Financial Due Diligence for Startup Investment: A CFE’s Checklist

Financial due diligence (FDD) for startup investment is the systematic examination of a target company's financial health, compliance status, and risk profile before an investor commits capital. Standard FDD — typically performed by audit firms — verifies that financial statements are prepared correctly. Forensic FDD goes deeper: it investigates whether the reported numbers reflect economic reality. For startups, this distinction is critical because: (1) Startups often lack audited financials for all periods or have qualified audit reports. (2) Revenue may include related party transactions, channel stuffing, or advance billing that inflates the top line. (3) Promoter expenses frequently flow through the company — personal rent, family salaries, lifestyle costs buried in operating expenses. (4) FEMA compliance gaps are endemic — share allotments to foreign investors without FC-GPR filing, ESOP grants to NRIs without RBI approval, pricing violations on convertible instruments. (5) Tax compliance is often deferred — GST returns filed but tax not fully paid, TDS defaults accumulating, transfer pricing documentation missing for cross-border transactions. A Certified Fraud Examiner (CFE) brings investigation methodology — not just verification — to the due diligence process. The CFE's training in fraud detection, red flag identification, and evidence-based analysis uncovers risks that standard audit-trained DD teams miss.

From our forensic DD practice, the 10 most common red flags in Indian startup financials: (1) Revenue concentration — top 2-3 customers contributing 60%+ of revenue, especially if any are related parties. (2) Revenue-cash flow disconnect — growing revenue but declining operating cash flow, suggesting aggressive revenue recognition or collection issues. (3) Undisclosed related party transactions — companies sharing addresses, common directors, or circular fund flows with the target. (4) Personal expenses in the P&L — promoter rent, family member salaries without job descriptions, personal vehicle expenses, lifestyle costs classified as business entertainment. (5) FEMA non-compliance — share allotments to foreign investors without regulatory filings, convertible instruments without RBI approval, ESOP exercises by NRIs without FEMA clearance. (6) Cap table inconsistencies — shareholder register not matching MCA filings, unrecorded option grants, side letters with liquidation preferences not reflected in articles. (7) GST demand exposure — pending Section 73/74 demands, ITC claimed on ineligible items, GSTR-1 vs GSTR-3B mismatches. (8) IP ownership gaps — code written by contractors without proper IP assignment, domain names in personal names, trademark applications not filed. (9) Employee misclassification — full-time workers treated as consultants to avoid PF/ESI, creating retroactive liability. (10) Deferred statutory payments — TDS deducted but not deposited, PF/ESI contributions delayed, advance tax shortfall.

Our CFE-led due diligence checklist covers 8 domains: (1) Revenue quality — source analysis, customer concentration, related party revenue, recognition policy, and collectibility. (2) Expense integrity — personal expenses, fictitious vendors, unusual consultant payments, and cost normalization. (3) Related party transactions — complete mapping of promoter entities, common directorships, fund flows, and undisclosed relationships. (4) Working capital reality — receivable aging verification, inventory valuation, payable stretching, and cash conversion cycle analysis. (5) Regulatory compliance — FEMA (FC-GPR, FC-TRS, ESOP approvals), GST (return filing, ITC eligibility, demand exposure), Income Tax (TDS compliance, advance tax, pending assessments), and Companies Act (ROC filings, board compliance). (6) Cap table and corporate governance — shareholder register reconciliation, ESOP pool documentation, convertible instrument terms, board minutes review, and statutory register verification. (7) Tax compliance and contingent liabilities — pending tax demands, show cause notices, appeal status, transfer pricing documentation, and DTAA exposure for cross-border structures. (8) Valuation cross-check — independent verification of the proposed valuation using DCF, comparable transactions, and Rule 11UA methodology, identifying whether the investment valuation is supportable.

FEMA compliance is the single most overlooked area in startup DD — and potentially the most expensive to remediate post-investment. Common FEMA issues we discover: (1) FC-GPR not filed for previous funding rounds — every share allotment to a non-resident must be reported to RBI within 30 days. Late filing requires compounding (penalty of 5% p.a. of the amount involved). (2) Convertible instruments (CCPS, CCD, iSAFE) issued without proper pricing — FEMA requires fair market value determination by a CA or SEBI Merchant Banker. Instruments issued below FEMA floor price are contraventions. (3) ESOP exercises by NRI employees without FEMA approval — if the company granted ESOPs to employees who are now NRIs, the exercise requires compliance with FEMA pricing and reporting norms. (4) Downstream investment structure not compliant — if the Indian company has itself invested in another Indian entity using foreign-origin funds, the downstream investment reporting may be missing. (5) LRS remittances by founders for overseas subsidiary formation without proper documentation. For PE/VC investors: FEMA non-compliance in prior rounds creates contingent liability that YOU inherit. The compounding penalty can run into lakhs — and in severe cases, ED adjudication can impose penalties up to 3x the contravention amount. Always verify FEMA compliance before investing.

