India’s defence sector regulatory framework comprises central legislation and executive instruments issued by the Government of India (GoI). These are broadly classified as follows:

• manufacturing and licensing ‒ the Industries (Development and Regulation) Act 1951 (IDRA), the Arms Act 1959 (the “Arms Act”) and the Arms Rules 2016 (the “Arms Rules”);
• government procurement ‒ the Defence Acquisition Procedure 2020 (the “DAP 2020”) and the Defence Procurement Manual 2025 (the “DPM 2025”), resting on the General Financial Rules 2017 (GFRs);
• trade controls ‒ the Foreign Trade (Development and Regulation) Act 1992 (the “FTDR Act”), the Foreign Trade Policy 2023 (FTP), and the Weapons of Mass Destruction and their Delivery Systems (Prohibition of Unlawful Activities) Act 2005 (the “WMD Act”);
• sanctions ‒ the United Nations (Security Council) Act 1947 (the “UNSC Act”) and the Unlawful Activities (Prevention) Act 1967 (UAPA);
• security ‒ the Official Secrets Act 1923 (OSA) and allied statutes; and
• foreign direct investment (FDI) ‒ the Foreign Exchange Management Act 1999 (FEMA), the Foreign Exchange Management (Non-Debt Instruments) Rules 2019 (the “NDI Rules”), and Press Notes of the Department for Promotion of Industry and Internal Trade (DPIIT), Ministry of Commerce and Industry (MCI), GoI.

No single agency, ministry or regulator has sole oversight over all legal and regulatory aspects. Instead, oversight responsibility is distributed based on function.

• Ministry of Defence, GoI (MoD) ‒ typically, the MoD is the buyer of defence equipment and responsible for implementing the DAP 2020 and DPM 2025. Additionally, the MoD (through its Department of Defence Production (DDP)) is the competent authority for defence-sector FDI approvals and the licensing authority for munitions exports.
• DPIIT ‒ the DPIIT grants and enforces industrial licences under the IDRA and arms manufacturing licences (other than for small arms) under the Arms Act, frames FDI policy, and routes FDI proposals (as nodal agency) to competent authorities, including for the defence sector.
• Ministry of Home Affairs, GoI (MHA) ‒ the MHA grants and enforces manufacturing licences for small arms under the Arms Act and the Arms Rules, grants security clearances for industrial and manufacturing licences (under the IDRA as well as the Arms Act), and grants security clearances for FDI in defence.
• Directorate-General of Foreign Trade (DGFT), MCI ‒ the DGFT is the licensing authority for dual-use exports, with primary responsibility for export controls enforcement.
• Ministry of External Affairs, GoI (MEA) ‒ the MEA oversees UN sanctions and treaty commitments.

The above-mentioned departments consult one another in discharging their functions ‒ for instance, DPIIT considers industrial licence applications in consultation with the MoD and the MEA, and the MoD decides defence-sector FDI proposals subject to MHA security clearance.

For FDI and manufacturing licences, if manufacturing an item requires an industrial licence under the IDRA (as per the DPIIT list) or a manufacturing licence under the Arms Act, then such manufacture falls within the defence sector.

From a regulatory standpoint, the concept of “dual-use” items is more relevant to export control, with the Special Chemicals, Organisms, Materials, Equipment and Technologies (SCOMET) list listing dual-use items.

India is dualist, with treaties becoming domestically binding only through domestic legislation. United Nations Security Council (UNSC) resolutions take effect through orders issued under the UNSC Act.

India belongs to the Missile Technology Control Regime (2016), the Wassenaar Arrangement (2017) and the Australia Group (2018). It adheres to Nuclear Suppliers Group guidelines and is party to the Chemical and Biological Weapons Conventions, with the SCOMET list built on these commitments.

India is neither a NATO member nor party to the Arms Trade Treaty. EU defence directives have no effect.

Executive orders (compiled as the GFRs issued by the GoI’s Ministry of Finance), rather than statute, govern public procurements in India.

Within the overarching structure of the GFRs, the defence procurement regime is bespoke. Depending on the nature of procurement, the MoD applies the DAP 2020 (capital acquisitions of equipment, platforms and systems) or the DPM 2025 (revenue procurement of goods and services, including maintenance, spares, repair and information technology). A draft DAP 2026, released for public consultation on 10 February 2026, will replace the DAP 2020 once finalised.

