CiteShift

1. One-liner

Finds every dead RBI circular quoted in your policy manuals and tells you which Direction paragraph replaced it.

2. Trend signal — why now?

On 31 July 2026 — five weeks ago — the Reserve Bank of India repealed 628 supervisory circulars in a single stroke and replaced them with 64 consolidated Master Directions administered by the Department of Supervision. The Directions cover 11 categories of regulated entity (commercial banks, small finance banks, payments banks, urban co-operative banks, rural co-operative banks, regional rural banks, local area banks, NBFCs, all-India financial institutions, credit information companies, asset reconstruction companies) across up to 9 functional areas each — compliance function, concurrent audit, cybersecurity and technology risk, digital payment security controls, fraud risk management, internal audit, statutory audit, supervisory returns, and miscellaneous supervisory directions.

Four details turn a tidy-up exercise into a business.

One: there was no transition window. Not a phase-in, not a glide path. The Directions came into force on issuance. Practitioners writing to the sector put it flatly: “No transition window, no phase-in.” An entity that walked into work on 1 August 2026 was already operating under a rulebook whose source documents had been withdrawn the previous evening.

Two: the consolidation is “as is,” which is precisely what makes it dangerous. RBI carried the underlying instructions forward without changing their substance. Nothing you must do changed. Only every reference to why you must do it. That inversion is the whole problem: because the obligations didn’t change, no compliance head triggers a substantive review — but every board-approved policy, audit checklist, internal-audit programme, risk register and board-reporting template in the building now cites a circular number that no longer exists. The guidance to the sector is explicit that entities must “update internal policy citations, audit checklists, and board-reporting templates to reference the new Master Direction numbers, not the old circular references.” A rule change gets a project plan. A renumbering gets forgotten until an inspector opens the manual.

Three — and this is the tell — RBI published the repeal list but not the crosswalk. The Bank’s own “Circulars to be Repealed/Withdrawn” page carries four columns: Sr. No., Circular Number, Subject, Date. It hyperlinks each dead circular so you can read what you no longer have to follow. What it does not contain, anywhere, is a mapping from the repealed circular to the Direction and paragraph that replaced it. The regulator issued the death certificates and withheld the forwarding addresses. Sector guidance confirms the gap, advising entities to independently examine the new Master Directions rather than rely on prior knowledge. Eleven thousand entities are each independently re-deriving the same 628-row lookup table by hand.

Four: the savings clause forces you to keep both rulebooks alive. RBI clarified that “actions already taken or initiated under the repealed directions will continue to be governed by those provisions.” So a fraud investigation opened in June 2026 is still governed by the 2016 circular that no longer exists; the identical investigation opened in August is governed by a Direction paragraph. Compliance teams cannot simply find-and-replace their way out. They have to know which citation governs which vintage of action — and hold both, correctly, at once.

The blast radius is not theoretical. Among the casualties: the 2016 Cyber Security Framework for Banks and the 2023 Master Direction on IT Governance, Risk, Controls and Assurance Practices — two documents that anchor the control libraries of essentially every regulated lender and every IS-audit firm serving them.

Population: ~9,100 NBFCs registered as of 31 March 2026, plus 1,457 urban co-operative banks, 351 district central co-operative banks, 34 state co-operative banks, and 11–12 small finance banks. Roughly eleven thousand entities, the overwhelming majority of which have a one- or two-person compliance function and no capacity to re-derive a 628-row crosswalk.

And this is a recurring programme, not a one-off event: RBI’s wider consolidation drive has already repealed 9,000+ circulars into 244 Master Directions across departments. The Department of Supervision tranche is one instalment. Whatever gets built for this round gets used again on the next.

