Unified Startup Enablement & Growth Platform

What Investors Look for in Due Diligence

Due diligence is the process by which an investor or acquirer verifies every material claim made during the fundraising or M&A process. It is not a formality — it is the moment where a term sheet either converts to a signed deal or dies quietly. Preparation is everything: founders who enter due diligence with a well-organised virtual data room (VDR), clean corporate records, and pre-answered common questions close significantly faster and at higher valuations than founders who scramble to produce documents on request.

In India, due diligence has additional complexity compared to the US: regulatory filings are spread across MCA21, GST Network, Income Tax, RBI, and DPIIT portals; FEMA compliance for foreign investment requires specific documentation that is often missing; and the Companies Act 2013 generates a paper trail of filings that investors will cross-reference against the company's internal records. A discrepancy between MCA filings and the company's own cap table is an immediate red flag that triggers deeper scrutiny.

Speed matters: Investors track how quickly and completely you respond to DD requests — slow responses signal operational weakness
Completeness signals trust: A complete, well-organised VDR tells investors the founders take governance seriously
Pre-emption reduces renegotiation: Proactively disclosing known issues prevents investors from discovering them mid-DD and using them to renegotiate terms
India-specific compliance is disproportionately scrutinised: FEMA violations, GST arrears, and labour law non-compliance are common deal-breakers in India DD

Due Diligence Checklist by Category

Category	Key Documents	Common Issues Found
Corporate	Certificate of Incorporation, MoA & AoA, board and shareholder resolutions, register of members, share certificates, MGT-7 annual returns, MCA master data	Cap table mismatch with MCA filings; missing EGM resolutions for share allotments; outdated AoA not reflecting current share classes
Legal	SHA, SSA, NDAs with key customers/partners, IP assignment agreements, litigation disclosure, pending notices, employment agreements for key personnel	IP not formally assigned from founders to company; pending consumer/labour disputes not disclosed; missing arbitration clauses
Financial	Audited P&L, balance sheet, cash flow (3 years); GST returns; TDS returns; income tax assessments; bank statements; accounts receivable ageing; management accounts	GST reconciliation gaps; TDS defaults; revenue recognition inconsistencies between management accounts and audited financials
Commercial	Top 10 customer contracts, MSAs, SLAs, LOIs; pipeline and forecast; churn data; customer NPS; key customer references	Contracts with auto-termination clauses on change of control; revenue concentration in 1–2 customers; SLA penalties not disclosed
Technical	Architecture diagram, data flow diagram, security audit/pen test reports, cloud infrastructure spend, data residency policies, third-party dependency list	No penetration testing done; data stored in non-compliant jurisdictions; critical dependency on a single third-party API with no SLA
People	Org chart, employment agreements, ESOP schedule (Form SH-6), offer letters, PF/ESI compliance, POSH committee records, key-person risk assessment	PF/ESI non-compliance; undocumented ESOP grants; missing POSH Internal Committee; no non-compete in founder/CXO agreements

Building Your Virtual Data Room

Recommended Folder Structure

A well-organised VDR eliminates investor frustration and signals operational maturity. Use this folder hierarchy as your template:

01_Corporate: Certificate of Incorporation, MoA/AoA, board resolutions, shareholder agreements, cap table, annual returns
02_Financial: Audited financials (3 years), management accounts (trailing 12 months), bank statements, financial model, GST returns, TDS returns, tax assessments
03_Legal: Key contracts (customer MSAs, vendor agreements, leases), IP assignments, employment agreements (key personnel), NDA template, any litigation or notices
04_Commercial: Customer list (with ARR/MRR), pipeline report, churn analysis, unit economics workbook, market sizing research
05_Technical: Architecture documentation, security reports, cloud spend breakdown, data privacy policies, third-party integrations list
06_People: Org chart, ESOP schedule, PF/ESI compliance certificates, POSH records, key hire plans
07_Regulatory: CIN, DPIIT certificate, GST registration, RBI/FEMA filings, sector-specific licences

Document Naming Conventions

Use consistent, date-stamped naming: YYYYMMDD_DocumentType_Version. Example: 20250301_AuditedFinancials_FY2024_v1.pdf. This makes it immediately clear which document is most current and prevents confusion when multiple versions exist. Never upload a document named "Final_FINAL_v3_use_this_one.pdf" — it signals disorganisation.

