Investor Data Room Checklist for Indian Startups: Cap Table, ROC, FEMA, Contracts, IP, ESOP and Tax Records Founders Should Prepare Before Funding
Indian startups should build the investor data room before outreach, not after an investor asks for it. A good data room lets a founder answer the first serious diligence call with evidence: clean cap table…
Direct answer for founders
Indian startups should build the investor data room before outreach, not after an investor asks for it. A good data room lets a founder answer the first serious diligence call with evidence: clean cap table, correct ROC filings, foreign investment records, tax returns, IP ownership, customer contracts, employee documents, ESOP approvals, vendor agreements, privacy controls and board approvals.
The data room is not a vanity exercise. It decides whether a funding round feels controlled or chaotic. A startup can have strong revenue and still lose momentum because share allotment forms are missing, a founder’s IP was never assigned, foreign investment filings are incomplete, contractor agreements do not transfer code, GST returns do not match books, or customer contracts have unlimited liability.
Use official law and regulator sources as the base. Section 42 of the Companies Act, 2013 governs private placement of securities: https://www.indiacode.nic.in/show-data?actid=AC_CEN_22_29_00008_201318_1517807327856&orderno=44. The Companies Act, 2013 is available on MCA: https://www.mca.gov.in/Ministry/pdf/CompaniesAct2013.pdf. DPIIT’s Startup India recognition and tax exemption pages explain recognition and 80-IAC routes: https://www.startupindia.gov.in/content/sih/en/startupgov/startup_recognition_page.html and https://www.startupindia.gov.in/content/sih/en/form80iac.html. FEMA and foreign investment reporting must be checked against RBI and FEMA rules where non-resident investors, founders or group entities are involved: https://www.rbi.org.in/.
What a data room should prove
An investor is not only asking for documents. The investor is testing whether the business can survive scrutiny after money enters. The data room should prove six things:
- The company exists and is authorised to run the business it is running.
- The cap table shown in the pitch deck matches statutory records.
- Shares, CCDs, CCPS, SAFEs, notes or other securities were issued with proper approvals.
- The company owns or controls the assets it claims to own.
- Tax, payroll, GST, TDS, FEMA and ROC compliance risks are visible and managed.
- Material contracts do not hide liabilities that can damage valuation or closing.
Founders should not wait for a full legal diligence checklist from investor counsel. By then, the round is already under pressure. Build a founder version now.
Folder 1: incorporation and corporate records
This folder should contain the legal identity of the company and the company-secretarial trail.
| Document | Why it matters in diligence |
|---|---|
| Certificate of incorporation | Confirms legal existence, date, CIN and entity type |
| Memorandum and Articles | Shows objects, share capital, transfer restrictions and governance rules |
| PAN, TAN and GST registration | Helps finance and tax checks start cleanly |
| Board and shareholder registers | Shows directors, members, transfers and corporate records |
| Share certificates | Confirms securities were actually issued and recorded |
| Board minutes and shareholder resolutions | Proves approvals for allotments, loans, ESOP, bank accounts, contracts and founder matters |
| Auditor appointment and ADT-1 records | Shows statutory audit hygiene |
| Annual filings | Financial statements, annual returns and related ROC filings |
Founder mistake: uploading only the incorporation certificate and calling it corporate records. Investor counsel will ask for the history, not only the birth certificate.
Folder 2: cap table and securities history
The cap table is usually the first real stress test. It should reconcile three versions of ownership: founder understanding, company records and ROC filings.
Prepare:
- Current cap table on issued and fully diluted basis.
- Historical cap table after every allotment or transfer.
- List of shareholders with name, address, residency, PAN or relevant ID, number of securities and class.
- Board approvals for every allotment.
- Shareholder approvals where required.
- Valuation reports where required.
- PAS-3 and other ROC filing acknowledgements.
- Private placement records where applicable.
- Share certificate copies and stamping evidence.
- Securities premium and bank receipt trail.
- ESOP pool and granted options shown separately.
For priced rounds, investors will usually review whether earlier rounds followed Section 42, Section 62, valuation and filing discipline. If there are non-resident investors, the cap table must also talk to FEMA records.
Folder 3: founder documents and founder governance
Founders often assume investor diligence is only about the company. It is also about founder control, commitments and conflicts.
Keep:
| Item | What to show |
|---|---|
| Founder agreement | Roles, equity, vesting, leaver terms, IP, confidentiality and disputes |
| Employment or consulting terms | Whether founders are formally engaged by the company |
| IP assignment | Pre-incorporation code, designs, content, domain, brand and product assets moved to the company |
| Conflict disclosures | Other businesses, employment restrictions, related-party dealings |
| Founder loans | Amounts, terms, approvals and repayment position |
| Access control | Company-owned emails, domains, repositories, cloud and bank access |
If one founder created the product before incorporation, record the transfer. If one founder still controls the domain, payment gateway, cloud account or GitHub repo personally, fix it before diligence.