Provenance:

• Signal 1 (demand): RBI repealed 628 supervisory circulars on 31 July 2026 and replaced them with 64 consolidated Master Directions across 11 entity categories and 9 functional areas, on an “as is” basis with no transition window; entities must update internal policy citations, audit checklists and board-reporting templates to the new Direction numbers — https://www.corplawupdates.in/updates/rbi-consolidated-supervisory-directions-628-circulars-64-master-directions-2026 — observed 2026-09-06
• Signal 2 (feasibility): RBI’s own “Circulars to be Repealed/Withdrawn” page publishes the repealed set as a four-column table (Sr. No., Circular Number, Subject, Date) with each circular hyperlinked to full text — and provides no mapping to replacement Directions or paragraphs, making the crosswalk a document-intelligence problem over two public corpora rather than a data-access problem — https://www.rbi.org.in/Scripts/BS_ViewCircularstobeRepealed.aspx — observed 2026-09-06
• Signal 3 (economic): ~9,100 NBFCs registered as of 31 March 2026 plus 1,457 urban co-operative banks and 351 DCCBs; NBFCs already spend 1.6–4.2% of operating costs on compliance, ~45% of it on human capital and advisory services — the exact line item a crosswalk tool displaces — https://www.eqomply.com/blogs/operating-costs-of-compliance-in-nbfc — observed 2026-09-06
• Signal 4 (corroboration): The repeal killed the 2016 Cyber Security Framework for Banks and the 2023 Master Direction on IT Governance, Risk, Controls and Assurance Practices, leaving existing control libraries pointing at repealed instruments and shifting the work “from compliance interpretation to structural alignment of existing controls against new paragraph references” — https://timusconsulting.com/rbi-2026-directions-sebi-cscrf-control-library/ — observed 2026-09-06
• Signal 5 (savings clause): RBI clarified that actions already taken or initiated under the repealed directions continue to be governed by those provisions, forcing entities to maintain both citation sets simultaneously — https://www.scconline.com/blog/post/2026/08/08/rbi-repeals-628-supervisory-circulars-after-consolidating-instructions-into-64-directions/ — observed 2026-09-06 Category: Regulatory arbitrage

3. The opportunity

The gap is narrow and specific: the regulator published what died without publishing what replaced it.

Indian RegTech is a crowded category, but look at what the incumbents actually sell. TeamLease RegTech, Lawrbit, Complinity and their peers sell compliance calendars — a database of obligations with due dates, owners and evidence upload. Their unit of value is the deadline. They answer “what is due on 15 October and who owns it.”

That is a completely different product from the one this event demands. Nobody’s deadline tracker knows what is written inside your Board-Approved Fraud Risk Management Policy. Your policy manuals are Word and PDF files sitting on a shared drive or a DMS, drafted over a decade by three generations of compliance officers and two outside law firms, each of whom quoted circular numbers inline. The calendar vendors never ingested those documents, because until 31 July 2026 there was no reason to. Their data model has no concept of “this paragraph of your internal policy cites this external instrument, and that instrument is now dead.”

The other half of the market is advisory — the ~45% of NBFC compliance spend that goes to human capital and advisory services. A Big Four or boutique firm will absolutely remap your policy suite. They will bill you for associates reading your manuals with the RBI website open in another tab, and they will re-derive the same 628-row lookup table they derived for the last client and will derive again for the next. That work is real, it is being paid for right now, and it is almost perfectly mechanical.

The 10× is straightforward. The crosswalk from 628 repealed circulars to 64 Directions is built once and amortised across every customer. Each entity’s marginal work is then just: read their documents, find the citations, apply the shared map, output a redline. A consultancy cannot price that way — their crosswalk lives in an associate’s head and gets rebuilt per engagement. A product builds it once, improves it every time a customer disputes a row, and sells the same asset eleven thousand times.

There is one more thing incumbents structurally will not do: tell you which of your citations should stay dead. Because of the savings clause, some references to repealed circulars are correct and must be preserved — the ones governing actions initiated before 31 July 2026. A find-and-replace tool would silently destroy those. The judgment call between “remap this” and “retain this with a vintage note” is the part a customer will not do themselves and cannot get from a script.