India-Specific DD Documents

Corporate Identity and Regulatory Registrations

CIN (Corporate Identification Number): The unique identifier for your company on MCA21. All investors will look up your CIN on the MCA portal to verify filings, charges, and director details independently. Ensure your MCA records match your internal records exactly. DPIIT Certificate: For startups recognised by DPIIT (Department for Promotion of Industry and Internal Trade), this certificate unlocks tax exemptions, ESOP tax deferral for employees, and preferential treatment in government procurement. Investors view DPIIT recognition as a positive signal.

GST Registration Certificate: Investors will request GST returns for the past 2–3 years to verify revenue independently (GSTR-1 shows sales invoices). Any gap between GST-reported turnover and management-reported ARR will trigger questions. FEMA compliance documentation: For companies that have received foreign investment, FC-GPR forms filed with the RBI-authorised dealer bank for each foreign investment event must be available. Missing FC-GPR filings for prior foreign investment rounds is a FEMA violation that must be remediated before a new round.

Sector-Specific Licences

Depending on your sector: Fintech: RBI NBFC licence, Payment Aggregator authorisation, Prepaid Payment Instrument licence as applicable. Edtech: No central licence, but state-level shop and establishment registration required. Healthtech: Clinical Establishment Act registration; Medical Device Rules compliance if applicable. Foodtech: FSSAI licence (basic, state, or central depending on turnover). Missing sector-specific licences are automatic DD red flags.

Managing Access and NDAs

VDR Access Tiering

Not all investors or advisors should see everything immediately. Structure access in tiers: Tier 1 (Initial): Company overview, pitch deck, financial summary, market sizing — shared after initial interest, before NDA. Tier 2 (Post-NDA): Full financials, customer list, commercial contracts, key personnel list — shared after executed NDA with all investment team members. Tier 3 (Deep DD): Individual employment agreements, full customer contracts including pricing, source code architecture, PF/ESI compliance certificates — shared only with the lead investor's legal counsel during formal DD.

NDA Before Sharing Sensitive Documents

Require a signed NDA before granting access to Tier 2 and Tier 3 documents. Most institutional VCs have their own NDA template — review it carefully before signing. Key NDA provisions to check: exclusivity (ensure no inadvertent exclusivity is granted), non-solicitation of employees (some VCs include this), and duration (1–2 years is standard). For competitive situations, request that the VC restrict internal distribution to their deal team. Most VDR platforms allow you to track who accessed which document and when — maintain these logs for your records.

Watermarking Sensitive Documents

Watermark financial models, customer contracts, and employee data with the recipient's name and date of access. Most VDR platforms (Datasite, Intralinks) do this automatically. Watermarking discourages unauthorised sharing and creates accountability. Do not watermark marketing materials or pitch decks — watermarks on promotional documents look unprofessional.

Common Red Flags and How to Pre-Empt Them

Round 1 DD Red Flags (Investor Finds During Initial Review)

Cap table discrepancies: If MCA records show a different shareholding than the provided cap table, investors will question every other data point. Pre-empt by reconciling cap table to MCA records before starting DD. GST / revenue mismatch: If GSTR-1 shows ₹8 Cr in invoices but management accounts claim ₹12 Cr ARR, you need to explain the difference (deferred revenue, non-GST-able components, etc.) before investors ask. Undisclosed related-party transactions: Loans between founders and the company, contracts with founder-owned entities, or director remuneration above board-approved limits will be found and will prompt credibility concerns if undisclosed.

Round 2 DD Red Flags (Legal Counsel Finds During Deep DD)

Missing IP assignments: If founders coded the product before incorporation, that IP technically belongs to the individuals, not the company. A formal IP assignment agreement (with nominal consideration) must transfer this to the company. Labour law non-compliance: Missing PF/ESI registrations, no POSH Internal Committee despite having 10+ employees, or non-compliant contractor arrangements will be flagged by investor legal counsel. These are remediable but require time. FEMA violations: If an earlier foreign investment was not routed correctly (wrong pricing, missing FC-GPR, wrong instrument type), the current round cannot close until the historical violation is resolved — which may require an RBI compounding application (a formal process to settle violations).

