Due diligence is not a test you cram for – it is an audit of how you have run the company since day one. When an Indian institutional investor issues a term sheet, three workstreams open in parallel – financial, legal-secretarial, and business – and over 3–6 weeks they rebuild your claims from primary documents. This is the complete checklist of what gets opened, the findings that actually delay or kill closings, and the founder playbook for a data room that shortens diligence instead of feeding it.
The financial workstream
| They open | They test | Common finding |
|---|---|---|
| Books of account, GST returns, 26AS/AIS | Does reported revenue reconcile to GST filings and bank credits? | Revenue recognised on invoicing that GST returns do not corroborate |
| MIS vs audited financials | Do the deck’s metrics tie to the ledger? | “Revenue” including GST, one-time setup fees, or GMV |
| Cohort and CAC data | Raw exports, not screenshots | Retention computed on revenue not logos (or vice versa) without disclosure |
| Payroll, PF/ESI/PT/TDS challans | Statutory dues paid and on time | TDS deducted but deposited late; contractor misclassification |
| Related-party ledger | Founder loans, family vendors, cross-charges | Undocumented founder advances sitting in loans & advances |
| Bank statements (full period) | Cash discipline; round-tripping | Personal expenses through the company account |
The legal-secretarial workstream (your CA/CS’s home turf)
Every past capital event gets re-opened: incorporation papers, each allotment’s board and shareholders’ resolutions, valuation reports, PAS-4 offers, PAS-3 filings, share certificates and stamp duty, statutory registers, and the ESOP scheme with every grant letter. The two findings that most often become conditions precedent in Indian closings: a missed FC-GPR from an earlier foreign cheque (curable via late-submission fee – size it on the LSF calculator – but it must be cured before closing), and ESOP grants made without a properly adopted scheme (curable by ratification, expensively mid-process). The 2025-26 addition to the list: Rule 9B dematerialisation – private companies other than small companies had to demat by 30 June 2025, and a non-compliant company cannot validly allot new securities, which makes demat status a day-one diligence question for the round itself. Contracts get read too: customer agreements (assignment and termination clauses), vendor and IP assignments (especially from founders and ex-freelancers – unassigned pre-incorporation IP is a classic), employment agreements, and any past SHA whose rights survive.
The business workstream
Reference calls with customers (they will ask for 5–10, and call 2–3 off-list), founder background and education verification, competitor and market triangulation, and product/tech review – codebase ownership, licences of open-source components, security posture, and DPDP-readiness for consumer data businesses. Nothing here is document-driven, which is why it cannot be fixed in the data room: it is fixed by not overstating things in the deck (see the pitch deck guide on claims that survive contact).
The data-room structure that shortens diligence
Build it before the term sheet, in this order: 1. Corporate (COI, MoA/AoA, registers, all resolutions chronologically, DPIIT certificate); 2. Capital (cap table reconciled to PAS-3s, every valuation report, share certificates, ESOP scheme + grants, FEMA filings per foreign investor); 3. Financial (audited statements, provisional MIS, GST/TDS/PF challans, bank statements); 4. Contracts (top-20 customer, vendor, IP assignments, employment); 5. Compliance (licences, DPDP documentation, litigation – even nil confirmations); 6. Metrics (raw cohort exports, CAC workings). Two disciplines: a single index file the investor’s associate can navigate without calls, and version control – nothing kills confidence like two versions of the cap table in one data room. Our cap-table hygiene rules are in the cap table guide.
Founder-side diligence (yes, on the investor)
Run your own checklist: fund vintage and dry powder (a year-8 fund cannot follow on), reserves policy, references from two portfolio founders including one whose company failed, decision timeline in writing, and – for foreign funds – whether their LP base triggers Press Note 3 screening that will slow your closing. The seed guide covers picking the lead; the term-sheet decoder covers what they will send you next.
Want diligence to be boring?
My Cloud Accountant runs a pre-diligence audit – secretarial clean-up, FEMA regularisation, data-room build – so the investor’s team finds a company that is exactly what the deck said.
Talk to an expertFrequently Asked Questions
How long does diligence take for an Indian seed or Series A round?
Seed: 2–4 weeks. Series A: 4–8 weeks with external counsel and audit firms involved. A prepared data room compresses each by a third; a messy capital history extends them indefinitely – the clock restarts with every cure item.
Who pays for diligence?
Each side bears its own costs by default; investors’ legal/financial DD costs are often recovered from the company at closing as a negotiated, capped deal expense (typically ₹5–15 lakh at Series A). Cap it in the term sheet.
Can a round die in diligence even after a signed term sheet?
Yes – term sheets are non-binding on the investment itself. The killers are misrepresented metrics, uncurable capital-history defects, and founder-reference failures. Curable findings (late filings, missing registers) become conditions precedent, not deal-breakers – if disclosed and priced early.
What should a bootstrapped company maintain even before raising?
The five that are painful to rebuild: statutory registers updated in real time, every allotment’s full paper trail filed on time, an adopted ESOP scheme before the first grant, IP assignments signed at onboarding, and monthly reconciliation of books to GST returns. Everything else can be assembled later; these five cannot be backdated honestly.
Last reviewed: August 2026. Companies Act 2013 (ss.42, 56, 88, 117), PAS Rules (incl. Rule 9B demat mandate, deadline expired 30 June 2025), FEM (NDI) Rules reporting, DPDP Act 2023 + Rules 2025.