4. Target market

• Primary customer: The Compliance Officer / Company Secretary at a middle-layer or base-layer NBFC in India — ₹500 crore to ₹10,000 crore asset size, a compliance function of one to four people, typically in Mumbai, Delhi NCR, Chennai, Bengaluru or Ahmedabad. Secondary: urban co-operative banks (1,457 of them) and the internal-audit and IS-audit firms who service both.
• Why they buy: Their board-approved policy suite is 15–40 documents. Every one of them cites circulars that RBI withdrew five weeks ago. The RBI inspection team, the statutory auditor and the internal auditor will each open those documents. The compliance officer knows the citations are stale, has no list of which ones, and has no crosswalk to fix them with. This is a known, unbounded, personally-attributable exposure sitting on their desk right now.
• Rough TAM reasoning: ~9,100 registered NBFCs + 1,457 UCBs + 351 DCCBs + 34 StCBs + ~12 SFBs ≈ 11,000 entities. Realistically address the top ~3,000 that have a formal documented policy suite and a budget. At ₹40,000/year average that is a ₹12 crore ($1.4M) India-only base subscription market, before audit-firm seats and before the next consolidation tranche.
• Why now for them: The repeal was 31 July 2026. Statutory audit and internal audit cycles for FY27 are being planned now. The first RBI inspections to open these manuals post-repeal land over the next two to three quarters. The window where “we’re still updating our references” is an acceptable answer is closing.

5. Product sketch (MVP)

• Upload your policy suite — drop in the Word/PDF board-approved policies, audit checklists, internal-audit programmes and board-reporting templates.
• Dead-citation inventory — every reference to a repealed circular, located by document, page and paragraph, with the exact quoted text.
• The crosswalk — for each dead citation, the replacement Direction, the specific paragraph, and a plain-English note on what carried over “as is.”
• Savings-clause triage — flags citations that should be retained rather than replaced because they govern actions initiated before 31 July 2026, with the reasoning stated.
• Redlined output — the same documents back, with citations updated in-place and every change tracked, so the compliance officer reviews rather than retypes.
• Board note generator — a one-page memo explaining what changed and why, in the format a board or audit committee expects to approve.
• Coverage certificate — a dated, exportable record showing which documents were scanned, what was found, what was changed and what was deliberately retained. This is the artefact you hand the inspector.
• Watch mode — monitors RBI’s repeal page and flags when a future tranche kills a circular your live documents still cite.

6. AI angle — what’s load-bearing

Remove the AI and there is no product — only a consultancy.

Three jobs are genuinely model work. First, citation extraction from unstructured prose. Indian compliance manuals do not cite cleanly. The same instrument appears as “DoS.CO.PPG/SEC.13/11.01.005/2024-25”, as “the Master Direction on IT Governance dated 7 November 2023”, as “RBI’s cyber security framework circular”, and as “the extant RBI guidelines on fraud classification.” Regex catches the first form and misses the rest — and the rest are the majority in documents drafted by lawyers rather than data-entry clerks. Recognising an oblique reference to a repealed instrument from a descriptive phrase is exactly a language-model task.

Second, building and maintaining the crosswalk itself. RBI didn’t publish one. Constructing it means reading 628 repealed circulars against 64 Directions and matching obligations by substance — the Direction paragraph that carries a repealed circular forward “as is” is recognisable by what it says, not by any shared identifier. This is a one-time-ish bulk semantic matching job over two public corpora, run once, then human-reviewed and frozen as the core asset.

Third, the savings-clause judgment. Deciding whether a given citation governs an action initiated before 31 July 2026 — and should therefore survive — requires reading the surrounding policy language and reasoning about whether the clause is prospective or retrospective. That’s the call that makes the output trustworthy rather than destructive, and it’s the reason this can’t ship as a find-and-replace macro.

7. Localization angle

This is India-only by construction — it exists because a specific Indian regulator repealed a specific set of its own circulars. There is no global version.

But the shape travels, and that matters for the roadmap. Regulators consolidate rulebooks constantly and almost never publish crosswalks: RBI’s own broader drive has already collapsed 9,000+ circulars into 244 Master Directions, and SEBI, IRDAI and the RBI Department of Regulation all run comparable exercises. The same engine points at the next tranche with new source corpora and no new product.

Pricing must be rupee-native. A ₹3,000/month tier reaches a base-layer NBFC with a two-person compliance team; a $99/month tier from a US RegTech vendor does not, which is a large part of why nobody has come for this segment. Distribution is also local — ICSI chapters, NBFC industry associations and the practising-CS network, not Google Ads.

