Finch Innovate Launches FinchSCAN: DPDP Vendor Risk and AML TCO for Fintech CFOs

What happened

Finch Innovate recently announced the global launch of FinchSCAN, a digital onboarding and Anti-Money Laundering screening SaaS platform, according to Elets BFSI. The company states that the platform is designed to support global privacy regulations. This explicitly includes India's Digital Personal Data Protection Act, 2023, alongside the European Union framework and Gulf market requirements.

Does the DPDP Act apply here?

The DPDP Act clearly governs this scenario under Section 3. It applies to digital personal data processed within the territory of India, and processing outside India if connected to offering goods or services to Data Principals in India. Fintechs using third-party SaaS platforms for AML screening transfer significant volumes of customer identity data to these vendors. Even if the vendor hosts its infrastructure offshore, processing this data for onboarding Data Principals in India brings the activity squarely under the Act.

Legal implications under DPDP

Under Section 4 of the Act, consent is the primary basis for processing, except where Section 7 legitimate uses apply. Processing data to fulfill state-mandated obligations, such as RBI digital lending guidelines for AML, typically qualifies as a legitimate use. However, relying on a SaaS provider makes them a Data Processor, which heavily impacts your enterprise risk profile. Under the DPDP Act, the Data Fiduciary remains entirely liable for vendor failures.

The Rules, 2025 require Data Fiduciaries to ensure reasonable security safeguards are maintained across the data lifecycle. If a processor suffers a breach, the fiduciary must notify affected Data Principals without delay and submit a detailed report to the Data Protection Board of India within 72 hours. Cross-border transfers to offshore SaaS servers are permitted unless the Central Government restricts a specific country via a notified negative list, but this still requires ironclad data processing agreements to protect your balance sheet.

Could this happen to you

Integrating an external AML API without configuring automated retention and data minimization creates massive contingent liability. Rapid product cycles in fintech often outpace legal review, leaving finance and compliance teams blind to how much identity data flows through account-aggregator APIs to unvetted third parties. The DPBI will not penalize the vendor for a breach; they will penalize the Data Fiduciary.

For a CFO, an unmanaged SaaS processor directly inflates your cyber insurance premiums and audit fees. If a vendor experiences a breach and you cannot produce a compliant data processing agreement and verified deletion logs within the 72-hour window mandated by the Rules, 2025, you face penalty ceilings of up to 250 crore INR. This level of exposure severely damages EBITDA and poses a direct threat to enterprise deal closures.

What companies should do in the next 30 days

1. The CFO and Head of Compliance must audit all existing digital onboarding and AML vendor contracts to ensure they include mandatory DPDP security safeguards and strict 72-hour breach reporting clauses.

2. Finance teams should model the Total Cost of Ownership of vendor consolidation. Evaluate if fragmented onboarding APIs can be replaced by unified, DPDP-aligned platforms to reduce audit fees and centralize third-party risk management.

3. Product leads must map the data lifecycle of all onboarding flows to ensure identity data is permanently erased by processors once the RBI-mandated retention period expires, fulfilling purpose limitation requirements.

What to watch

Exactly 273 days remain until the DPDP hard compliance deadline of 13 May 2027. Fintechs must finalize their processor agreements and provision appropriate compliance budgets well before this date. Expect the DPBI to heavily scrutinize third-party data sharing in the financial sector, especially where volume designates a company as a Significant Data Fiduciary. Check your vendor exposure and audit readiness with a self-assessment at freescan.complydp.com to prevent unexpected compliance costs.