Folder 4: FEMA and foreign investment records
Any non-resident founder, overseas investor, foreign holding structure, external commercial borrowing, foreign subsidiary, overseas bank account, foreign customer revenue or cross-border share issue deserves a separate FEMA check.
For foreign investment into the Indian company, keep:
- KYC and remittance documents from the authorised dealer bank.
- FIRC or inward remittance evidence.
- Valuation report for issue or transfer where required.
- Board and shareholder approvals.
- Share subscription agreement.
- FC-GPR or FC-TRS filing acknowledgements where applicable.
- Entity Master and FIRMS portal records.
- Downstream investment records if the startup invests in another Indian entity.
- Annual return on foreign liabilities and assets where applicable.
Do not tell investors “the bank handled FEMA” unless you have the filings. Banks facilitate remittance and reporting, but the company remains responsible for its compliance trail.
Folder 5: tax, GST and finance records
Finance diligence is not just revenue. It tests whether revenue, invoices, returns, bank receipts and management MIS can be trusted.
Prepare:
| Sub-folder | Documents |
|---|---|
| Financial statements | Audited financials, provisional financials, trial balance, ledgers |
| Tax returns | ITR acknowledgements, computation, assessment notices if any |
| GST | Registration, GSTR-1, GSTR-3B, annual return if applicable, reconciliations |
| TDS | TAN, challans, returns, Form 16/16A, vendor TDS workings |
| Payroll | Salary registers, PF/ESI if applicable, professional tax where applicable |
| Bank | Statements, bank confirmations, loan records and security documents |
| Revenue | Customer-wise revenue, invoices, credit notes, refunds and write-offs |
| Expenses | Vendor invoices, related-party expenses and reimbursement policy |
Founder mistake: sharing a pitch-deck revenue number without the invoice and bank trail. Diligence teams will test the number from multiple sides.
Folder 6: customer, vendor and revenue contracts
The contract folder should explain how the startup earns money and what risks are attached to that revenue.
Customer contracts should include:
Free Weekly Newsletter
Subscribe to BSA startup funding alerts
- Every Sunday, all Indian startup funding alerts in one place
- Monthly funding report on the last day of the month
- Free, concise, founder-focused, and easy to unsubscribe
Get the complete Indian startup funding roundup in your inbox, covering deals, sectors, investor moves, and founder readiness notes from the week.
Built for founders, investors, CFOs, and advisors
No spam. Unsubscribe anytime.
- Master services agreements.
- Order forms and statements of work.
- Purchase orders.
- Product terms.
- SLA and support terms.
- Data processing terms where personal data is handled.
- Liability caps and indemnity language.
- Renewal, termination and refund terms.
- Unusual side letters or discounts.
Vendor contracts should include cloud, software, payment gateway, logistics, manufacturing, consultants, agencies, recruiters, outsourced developers, data processors and marketplace agreements.
Investors will ask whether revenue is sticky, assignable, cancellable, refundable, dependent on one customer, or exposed to unlimited claims. A founder-friendly contract does not hide risk; it shows the risk clearly.
Folder 7: IP, product and technology ownership
For SaaS, AI, fintech, marketplace, D2C, gaming, creator, manufacturing or deeptech startups, IP diligence can become central.
Keep:
- Founder IP assignment agreements.
- Employee and contractor IP assignment clauses.
- Repository access list.
- Open-source software policy and licence review.
- Trademark applications and registrations.
- Domain ownership records.
- Product architecture notes.
- Patent or design filings where applicable.
- Dataset source records for AI or analytics products.
- Customer data and training-data permissions where relevant.
If contractors built the first version, check whether the agreement says work product belongs to the company. Payment of an invoice alone does not always create clean IP ownership.
Folder 8: employees, consultants and ESOP
People records matter because investors do not want hidden wage, IP, confidentiality or option disputes.
Prepare:
| Area | Documents |
|---|---|
| Employees | Offer letters, employment agreements, confidentiality, IP, exits |
| Consultants | Consulting agreements, invoices, IP assignment, termination records |
| ESOP | Scheme, board/shareholder approvals, grants, vesting, exercise, cancellations |
| Policies | Leave, remote work, device, POSH where applicable, expense policy |
| Payroll compliance | TDS, PF/ESI/professional tax where applicable |
For ESOP, show the authorised pool, grants, vested/unvested options and fully diluted impact. Investors dislike finding informal option promises in emails after the cap table has already been negotiated.
