Y Combinator’s Request for Startups is a product and market signal, not a substitute for legal or accounting advice. For an Indian startup applying in 2026—or reviewing an older Spring 2025 theme—the practical question is simple: can you clearly explain who owns the company, who owns the product, how money moves, and which risks remain unresolved?
YC applications are primarily judged on founders, insight, product, traction, and speed. Compliance will not rescue a weak application. But missing records, unclear ownership, unpaid statutory dues, or an undocumented investment can slow diligence and create avoidable risk after acceptance.
What YC applicants should be ready to explain
Prepare a concise, accurate company file covering:
- Entity and ownership: incorporation documents, cap table, founder shareholding, option promises, and any shareholder agreements.
- Financial position: bank statements, bookkeeping, revenue records, expenses, liabilities, grants, loans, and investor funds.
- Intellectual property: founder and employee invention assignments, contractor agreements, open-source usage, domains, trademarks, and model or dataset licences.
- Operations: customer contracts, vendor terms, privacy notices, information-security practices, and material disputes.
- Fundraising history: SAFE-like instruments, convertible notes, equity issuances, grants, related-party transactions, and regulatory filings.
Do not manufacture a polished compliance story. Mark each item as complete, pending, not applicable, or needing professional review. Accurate disclosure is more useful than a checklist that hides uncertainty.
India compliance areas to review
Incorporation and corporate records
Confirm that the company’s legal name, registered office, directors, authorised signatories, and statutory registers are current. Keep certificates, board and shareholder resolutions, annual filings, and share allotment records in one controlled folder.
If founders began as individuals or a partnership and later incorporated, document the transfer of assets, contracts, code, customer relationships, and IP into the company. A common diligence problem is a startup whose pitch deck names one entity while invoices, bank accounts, or software licences belong to another.
Tax, GST, and payroll
Reconcile books with bank transactions, invoices, tax returns, and the pitch deck. Review income-tax filings, advance tax, tax deducted at source, GST registration and returns where applicable, and payroll obligations. GST treatment depends on the business model, turnover, location, and type of supply; do not assume that a software or AI product is automatically exempt.
Maintain a schedule of tax registrations, filing dates, payments, notices, and reconciliations. If the startup has no revenue, record that clearly rather than leaving unexplained gaps. For a practical overview of recurring finance and filing work, use this guide to Indian CA compliance.
Foreign investment and cross-border issues
YC or another overseas investor can create FEMA, reporting, valuation, and banking questions. Review whether the company is permitted to receive the proposed investment, whether the instrument and pricing comply with applicable rules, and whether required filings have been completed through the authorised dealer bank and relevant government portals.
Also check cross-border payments for cloud infrastructure, software, contractors, advertising, and customers. Preserve invoices, agreements, withholding-tax analysis, remittance records, and certificates where relevant. Ask a qualified professional to review the exact structure before signing documents.
Intellectual property and open source
For an AI startup, IP diligence extends beyond the brand and source code. Create an asset register covering:
- Source code, prompts, model weights, fine-tuning methods, evaluation datasets, and documentation.
- Founder, employee, advisor, and contractor contributions.
- Third-party APIs, pretrained models, datasets, and open-source components.
- Licences, attribution duties, usage restrictions, and commercialisation rights.
Every person who contributed material work should have a signed agreement addressing confidentiality and IP assignment. If a founder built the prototype before incorporation, execute a written assignment to the company. For legal workflow support, founders may also review this AI copilot guide for Indian lawyers and startups.
Data protection and AI governance
If the product handles personal data, map what is collected, why it is collected, where it is stored, who can access it, and how long it is retained. Review consent or other lawful processing grounds, user notices, deletion and correction processes, vendor contracts, breach response, and cross-border data flows.
India’s Digital Personal Data Protection framework and sector-specific requirements should be assessed alongside contractual commitments. A startup selling to enterprises may face stricter security, audit, residency, and incident-reporting requirements than its current size suggests.
For AI products, document training-data provenance, evaluation methods, human review, known failure modes, safety controls, and customer restrictions. Avoid claiming that a model is proprietary if it relies on third-party services or permissively licensed components with conditions. Compliance automation can reduce repetitive work, but founders should first understand the process; see how to automate legal compliance with AI in India.
Build a diligence-ready data room
A lightweight data room is valuable before an interview, not only after a term sheet. Use clear file names, version control, and access permissions. A sensible structure is:
1. Corporate: incorporation, constitutional documents, registers, resolutions, and cap table.
2. Finance and tax: financial statements, bank records, returns, invoices, payroll, grants, and liabilities.
3. Commercial: customer contracts, pricing, revenue metrics, pilots, and material vendor agreements.
4. IP and product: assignments, licences, repositories, architecture, model documentation, and security materials.
5. People: employment, contractor, advisor, confidentiality, and equity documents.
6. Legal and risk: disputes, notices, insurance, privacy documents, security incidents, and compliance calendar.
Restrict access to sensitive data and redact personal information where possible. Keep a one-page issues register stating the issue, owner, deadline, financial exposure, and proposed fix.
A 30-day readiness plan
Days 1–7: establish the facts. Reconcile the cap table, list all entities and bank accounts, identify missing contracts, and compare the application narrative with accounting records.
Days 8–14: fix ownership and finance gaps. Execute IP assignments, collect contractor agreements, update corporate records, reconcile tax filings, and document grants, loans, and investments.
Days 15–21: review product risk. Map personal data, third-party services, open-source licences, security controls, customer commitments, and AI limitations.
Days 22–30: package and test. Build the data room, prepare a concise risk memo, assign owners for unresolved matters, and ask an independent CA or lawyer to review material issues.
What not to do
- Do not backdate agreements or create inaccurate board records.
- Do not overstate revenue, users, regulatory approvals, or IP ownership.
- Do not treat a template privacy policy as evidence of compliance.
- Do not issue equity or accept foreign funds without checking the legal and tax consequences.
- Do not hide a founder dispute, tax notice, security incident, or failed pilot if it materially affects the business.
The objective is not perfect paperwork. It is a company whose story, records, money flows, and product claims are consistent—and whose remaining risks are visible and actively managed.