Revenue quality analysis examines whether reported revenue represents genuine, sustainable, arm's length business activity — or whether it is artificially inflated through related party transactions, aggressive recognition policies, or one-time items. For startups, revenue quality is the single most important DD finding because: (a) Valuation is typically a multiple of revenue (ARR for SaaS, GMV for marketplaces). Inflated revenue directly inflates the valuation the investor pays. (b) Startup revenue may include: pilot/trial revenue that will not convert to recurring contracts, related party revenue (group companies purchasing the product), channel partner advances recognized as revenue, and multi-year contracts recognized upfront. Our analysis: customer-level revenue breakup, related party screening (MCA director search, address matching, fund flow analysis), contract review (term, renewal, auto-renewal provisions), and cash realization verification (revenue recognized vs actual cash received within 90 days). If 20% of claimed ARR turns out to be related party or non-recurring: on a 10x ARR valuation, the investor is overpaying by 20% — for a ₹100 crore round, that is ₹20 crore of overpayment.

The investor's term sheet proposes a valuation — typically based on the startup's pitch deck metrics and market benchmarks. Our valuation cross-check independently verifies whether the proposed valuation is supportable: (1) DCF cross-check: we build an independent DCF using verified revenue figures (after revenue quality adjustment), realistic growth assumptions (industry benchmarks, not promoter projections), and appropriate discount rates (including India risk premium and startup-specific risk factors from our valuation engine). (2) Comparable transaction analysis: we compile recent funding rounds in the same sector, stage, and geography — verifying the multiples against actual verified metrics (not reported metrics). (3) Rule 11UA compliance: for investments by Indian residents, we verify the valuation complies with Rule 11UA methodology — DCF or NAV. Post-abolition of angel tax (Section 56(2)(viib) abolished July 2024), there is no income tax ceiling on premium for primary issuances. However, Rule 11UA still governs secondary transfers under Section 56(2)(x) and Section 50CA. (4) FEMA floor price: for investments by non-residents, we verify the valuation meets or exceeds the FEMA floor price determined by a CA or SEBI Merchant Banker. If the proposed investment price is below FEMA floor: the transaction cannot proceed without a pricing violation.

Our regulatory compliance module covers 5 regimes: (1) FEMA — FC-GPR/FC-TRS filings for all rounds, ESOP compliance for NRI holders, convertible instrument pricing, downstream investment reporting, and LRS documentation. (2) Income Tax — TDS deposit verification (Form 26AS/AIS reconciliation), advance tax computation adequacy, pending assessment/reassessment orders, transfer pricing documentation for cross-border transactions, and Section 56(2)(x)/50CA exposure on secondary transfers. (3) GST — GSTR-1 vs GSTR-3B reconciliation, ITC eligibility verification, pending SCN/demand orders, e-way bill compliance for goods companies, and Rule 42/43 reversal computation for companies with exempt supplies. (4) Companies Act — ROC filing status (AOC-4, MGT-7), board meeting compliance, related party transaction approvals under Section 188, ESOP compliance under Section 62(1)(b), and statutory register maintenance. (5) Labour laws — PF/ESI registration and deposit status, employee vs contractor classification, gratuity provisioning, and POSH (Prevention of Sexual Harassment) compliance. Each finding is classified: GREEN (compliant), AMBER (minor gap, remediable before closing), or RED (material non-compliance, affects deal terms).

Standard forensic FDD: 2-4 weeks from data room access to final report. Timeline depends on: company's readiness (organized data room vs scattered records), number of funding rounds to verify, complexity of corporate structure (subsidiaries, overseas entities), and regulatory regime overlap (FEMA + TP + GST). Expedited DD (for time-sensitive rounds): 10-15 business days with a focused scope — covering revenue quality, FEMA compliance, and cap table verification. This covers the highest-impact areas while flagging deeper issues for post-closing review. Comprehensive DD (for PE growth rounds or Series B+): 4-6 weeks covering all 8 domains with full forensic depth including vendor verification, employee audit, and regulatory compliance across all regimes. We recommend starting DD as early as possible in the deal timeline — waiting until the term sheet is signed creates time pressure that limits the depth of investigation.

Investor DD (buy-side): conducted by or for the investor to identify risks before committing capital. Focus: what can go wrong, what is hidden, what is overstated. The investor wants to know the worst-case scenario. Promoter-side DD (sell-side / vendor DD): conducted by or for the company/promoter before approaching investors. Focus: what needs to be fixed before the investor's DD team arrives. The promoter wants to identify and remediate issues proactively. Sell-side DD is increasingly common because: (a) it identifies and fixes compliance gaps before investor scrutiny (FEMA filings, TDS deposits, ROC annual returns), (b) it reduces the negotiation leverage that investors gain from discovering issues, and (c) it accelerates the investor's DD process — a pre-completed DD report can reduce the investor's timeline by 50%. We provide both: for investors, we investigate. For promoters, we prepare.

Seed/Angel stage (basic compliance + cap table + FEMA check): ₹1,50,000-₹3,00,000. Series A (standard forensic FDD — 8 domains): ₹3,00,000-₹8,00,000. Series B+ / PE growth (comprehensive with full forensic depth): ₹5,00,000-₹15,00,000. Sell-side DD (promoter preparation): ₹2,00,000-₹6,00,000. Expedited DD (10-15 days, focused scope): ₹2,50,000-₹5,00,000. For context: on a ₹50 crore investment, ₹5 lakh DD cost is 0.1% of the investment amount. In Case Study 2 from our forensic accounting page, ₹8 lakh DD cost identified issues that led to a 30% valuation reduction — saving ₹13.5 crore. The DD cost is always a rounding error compared to the risks it identifies.