Folder 9: privacy, DPDP, cyber and sector compliance
A startup that handles personal data should maintain a privacy and security folder. This is especially important for fintech, healthtech, edtech, HR tech, SaaS, AI, marketplaces and consumer apps.
Keep:
- Privacy notice and product consent screens.
- Data map.
- Vendor processor list.
- Data retention and deletion process.
- Breach response playbook.
- Access-control records.
- Security policies and audit reports if available.
- Sector licences or regulatory correspondence where applicable.
- Customer security questionnaires and responses.
DPDP readiness is now a diligence signal. It tells investors whether the company can sell to enterprises, handle user trust and scale responsibly.
Folder 10: litigation, notices and risk disclosures
Do not hide disputes. Put them in a controlled disclosure folder.
Include:
- Legal notices sent or received.
- Tax, GST, MCA, labour, FEMA or sector notices.
- Customer disputes.
- Founder disputes.
- Employee claims.
- IP objections or trademark oppositions.
- Settlement documents.
- Legal opinions where obtained.
The best disclosure is specific: what happened, amount involved, current status, next date, likely exposure and documents available. Surprises damage trust more than small disclosed risks.
A 21-day data-room build plan
| Days | Action |
|---|---|
| 1-3 | Collect incorporation, MoA, AoA, PAN, GST, board and shareholder records |
| 4-5 | Reconcile cap table, share certificates, PAS-3, valuation and bank receipts |
| 6-7 | Prepare founder, IP and account-control cleanup list |
| 8-9 | Compile FEMA, foreign investment and AD bank records |
| 10-12 | Pull financials, tax, GST, TDS and payroll records |
| 13-14 | Review customer and vendor contracts for unusual clauses |
| 15-16 | Build ESOP and employee folders |
| 17-18 | Add privacy, DPDP, cyber and sector compliance documents |
| 19 | Create litigation and notices disclosure note |
| 20 | Prepare a data-room index with owner and status |
| 21 | Run founder review and mark gaps before investor outreach |
Founder mistakes to avoid
- Uploading documents without checking whether they contradict the pitch deck.
- Hiding cap table side arrangements.
- Waiting for investor counsel to discover missing PAS-3 or FEMA filings.
- Treating contractor invoices as IP assignment.
- Making informal ESOP promises outside the approved plan.
- Sharing customer contracts without checking confidentiality restrictions.
- Not separating final signed documents from drafts.
- Giving all investors unrestricted access before qualification.
- Not keeping a red-flag memo for known gaps.
Sources
- Companies Act, 2013 on MCA: https://www.mca.gov.in/Ministry/pdf/CompaniesAct2013.pdf
- Section 42 on private placement, India Code: https://www.indiacode.nic.in/show-data?actid=AC_CEN_22_29_00008_201318_1517807327856&orderno=44
- Startup India DPIIT recognition page: https://www.startupindia.gov.in/content/sih/en/startupgov/startup_recognition_page.html
- Startup India 80-IAC page: https://www.startupindia.gov.in/content/sih/en/form80iac.html
- Reserve Bank of India: https://www.rbi.org.in/
FAQ Section
When should an Indian startup create an investor data room?
Create the first version before investor outreach. It can be simple at seed stage, but it should already contain incorporation, cap table, tax, contracts, IP, founder and compliance records.
What is the most common data-room problem?
The most common problem is mismatch. The pitch deck says one cap table or revenue number, while ROC filings, bank records, invoices or contracts show something different.
Do pre-revenue startups need a data room?
Yes. A pre-revenue startup still needs incorporation records, founder IP assignment, cap table, approvals, contracts, product ownership and basic compliance records.
Should founders disclose known compliance gaps?
Yes, with context. A clear gap note with corrective steps is usually better than letting investor counsel discover the issue late.
Can one Google Drive folder be enough?
The tool does not matter. What matters is version control, access control, clear indexing, signed documents, and a founder-reviewed red-flag list.
Founder / Business Takeaway
A data room is a founder-control system. If the company can show clean ownership, filings, contracts, tax and IP records, diligence becomes a business conversation instead of a document rescue exercise. The Best CS Firm In India mindset is to make the evidence trail investor-ready before the term sheet arrives.
Need expert support?
BSA helps Indian startups prepare investor data rooms, cap tables, ROC records, FEMA documents, ESOP files, IP assignments and diligence-ready compliance checklists.
Need expert support?
BSA supports founders across India with ROC, FEMA, due diligence, fundraising readiness, and company secretarial execution.
