SEBI Annual Report 2025-26: Startup Founder Checklist on IPO Readiness, AIF Capital, Governance, Cybersecurity and Enforcement Signals
SEBI published its Annual Report 2025-26 in August 2026: https://www.sebi.gov.in/reports-and-statistics/publications/aug-2026/annual-report-2025-26.html. For startup founders, the report matters because it…
What changed now
SEBI published its Annual Report 2025-26 in August 2026: https://www.sebi.gov.in/reports-and-statistics/publications/aug-2026/annual-report-2025-26.html. For startup founders, the report matters because it shows where Indian capital-market regulation is moving: primary markets, fund management, foreign portfolio investment, investor protection, technology supervision, cybersecurity, enforcement and corporate governance.
The report is not a new standalone law. It is still a current official document founders should read as a market signal. If a startup expects to raise from AIFs, work with wealth platforms, prepare for an IPO, issue debt securities, become acquisition-ready, serve regulated financial entities, or handle investor-facing data, SEBI’s priorities should influence internal controls.
The strongest founder takeaway is simple: private companies should not wait until listing to behave like records matter. Capital is becoming more documentation-led. AIF managers, investment bankers, strategic investors and public-market investors will expect better board records, cap table discipline, customer-contract disclosure, clean related-party documentation, cybersecurity evidence and accurate financial statements.
Why a SEBI annual report matters to a private startup
Founders sometimes ignore SEBI material because they are not listed. That is too narrow. SEBI regulates the ecosystem around startup capital: AIFs, angel funds, FPIs, investment advisers, merchant bankers, stock brokers, exchanges, listed exits, public issues and enforcement around securities markets.
| Startup situation | Why SEBI signals matter |
|---|---|
| Raising from AIFs | AIF managers have their own regulatory and diligence duties |
| Preparing Series B or later | Investors ask for stronger governance and reporting |
| Considering IPO in 2-4 years | Public-market hygiene starts before DRHP drafting |
| Issuing debt or structured instruments | Disclosure and governance expectations increase |
| Building wealthtech or fintech | Regulatory perimeter and investor-protection standards matter |
| Selling to regulated entities | Cybersecurity, audit and vendor-risk evidence becomes important |
| Planning secondary sale | Investor rights, transfer records and disclosures need precision |
The Best CS Firm In India view is that founders should convert SEBI’s annual-report signals into internal discipline before a banker, AIF, regulator or buyer forces the issue.
Primary-market signal: public-market readiness is becoming more serious
SEBI’s annual report includes a dedicated primary-market chapter covering equity, debt, public issues and corporate governance developments: https://www.sebi.gov.in/reports-and-statistics/publications/aug-2026/Chapter%2003.pdf. For startups, the point is not to copy listed-company compliance immediately. The point is to start building habits that later survive listing diligence.
Founders should review:
| IPO-readiness area | Startup action now |
|---|---|
| Financial statements | Close monthly books, reconcile revenue and clean related-party entries |
| Board governance | Maintain minutes, approvals, committees where appropriate and risk registers |
| Share capital | Fix share certificates, PAS-3, transfers, ESOP grants and investor rights |
| Material contracts | Summarise customer, vendor, lender and partnership obligations |
| Litigation | Track notices, disputes, recovery matters and settlements |
| Related-party transactions | Maintain disclosure, pricing basis and approvals |
| ESOPs | Keep grant, vesting, exercise, lapse and tax records clean |
| Use of funds | Maintain board-approved budgets and actual utilisation trail |
Companies rarely become IPO-ready in one quarter. The discipline starts when the company is still private and smaller.
AIF capital signal: investor diligence is not only commercial
SEBI’s fund-management chapter covers AIFs and other fund management activities: https://www.sebi.gov.in/reports-and-statistics/publications/aug-2026/Chapter%2005.pdf. Startup founders raising from AIFs should understand that institutional investors do not only judge product and growth. They check whether their own investment can be made, monitored and exited within applicable fund documents and regulations.
Before approaching AIFs, prepare:
- Cap table and fully diluted shareholding.
- Constitutional documents and shareholder agreements.
- Valuation reports and instrument terms.
- Past issuance and transfer filings.
- Board and shareholder approvals.
- FEMA filings where non-resident investment exists.
- ESOP documents and employee equity schedule.