VC DD vs M&A DD

VC Due Diligence

VC DD is primarily about confirming that the investment thesis is sound: is the team capable, is the market real, is the product defensible, and are the financials consistent with the story? VC DD typically runs 4–8 weeks for a Series A and focuses on commercial validation (customer references, churn data, pipeline), team background checks, cap table legality, and basic financial verification. VC lawyers perform legal DD focused on ensuring the transaction structure is clean — not exhaustive review of every contract the company has ever signed.

M&A Due Diligence

M&A DD is far more comprehensive. A strategic acquirer or PE firm is buying the entire business and assuming all liabilities. Their legal team will review every material contract for change-of-control provisions (contracts that terminate or require consent upon an acquisition), every employment agreement for non-compete and non-solicit clauses, every IP agreement for ownership clarity, and every regulatory licence for transferability. M&A DD also includes a full financial audit of historical results, a tax DD to identify contingent tax liabilities, and often an environmental and technical DD for technology companies. Timeline is typically 8–16 weeks, and the cost of DD advisors (lawyers, accountants, technical specialists) can run ₹50L–2 Cr depending on company complexity.

VDR Tools: India Startup Usage and Cost

Datasite (formerly Merrill DataSite)

The global enterprise standard for M&A data rooms. Advanced permission controls, watermarking, Q&A module for investor queries, full audit trail, and reporting on document access patterns. Cost: $1,500–5,000/month depending on storage and users. Best for: Series C+ fundraises and M&A processes where a large number of buyers or advisors need simultaneous access.

Intralinks

Competing enterprise VDR with similar capabilities to Datasite. Strong in PE and debt financing transactions. Cost: similar to Datasite. Best for: complex M&A transactions with multiple bidders.

DocSend

Lightweight document sharing platform with link-level analytics (who viewed, which pages, time spent). Not a full VDR but excellent for initial investor outreach — share your pitch deck via DocSend to track investor engagement before formal DD. Cost: $65–250/month. Best for: seed and Series A pitch decks and preliminary investor materials sharing.

Corpfy Knowledge Hub with Permissions

Many India seed and pre-Series A startups use Corpfy Knowledge Hub as a VDR, creating a structured database with granular page-level permissions. Workable for small investor groups (1–3 investors) with limited DD scope. Limitations: no watermarking, limited audit trail, not suitable for sensitive financial or legal documents. Cost: ₹0–800/month. Best for: pre-seed and seed rounds with 1–2 angels where full VDR tooling is overkill.

Google Drive with Shared Drive Permissions

The most common DD solution for Indian startups raising seed rounds. Shared Drives allow view-only access, folder-level permissions, and basic activity logs. Not suitable for M&A or large-scale VC DD due to limited access control granularity and no watermarking. Cost: included in Corpfy Startup Tool Stack. Best for: seed rounds where speed and simplicity matter more than enterprise-grade security.

Frequently Asked Questions

How long does due diligence typically take for a Series A in India? +

India Series A due diligence typically runs 6–12 weeks from term sheet to close. Legal DD (reviewing corporate documents, contracts, and compliance) takes 3–5 weeks. Financial DD runs concurrently, taking 2–4 weeks. The longest delays are usually caused by missing documents that must be recreated, FEMA compliance gaps requiring RBI interaction, or slow response times from the company's CA or legal counsel. Companies that prepare their VDR in advance can compress this to 4–6 weeks. Government and regulatory approval requirements (e.g., for sectors with FDI caps) can add 4–8 additional weeks.

Do I need a lawyer to build a due diligence room? +

You do not need a lawyer to organise and upload documents to a VDR — a founder or CFO can do this. However, you should have a startup-focused lawyer review your legal documents (SHA, SSA, employment agreements, IP assignments) for obvious gaps before DD begins, and have a CA review your financials and GST/TDS compliance position. The cost of a pre-DD legal and financial review (typically ₹1–3L depending on complexity) is significantly less than the cost of discovering issues mid-DD, which often requires emergency legal remediation at 2–3× normal rates under time pressure.