8. Business model — path to $1M–$5M ARR

• Pricing: Three tiers. Scan ₹25,000/year (up to 20 documents, one entity, annual re-scan). Standard ₹60,000/year (unlimited documents, redlines, board notes, watch mode). Firm ₹2,50,000/year for audit, CS and consulting firms managing 10+ client entities from one workspace.
• ACV: ₹45,000 ($510) blended for direct entities; ₹2,50,000 ($2,850) for firms.
• Rough math to $1M ARR: ~₹8.7 crore. Roughly 1,200 direct entities at ₹45,000 (₹5.4 crore) plus 130 firm accounts at ₹2,50,000 (₹3.25 crore). That is ~11% penetration of the addressable 11,000 entities — demanding but not fantastical for a mandatory-feeling compliance artefact.
• Rough math to $5M ARR: Requires going past this single tranche. Cover RBI Department of Regulation consolidations, SEBI and IRDAI equivalents, and sell the underlying capability — “which of your documents cite instruments that no longer exist” — as a standing subscription rather than a one-time remap. Add the internal-audit programme and control-library remap as a second SKU.
• Expansion path: Entity count (groups with an NBFC plus an HFC plus an ARC), document count, then the recurring watch subscription. The natural land-and-expand is scan → remap → monitor, with the monitoring tier the one that survives after the initial panic subsides.

Honest note on the revenue shape: the acute event is one-time. A customer who remaps in FY27 may not feel urgency in FY28. The watch-mode tier and the next consolidation tranche are what convert this from a project into a subscription, and that conversion is the single biggest commercial risk in the model. Price the first year for the remap; earn the second year on the monitoring.

9. Go-to-market wedge — first 100 customers

• The RBI list is the lead list, and it’s public. RBI publishes the register of NBFCs by category with addresses, and NBFC annual reports name the Compliance Officer and Company Secretary. Build the top 1,500 middle- and base-layer NBFCs with contact details. Ship each a free, personalised dead-citation scan of one public document — most NBFCs publish their Fair Practices Code, Fraud Risk Management Policy and Grievance Redressal Policy on their own websites, and those public documents are riddled with the exact citations that died. “We scanned your published Fair Practices Code. It cites four circulars RBI repealed on 31 July. Here’s the mapping to the new Direction paragraphs — free. Your internal manuals are worse.” That’s not a cold email, it’s evidence.
• Sell the crosswalk to the firms first. ~40–60 boutique CS practices, IS-audit firms and mid-tier CA firms service hundreds of NBFCs and UCBs between them. They currently bill this work by the hour and hate it. The Firm tier makes them faster on work they’ve already sold. One firm account brings a book of client entities and becomes the reseller.
• Publish the crosswalk itself as the marketing. Put the 628→64 mapping table online, free, indexed, permanently. It is the single most-searched thing in this niche right now, it does not exist anywhere including on rbi.org.in, and every compliance officer in the country will find it. The table is the lead magnet; the scan of your documents is the product. This deliberately inverts the usual trap — give away the reference data, charge for applying it to the customer’s own files.
• ICSI and industry associations. Practising Company Secretaries are the ones who actually redraft board-approved policies for smaller NBFCs. ICSI regional chapters run continuing-education sessions constantly and are hungry for topical content five weeks after a 628-circular repeal. A free session on “what the 31 July repeal did to your policy manuals” puts the product in front of exactly the people who do this work.
• Time it to the audit cycle. Statutory and internal audit planning for FY27 is happening now. Target the compliance officer in the four weeks before their audit committee meeting — the moment the exposure becomes personally attributable.

10. Build complexity — justification

Low. Both corpora are public and static: 628 repealed circulars (hyperlinked from RBI’s own page) and 64 Master Directions. The crosswalk is a bounded, one-time bulk job — build it, have a domain expert review it, freeze it as the asset. The per-customer product is then document ingestion, citation extraction from Word/PDF, lookup against a frozen table, redline generation, and a PDF export. All off-the-shelf. No integrations, no real-time data, no platform dependency, no user-generated network.