- Founder employment, vesting and IP assignment documents.
- Related-party transaction register.
- Tax, GST, TDS, PF and ESIC compliance status.
- Material customer and vendor contracts.
- Data-room index with source files, not only management summaries.
AIF managers prefer founders who can answer diligence questions with records instead of explanations.
Corporate governance signal: clean decisions will matter
SEBI’s primary-market chapter also discusses corporate governance and corporate restructuring. Even private startups should track the governance themes: transparency, board accountability, investor disclosures, restructuring records and decision controls.
Practical founder checklist:
| Control | What to do |
|---|---|
| Board calendar | Hold regular board meetings and circulate papers before meetings |
| Reserved matters | Keep a tracker for investor and board approvals |
| Banking authority | Update authorised signatories and bank mandates after role changes |
| Related parties | Disclose founder, relative, advisor and group-company dealings |
| Contract authority | Define who can sign customer, vendor, loan and employment documents |
| Conflict records | Record abstentions and conflict disclosures |
| Risk register | Track tax notices, customer concentration, data incidents and disputes |
| Document retention | Keep signed versions, not editable drafts as final records |
This is not bureaucracy. It is valuation protection.
Cybersecurity and technology supervision signal
SEBI’s technology chapter says SEBI used technology, data analytics and cybersecurity oversight during 2025-26 and describes platforms and supervision measures: https://www.sebi.gov.in/reports-and-statistics/publications/aug-2026/Chapter%2009.pdf. Startups selling to regulated entities should pay attention. Banks, brokers, AMCs, RIAs, exchanges, depositories, fintech partners and enterprise buyers increasingly ask vendors to prove security posture.
Free Weekly Newsletter
Subscribe to BSA startup funding alerts
- Every Sunday, all Indian startup funding alerts in one place
- Monthly funding report on the last day of the month
- Free, concise, founder-focused, and easy to unsubscribe
Get the complete Indian startup funding roundup in your inbox, covering deals, sectors, investor moves, and founder readiness notes from the week.
Built for founders, investors, CFOs, and advisors
No spam. Unsubscribe anytime.
Prepare a vendor-security file:
| Document | Why it matters |
|---|---|
| Information security policy | Shows governance owner and control baseline |
| Access-control list | Proves who can access production, code, customer data and admin systems |
| Incident response plan | Shows how breaches, outages and suspicious activity are handled |
| Vendor list | Tracks cloud, payments, analytics, KYC, CRM and data processors |
| Data-retention policy | Helps answer customer and privacy diligence |
| Pen-test or vulnerability report | Shows technical assurance where available |
| Backup and recovery evidence | Supports business-continuity claims |
| Employee onboarding/offboarding checklist | Reduces access leakage |
For a wealthtech, fintech, regtech, cybersecurity, data infrastructure or enterprise SaaS startup, weak cyber records can block procurement even when the product is strong.
Enforcement signal: accuracy and records are not optional
SEBI’s regulatory action and enforcement chapter records investigations, surveillance and enforcement activity during 2025-26: https://www.sebi.gov.in/reports-and-statistics/publications/aug-2026/Chapter%2010.pdf. The founder lesson is not fear. The lesson is evidence.
Investors become cautious when a startup’s records cannot support statements made in a deck. Do not make claims about revenue, margins, customers, licences, regulatory approvals, AI capability, patents, ESG impact, user numbers or pipeline unless the company can support the claim.
Create a claims file for fundraising:
| Claim type | Evidence |
|---|---|
| Revenue | Signed contracts, invoices, bank receipts and revenue recognition note |
| Customer logos | Consent, active contract or permitted case-study use |
| Regulatory approval | Licence, registration, exemption or legal memo |
| IP | Filing receipt, assignment, repository evidence or licence |
| ESG/climate impact | Methodology, measurement data and assumptions |
| AI/product capability | Demo logs, model documentation and limitation notes |
| Market leadership | Independent data source or carefully qualified language |
Overstatement creates diligence and reputational risk. Conservative, provable language is stronger.
