Suggested control |
|---|---|
| Salary and contractor fee | Approved payroll sheet, bank proof and tax deduction review |
| Vendor invoice | PO or contract, invoice, delivery proof and GST check |
| Founder reimbursement | Expense proof, business purpose and finance review |
| Related-party payment | Board note, Section 188 review where relevant and disclosure trail |
| Statutory dues | Challan, return reference and calendar owner |
| Rent and deposits | Lease agreement, security deposit register and TDS check |
| Customer refund | Contract basis, refund approval and GST credit note where relevant |
| Loan repayment | Loan agreement, Board approval and lender statement |
| Foreign payment | FEMA, tax withholding, invoice, purpose code and bank advice |
| Capex | Budget approval, asset register entry and invoice proof |
Do not create a matrix that nobody can follow. Start with practical thresholds: routine operating payments, high-value payments, related-party payments, foreign payments, capital payments and emergency payments.
UPI, cards and payment apps need company-level discipline
UPI and cards are convenient, but they often break accounting discipline. A company UPI handle should not be tied casually to one founder’s personal device without backup, access policy and reconciliation. Company cards should be issued to named users with limits and expense rules.
Controls to implement:
- Use company bank accounts, not personal accounts, for company receipts and payments.
- Keep separate cards for company spending where the bank product permits it.
- Set per-transaction and monthly limits for cards and UPI.
- Store invoice, receipt and business purpose for every card transaction.
- Disable access immediately when an employee exits or role changes.
- Reconcile payment gateway, UPI, POS and bank settlement reports monthly.
- Avoid sharing card numbers, OTPs, PINs or net-banking credentials.
RBI’s payment-security framework stresses robust authentication, monitoring, reconciliation and customer protection for regulated entities. Founders should translate that into internal controls: access should be named, approvals should be traceable, and unusual transactions should be reviewed quickly.
Bank control checklist before fundraising
Add these records to the investor data room:
| Folder | Documents |
|---|---|
| Bank accounts | Account list, opening dates, branch, account purpose and current status |
| Mandates | Bank mandate forms and Board resolutions for signatories |
| Access | Net-banking users, roles, limits and last review date |
| Statements | Bank statements for diligence period, usually 12 to 36 months |
| Reconciliations | Bank reconciliation, payment gateway settlements and receivable matching |
| Payments | High-value payment approvals, related-party payments and statutory challans |
| Investor funds | FIRC, bank advice, purpose tags, valuation and allotment trail where applicable |
| Loans | Sanction letters, security, repayment schedule and covenants |
| Cards and UPI | User list, limits, statements and expense policy |
| Exceptions | Fraud incidents, chargebacks, disputed payments and recovery steps |
The data room should let an investor move from bank statement to accounting entry to approval evidence without asking ten follow-up questions.
Banking controls by startup type
| Startup type | Specific control focus |
|---|---|
| SaaS | Subscription collections, foreign inward remittances, refunds and chargebacks |
| D2C | Payment gateway settlements, COD reconciliation, marketplace deductions and refunds |
| Manufacturing | Vendor advances, capex payments, import payments, GST and e-way bill matching |
| Fintech | Partner-bank flows, customer funds, escrow, regulatory perimeter and access controls |
| Marketplace | Seller payouts, commissions, customer refunds and wallet or nodal-account rules |
| Services | TDS, retainer invoices, employee reimbursements and foreign client receipts |
| Quick commerce | Dark-store cash controls, vendor credit, rider payments and inventory variance |
When to update bank mandates
Update bank mandates immediately when:
- A founder resigns or loses operating role.
- A CFO, finance manager or authorised employee exits.
- The Board approves a new signatory or removes one.
- Investment documents impose reserved matters or payment restrictions.
- The company opens a new business line, branch, warehouse or city office.
- The company takes debt and lender covenants affect payments.
- There is a suspected credential compromise or payment fraud.
- A mobile number or email used for bank alerts changes.
Keep the old mandate, new mandate, Board approval and bank acknowledgement together.
10-day cleanup plan
| Day | Action |
|---|---|
| 1 | List all bank accounts, cards, UPI IDs, payment gateways and loan accounts |
| 2 | Export all authorised signatories and net-banking users |
| 3 | Match bank mandates with Board resolutions |
| 4 | Create payment approval thresholds |
| 5 | Review related-party and founder payments for the last 12 months |
| 6 | Reconcile payment gateway settlements with books |
| 7 | Remove access for exited users and old devices |
| 8 | Create card and UPI expense rules |
| 9 | Put bank records into the investor data room |
| 10 | Schedule monthly bank-control review with founders and finance |
Sources
- Companies Act, 2013, Section 179: https://www.indiacode.nic.in/show-data?actid=AC_CEN_22_29_00008_201318_1517807327856&orderno=183
- Companies Act, 2013, Section 118: https://www.indiacode.nic.in/show-data?actid=AC_CEN_22_29_00008_201318_1517807327856&orderno=121§ionId=1309§ionno=118
- RBI FAQ on Master Direction on KYC, dated 9 June 2025: https://www.rbi.org.in/commonman/english/Scripts/FAQs.aspx?Id=3782
- RBI Master Direction on Know Your Customer: https://www.rbi.org.in/commonman/english/scripts/notification.aspx?id=2607
- RBI Master Direction on Digital Payment Security Controls: https://www.rbi.org.in/scripts/NotificationUser.aspx?Id=12032&Mode=0
FAQ Section
Can a startup operate its bank account with only one founder as signatory?
It can happen in the earliest stage, but it creates continuity and control risk. As payments grow, the company should adopt documented thresholds, backup signatories and Board-approved banking authority.
Does every bank mandate change need a Board resolution?
For a company, bank authority should be supported by Board approval or a valid authority record. Banks usually ask for a resolution when signatories, mode of operation or account powers change.
Should company UPI be linked to a founder’s personal phone?
Avoid founder-personal dependence where possible. If a startup uses UPI or mobile banking, access should be named, controlled, backed up and reconciled with company books.
What do investors check in banking diligence?
Investors check bank statements, account list, mandates, payment approvals, related-party payments, investor-fund receipt trail, loan accounts, payment gateway settlements and unusual transfers.
When should bank access be reviewed?
Review it monthly in a funded or fast-growing startup, and immediately after founder role changes, employee exits, suspected fraud, new debt, new investment or new payment products.
Founder / Business Takeaway
Banking control is founder discipline in practical form. If money can move without clear authority, the company has a governance weakness even when the business is growing.
Need expert support?
BSA helps Indian startups clean up Board resolutions, bank mandates, authorised signatory records, related-party payment files, founder reimbursements and investor-ready banking data rooms.
Need expert support?
BSA supports founders across India with ROC, FEMA, due diligence, fundraising readiness, and company secretarial execution.