The genuine work is not engineering, it is verification: the crosswalk must be right, and getting it right requires a practising CS or ex-RBI-inspection domain expert to review the mapping rows before anything ships. Budget six to eight weeks for a technical founder plus a paid domain reviewer. The domain reviewer is not optional — a wrong crosswalk row that a customer puts in a board-approved policy is a serious problem, and it is the reason this is domain-expertise-required.

11. Gating checklist

Gate	Pass?	Note
Legal in target market	✅	Reads public RBI documents and the customer’s own files. No regulated activity, no licence needed. Positioned as a drafting aid, not legal advice — same footing as any compliance software.
Ethical — no harm / dark patterns	✅	Helps small entities meet obligations they already have. The savings-clause flag actively prevents the destructive change a naive tool would make.
Market exists (evidence above)	✅	628 circulars repealed with no crosswalk; ~11,000 affected entities; sector guidance explicitly instructing entities to update citations; 45% of NBFC compliance spend already going to advisory.
1–5 person team can build this	✅	One technical founder plus a paid domain reviewer. Six to eight weeks.
Launchable with <$50K / ₹40L	✅	Realistically ₹5–8 lakh: domain reviewer fees, inference costs for the bulk crosswalk build, hosting.

All five pass.

12. Feasibility score

Axis	Weight	Score	Notes
Problem intensity	20	15/20	Real, dated, personally attributable to a named officer, and currently unsolved. Held back from higher: nothing substantive changed, so it’s an inspection-and-audit risk rather than a daily bleed. Some entities will rationally defer until an auditor actually flags it.
Demand evidence	15	11/15	Strong structural evidence — the repeal, the missing crosswalk, the entity counts, the advisory spend, sector guidance telling entities to remap. Docked for what I could not find: no forum threads or verbatim compliance-officer complaints surfaced in research. The demand is inferred from the regulatory fact, not heard from customers. That gap is the first thing to close.
Build feasibility	15	13/15	Public static corpora, no integrations, off-the-shelf document intelligence. The constraint is expert review time, not engineering.
Distribution clarity	15	12/15	Named, enumerable list; public documents make the outreach evidence-based rather than speculative; firms as a channel; ICSI chapters as a venue. Docked because Indian compliance officers are notoriously slow email responders and the firm channel needs relationship work.
Revenue mechanics	15	11/15	Pricing is rupee-native and beneath the advisory alternative, so the value case is easy. Docked hard for the one-time-event shape — year-two retention genuinely depends on watch mode and the next tranche landing.
Time to first revenue	10	8/10	The free-scan-of-your-public-document wedge should convert inside weeks of launch. Realistically 6–10 weeks to first paying customer.
Defensibility	10	3/10	The crosswalk is the asset, and once published as marketing it is copyable. What’s left is accuracy, the corrections that accumulate from customer disputes, and being first while the event is hot. Execution moat only.
Total	100	73/100

13. Qualitative modifiers

Founder-fit tags

technical-heavy · domain-expertise-required

The build is modest; the credibility is not. Shipping a crosswalk that a Compliance Officer will paste into a board-approved policy requires either a founder from the Indian banking-compliance world or a paid practising CS reviewing every mapping row before release. Without that, this fails on trust regardless of engineering quality.

Key assumptions to validate (3–5)

1. Assumption: NBFC policy manuals actually contain dense inline citations to the repealed circulars — enough that a scan produces an alarming finding rather than two trivial hits. How to test: Download 30 published Fair Practices Codes, Fraud Risk Management Policies and Grievance Redressal Policies from NBFC websites and count references to circulars on the repeal list. This costs a day and is the single most decisive test — if the average document has fewer than three dead citations, the alarm doesn’t land and the idea is much weaker.
2. Assumption: Compliance officers see stale citations as a real inspection risk rather than a cosmetic one. How to test: 20 structured calls with NBFC/UCB compliance officers and two ex-RBI inspecting officers. Ask directly: has an inspection ever flagged a stale citation, and would you pay to fix it before FY27 audits?
3. Assumption: A defensible 628→64 crosswalk can actually be built to acceptable accuracy. How to test: Build it for one functional area only — say fraud risk management — and have a practising CS grade every row. If accuracy is below ~90% before human correction, the economics of expert review get much worse.
4. Assumption: Audit and CS firms will buy a multi-entity seat rather than treat this as billable hours they’d rather keep. How to test: Pitch the Firm tier to 10 boutique practices. Watch whether they frame it as margin expansion or as revenue cannibalisation — the answer decides whether the firm channel is real.
5. Assumption: Year-two retention exists. How to test: Ask the first 20 customers directly what they’d pay for watch mode alone, priced separately, before building it.