What happens if due diligence reveals a compliance issue? +

Most compliance issues discovered during DD are remediable and do not kill deals outright. The typical process: investor's counsel flags the issue; company's counsel assesses the remediation path and timeline; investor and company agree on an escrow arrangement or a condition precedent to closing (e.g., "FEMA compounding application filed" or "POSH committee constituted within 30 days of closing"). Material issues — like significant undisclosed litigation, criminal proceedings against directors, or systematic revenue fraud — are more likely to result in deal termination or material valuation adjustment.

Should I share my full customer list with a potential investor? +

Yes, but in a controlled manner and after NDA execution. Investors need to verify customer revenue (cross-checking against GST returns and bank statements) and will request customer references for independent validation of churn, NPS, and product value. You can provide customer names and ARR values in a Tier 2 document without providing individual contact details initially. Contact details for reference calls are typically shared in Tier 3, with a request that the investor coordinate references through you rather than reaching out cold — this protects the customer relationship and gives you visibility into the reference process.

What is an RBI compounding application and when is it needed? +

An RBI compounding application is a formal process to voluntarily disclose and settle historical FEMA violations by paying a compounding fee (essentially a penalty) to the RBI. It is needed when a company has received foreign investment that was not reported correctly — missing FC-GPR filings, investment in a prohibited instrument, pricing below fair market value, or investment beyond sectoral FDI caps. The process involves filing an application with the RBI's FEMA compounding authority, which reviews the violation, assesses the compounding amount (typically a percentage of the violation amount), and issues a compounding order. Once compounded, the violation is settled and the company has a clean FEMA compliance record. The process takes 3–9 months depending on complexity and RBI workload.

Key Takeaways

Prepare your VDR before you start fundraising, not after you receive a term sheet.

Founders who spend 2–3 weeks assembling their VDR after a term sheet is signed lose momentum, signal disorganisation, and give investors time to reconsider. A VDR built before you start meetings closes rounds 3–5 weeks faster on average.

Reconcile your cap table to MCA filings before DD begins — every discrepancy will be found.

Investors independently verify your MCA21 filings. Any mismatch between your internal cap table and ROC records triggers a credibility crisis that is expensive and time-consuming to repair mid-process.

FEMA violations from prior rounds must be resolved before a new round can close.

Historical FEMA non-compliance (missing FC-GPR, incorrect pricing of foreign investment, wrong instrument structure) requires an RBI compounding application to resolve. This process takes 3–6 months — discover and fix these issues proactively, not mid-DD.

Proactive disclosure of known issues is always better than investor discovery.

Every company has warts. Disclosing them upfront — with a remediation plan — demonstrates founder integrity. Investors discovering issues themselves creates distrust, renegotiation leverage, and sometimes deal termination. There are almost no issues that cannot be disclosed and resolved; there are many issues that cannot be hidden.

M&A DD is 3× more intensive than VC DD — plan accordingly if an acquisition is a possible exit.

A strategic acquirer or PE firm will review every material contract for change-of-control provisions, every IP agreement for clean ownership, and every licence for transferability. Companies that clean up governance issues post-Series A — not just before exit — are worth materially more in M&A processes.

Inside Corpfy Due Diligence Room

Corpfy's Due Diligence Room organises 33 document types across 7 sections (Corporate, Financial, Legal, IP, HR, Technical, Commercial) with Series A and Series B specific checklists pre-loaded. Every document has a priority level, a status (Missing / Draft / Under Review / Ready / Shared), and investor access controls — so you can open a clean, organised data room in hours, not weeks.

What you get in the dashboard

Feature	What it does	Founder benefit
33-Document Checklist	Pre-loaded document types across 7 sections with Critical / High / Medium / Low priority and status tracking	Know exactly what is missing on any given day — no more scrambling the week a VC sends a diligence request
Series A & B Checklists	Stage-specific document checklists mapped to what institutional investors actually ask for at each round	Stop over-preparing for Series A with Series B documents — focus on what moves the process forward
Investor Access Management	Controls which documents have been shared with which investor, with pending request tracking	Never accidentally share a board-only document with a prospective investor
Document Status Workflow	Tracks each document from Missing → Draft → Under Review → Ready → Shared with colour coding	Legal, finance, and product can all see completion status without a weekly sync call
Days to Close KPI	Tracks average days remaining to close the diligence process based on outstanding items	Set realistic timeline expectations with investors — and pressure-test your readiness internally