With fewer fintech deals getting done, investors have more time to test each one. We asked industry leaders what fintech due diligence focuses on now. They say founders underprepare on proof that controls work and that lenders can recover loans.

Money is flowing back into fintech, but into fewer companies. KPMG’s Pulse of Fintech counted $103.1 billion of global fintech investment in the first half of 2026. That was up from $50.5 billion a year earlier. However, CB Insights recorded just 650 fintech deals in the third quarter, the fewest in more than four years. As a result, fintech due diligence has become slower and deeper, and founders face harder questions per cheque.

We asked fintech investors, angels and founders who had recently raised one question: what are investors scrutinising most closely in fintech due diligence right now that founders tend to underprepare for? We also asked for specific questions and data room requests. Three people answered, and we used two. Neither is an investor. One is a fundraising adviser and the other is a founder who has raised pre-Series A funding. So we checked their answers against the cases and rules driving investor behaviour.

Fintechbits analysis

Why fintech due diligence has deepened

First, the Synapse collapse changed the questions investors ask. The banking-as-a-service middleware firm filed for bankruptcy in April 2024. Its trustee estimated a gap of $65 million to $96 million between end users’ balances and the money partner banks held. In its complaint, the CFPB said Synapse failed to keep records of where consumers’ money sat that matched its partner banks’ records. Our banking-as-a-service explainer covers how that model works.

Partner bank risk is the second focus of fintech due diligence, because banks can walk away. In 2024, Lewis & Clark Bank ended its agreement with BaaS platform Solid, which filed for bankruptcy in April 2025. Meanwhile, UK rules now create a paper trail. Since 7 May 2026, payment and e-money firms must reconcile safeguarded funds daily under the FCA’s CASS 15 regime. They must also file a monthly return. Therefore, fintech due diligence now asks for evidence that already exists.

Proof that controls work, not polished policies

Our first respondent is managing partner of spectup, a Berlin-founded capital advisory firm that helps companies raise funding. He was earlier on the team at N26.

One area fintech founders tend to underprepare for is showing that their compliance and risk controls work in practice, rather than just presenting policies and regulatory documents.

Investors increasingly need to understand the operational reality behind the business. I would expect them to ask to see the full customer onboarding journey, including identity checks and failed applications. They will ask what share of transactions are flagged for review, rejected or escalated, and how quickly cases are resolved. They will want to know how concentrated revenue is across banking partners, payment providers and other critical infrastructure, and what happens to customers if one of those partners ends the relationship. They will also ask whether management can reconcile transaction volume, revenue and cash balances across reporting periods.

I would expect supporting evidence in the data room too, including compliance monitoring records, partner agreements, reconciliation reports, customer cohort data and unit economics.

A polished pitch can explain the opportunity. These documents show whether the business is ready to scale.

Niclas Schlopsna, Managing Partner, spectup

Niclas’s checklist reads like a fintech due diligence playbook built on Synapse and Solid. His reconciliation question goes to the heart of the CFPB’s complaint. His partner exit question matches what happened at Solid. In addition, the deposit side matters. As our guide to business deposits at fintechs explains, insurance depends on accurate records at the partner bank. Still, readers should note two points. First, spectup sells the investor-readiness work his answer describes. Second, it advises founders rather than investing its own money.

Can a lender recover its money?

Our second respondent co-founded CADRE ODR, a Bengaluru online arbitration and mediation platform whose clients include banks, non-bank lenders and fintechs.

Working with lenders on online dispute resolution has shown me that investors look beyond loan disbursals and collection figures. They want to know what happens when borrowers stop paying, and whether the lender can legally recover the money. Many founders have detailed financial reports but are less prepared to explain the legal process behind recovery.

Take the arbitration clause in a standard loan agreement. Many lenders relied on clauses that let them appoint the arbitrator themselves. In November 2024, a Constitution Bench of India’s Supreme Court held that clauses letting one party appoint a sole arbitrator on its own undermine equal treatment of the parties. Investors may now ask how many awards in a lender’s portfolio could face challenges because of these clauses.

Borrower consent is another area to watch under India’s Digital Personal Data Protection Act, whose consent and notice duties take effect in May 2027. Investors may ask for consent records and proof that proper notices were delivered, rather than just a privacy policy. I would keep these records ready in the data room, along with a review of loan agreement clauses and a note on dispute resolution.

Rajneesh Jaswal, Co-founder, CADRE ODR

Rajneesh’s legal point holds, and it has grown sharper. On 8 November 2024, a five-judge bench ruled 3:2 in the CORE case that one-sided appointment clauses breach equal treatment. Then, in January 2026, the Court went further in Bhadra International. Borrowers can now challenge an award from a unilaterally appointed arbitrator at any stage. So, in fintech due diligence on Indian lenders, collection figures can overstate how much a lender can recover. We updated his wording to reflect the ruling and the DPDP Rules timeline. Also, CADRE sells neutral arbitration to lenders, and its last disclosed round closed in April 2025.

What to watch next

Next, watch India’s data rules, which will shape fintech due diligence on lenders there. Consent manager provisions under the DPDP Rules start on 13 November 2026. The main consent and notice duties follow on 13 May 2027. In the UK, any investor taking 10% or more of an FCA-authorised firm needs approval first. The FCA has up to 60 working days to decide, which can shape when a round closes. In the US, partner banks remain answerable for their fintech partners under federal third-party risk guidance. So expect fintech due diligence to keep probing sponsor bank health. Meanwhile, CB Insights says 2026 fintech funding is on course for about $52 billion, down 14% on 2025.

Above all, fintech due diligence now rewards evidence over narrative. Founders who can show reconciliations that tie, a plan for losing a partner bank and loan terms that hold up in court will close faster.

FintechBits covers payments, banking and fintech developments for readers in the US and UK. This article is for information only and is not financial, legal or investment advice. Views expressed are those of the FintechBits editorial team.