Risk flags

1. Event-decay risk. This is the dominant risk. The acute panic has a shelf life of maybe three to five quarters. If the product doesn’t convert into a monitoring subscription or ride the next consolidation tranche, ARR peaks and decays. Everything about the roadmap should be aimed at this.
2. Regulator-obsolescence risk. RBI could publish an official crosswalk at any time and vaporise the core asset overnight. Mitigation is to be positioned as “we apply the map to your documents” rather than “we own the map” — which is also exactly why publishing the table free as marketing is the right call rather than a concession.
3. Accuracy and liability risk. A wrong mapping row that lands in a board-approved policy is a real problem for the customer and a reputational kill for a one-person vendor. Requires expert review, conservative flagging of low-confidence rows, and explicit “review before adoption” framing throughout the output.
4. Demand-evidence risk. The demand here is inferred from regulatory structure, not observed from customer complaints. I could not surface a single compliance officer saying this out loud. That’s why confidence is Medium and why assumption 1 comes before any code.
5. Fast-follow risk. An incumbent like TeamLease RegTech or Lawrbit could bolt this onto an existing distribution base. They’re slow and their data model doesn’t include customer documents today, but they have the customer list.

14. Structured verdict

Score:                  73/100
Verdict:                GO
Confidence:             Medium
Best-fit builder:       Technical founder paired with a practising Company Secretary
                        or ex-RBI supervision domain reviewer
Time to revenue:        6–10 weeks
Capital to launch:      ₹5–8 lakh ($6–9K)
Top 3 assumptions to validate first:
  1. NBFC policy manuals contain dense citations to repealed circulars — count
     references across 30 published policy documents before writing any code
  2. Compliance officers treat stale citations as inspection risk — 20 calls with
     compliance officers plus 2 ex-RBI inspecting officers
  3. The 628→64 crosswalk is buildable to >90% pre-review accuracy — pilot one
     functional area and have a practising CS grade every row
Kill criteria:
  - Abandon if the average published NBFC policy document contains fewer than 3
    citations to repealed circulars
  - Abandon if fewer than 5 of 20 compliance officers say they would pay ₹25,000+
    to remediate before their FY27 audit
  - Abandon if crosswalk accuracy on the pilot functional area is below 80% before
    human correction — expert review costs then exceed the price point
  - Abandon if RBI publishes an official circular-to-Direction crosswalk before launch

15. Next step — 1-week validation sprint

• Day 1–2: Scrape RBI’s repeal page for all 628 circular numbers, subjects and dates. Separately download 30 published policy documents from NBFC and UCB websites — Fair Practices Codes, Fraud Risk Management Policies, Grievance Redressal Policies, IT/cyber policies. Count citations to repealed circulars per document. This is the falsifiable core: mean dead-citations-per-document must be ≥3.
• Day 3–4: Hand-build the crosswalk for one functional area only — fraud risk management. Have a practising CS grade every row for correctness. Record pre-review accuracy.
• Day 5: Send the free personalised scan to 20 NBFC compliance officers whose published documents you already scanned on Day 1–2. Real finding, their real document, no product required. Measure reply rate and how many ask “can you do this for our internal manuals?”
• Decide go / no-go on: mean dead-citations-per-document ≥3, crosswalk pre-review accuracy ≥80% on the pilot area, and ≥4 of 20 scanned entities asking for the internal-manual version unprompted.

All three are countable within the week. If the citation density isn’t there, the alarm doesn’t land, and no amount of good engineering saves it — kill it on Day 2 rather than Day 5.