Founder impact by stage
| Stage | What SEBI’s 2025-26 report should change |
|---|---|
| Pre-seed | Start basic board, cap table, IP and tax discipline |
| Seed | Build investor-ready data room and claims file |
| Series A | Add governance calendar, risk register and contract summaries |
| Series B/C | Prepare IPO-style financial, ESOP, related-party and cyber evidence |
| Pre-IPO | Run legal, secretarial, tax, regulatory and business diligence before bankers begin |
| Fintech/wealthtech | Review regulatory perimeter, customer disclosures, cyber controls and partner contracts |
Founders should not blindly become listed-company compliant too early. The right move is to build private-company controls that can scale.
Documents founders should prepare this month
- Updated cap table with all instruments and ESOPs.
- Board and shareholder approval tracker.
- Related-party register with pricing basis.
- Top customer and vendor contract summary.
- Tax compliance dashboard for income tax, GST and TDS.
- FEMA filing tracker where relevant.
- Cybersecurity and data-handling folder.
- Investor claim evidence folder.
- Litigation and notice tracker.
- IPO or strategic-exit readiness gap note.
Mistakes to avoid
- Treating SEBI material as irrelevant because the company is private.
- Approaching AIFs without a clean cap table and issuance history.
- Making investor-deck claims without evidence.
- Ignoring cybersecurity until an enterprise buyer asks for a questionnaire.
- Hiding related-party payments in ordinary vendor ledgers.
- Cleaning ESOP records only when employees demand liquidity.
- Waiting for a pre-IPO banker to discover three years of missing approvals.
- Assuming a compliance update applies without checking the exact regulation, entity type and commencement.
Practical next step
Founders should run a two-hour internal review around the SEBI annual-report themes: public-market discipline, AIF diligence, governance, technology controls and enforcement-proof records. The output should be a 30-day cleanup list owned by founders, finance, legal, tech and people teams.
Sources
- SEBI Annual Report 2025-26 landing page: https://www.sebi.gov.in/reports-and-statistics/publications/aug-2026/annual-report-2025-26.html
- SEBI Annual Report 2025-26, Chapter 3 on Primary Markets: https://www.sebi.gov.in/reports-and-statistics/publications/aug-2026/Chapter%2003.pdf
- SEBI Annual Report 2025-26, Chapter 5 on Fund Management Activities: https://www.sebi.gov.in/reports-and-statistics/publications/aug-2026/Chapter%2005.pdf
- SEBI Annual Report 2025-26, Chapter 9 on Technology: https://www.sebi.gov.in/reports-and-statistics/publications/aug-2026/Chapter%2009.pdf
- SEBI Annual Report 2025-26, Chapter 10 on Regulatory Action, Supervision and Enforcement: https://www.sebi.gov.in/reports-and-statistics/publications/aug-2026/Chapter%2010.pdf
- SEBI Annual Report 2025-26, Chapter 6 on FPI and FVCI themes: https://www.sebi.gov.in/reports-and-statistics/publications/aug-2026/Chapter%2006.pdf
FAQ Section
Is the SEBI Annual Report 2025-26 a new compliance circular?
No. It is an official annual report, not a standalone circular creating one new checklist for every private company. It is still useful because it shows SEBI’s current market, supervision, technology and enforcement priorities.
Why should a private startup read SEBI’s annual report?
Private startups raise from AIFs, prepare for IPOs, sell to regulated entities, issue securities, make investor claims and sometimes handle financial data. SEBI’s priorities influence investor diligence and public-market expectations.
Does every startup need IPO-level governance now?
No. A small private startup should not copy every listed-company process. It should build scalable controls: clean cap table, board approvals, related-party records, tax files, IP ownership, contract summaries and cyber evidence.
What should AIF-backed founders prioritise?
Prioritise issuance history, valuation support, cap table accuracy, FEMA filings where relevant, ESOP records, investor rights, related-party disclosures and management claims that can be verified.
What is the fastest action after reading the report?
Create a 30-day cleanup list covering board records, cap table, AIF diligence documents, cyber controls, customer contracts, tax status, related-party items and investor-deck claim evidence.
Founder / Business Takeaway
SEBI’s latest annual report should push founders toward better records before listing, later-stage fundraising or regulated-enterprise sales. The same controls that satisfy investors also reduce founder stress.
Need expert support?
BSA helps startups build board, cap table, AIF diligence, IPO-readiness, cybersecurity-documentation and compliance files that stand up to institutional investor review.
Need expert support?
BSA supports founders across India with ROC, FEMA, due diligence, fundraising readiness, and company secretarial execution.