The DAP 2020 and the DPM 2025 provide for exemptions/dispensations in specific procurement situations ‒ for example, fast-track procurement, emergency procurement (EP), inter-governmental agreement (IGA) (government-to-government transactions), and buyer nominated/single-source situations.

The obligations of original equipment manufacturers (OEMs) and suppliers in defence procurements flow from tender documents and the resulting contract (typically based on the standard contract), rather than a single statute.

The DAP 2020 and the DPM 2025 apply to the buyer, which is typically an instrumentality of the GoI. The DAP 2020 governs capital acquisitions (excluding works, land and medical equipment) by the MoD, the Service Headquarters of the Indian Army, the Indian Navy and the Indian Air Force, the Integrated Defence Staff, and the Indian Coast Guard. DPM 2025 governs revenue procurement across MoD, the Defence Services and their subordinate organisations.

The Defence Research and Development Organisation (DRDO) and defence public-sector undertakings (DPSUs) buy under their own procurement manuals.

In India, private companies are never buyers and are bound only as participating bidders, suppliers, and subcontractors through the tender documents and contract terms.

Purchases charged to the capital budget (ie, new equipment, platforms, upgrades and major refits) fall under the DAP 2020. Purchases charged to the revenue budget (ie, supplies, spares, maintenance, IT and services) fall under the DPM 2025. There is no minimum value threshold for applicability of either instrument.

Under the DAP 2020, a classified request for proposal (RFP) is handled under the precautions of its security classification, and each bidder signs a non-disclosure agreement in the prescribed format. The DPM 2025 permits exemption of offers/relevant information from electronic publication where national security requires.

Acquisitions under the DAP 2020 are category-dependent (Buy, Buy & Make, Make, etc) and typically involve the following stages (with variations depending on category):

• request for information;
• setting qualitative requirements and performance parameters;
• acceptance of necessity (AoN) ‒ the government’s in-principle approval of the purchase and its category;
• RFP;
• technical evaluation and field trials;
• opening of commercial bids for compliant bidders;
• price negotiation by contract negotiation committee; and
• approval by competent financial authority and contract signature.

Typically, bids are submitted in a single stage (with technical and commercial offers in separate covers) and the contract is awarded to the technically compliant lowest (L1) bidder.

Negotiated and direct routes (IGA/foreign military sales (FMS)) have historically accounted for a substantial share of capital spending by the MoD/Indian defence forces, with the Supreme Court of India (the “Supreme Court”) noting in the Rafale litigation (Manohar Lal Sharma v Narendra Damodardas Modi, AIRONLINE 2018 SC 1376) that IGAs (including FMS) accounted for nearly 40% of the INR7.45 trillion (USD78.5 billion) procured since 2002 under the Defence Procurement Procedure (predecessor to the DAP 2020).

Routes

Under the DAP 2020, an ab initio single-vendor case may be approved where only one vendor can supply equipment that gives a qualitative edge. The DAP 2020 allows purchase under IGA/FMS where a government-to-government transaction carries strategic, military, technological, economic or diplomatic benefit. The fast-track procedure/EP compress the process under the DAP 2020 for procurements addressing urgent operational requirements. Under the DPM 2025, a proprietary article certificate permits purchase from a sole manufacturer/rights-holder, and a single tender enquiry is available in operational emergencies or for standardisation with existing equipment.

Pricing

Single-vendor cases usually entail establishing a benchmark price before the commercial offer is opened. Under the DAP 2020, benchmarking is undertaken by a benchmark models committee, whose recommendations inform internal discussions of the contract negotiation committee. For procurement of DPSU equipment in single-vendor cases, the DAP 2020 requires a separate costing committee constituted by the DDP to price the equipment. IGA/FMS purchases are made at prices set in direct government-to-government negotiations.

Practice

These routes account for some of the largest recent procurements, including the Rafale purchase under a 2016 IGA with France and the 2024 MQ-9B purchase from the USA under FMS.

The DAP 2020 marked a graded shift in emphasis from offset obligations to indigenous content (IC) requirements.

Offsets

Offset applies to procurements under the Buy (Global) category where estimated cost at AoN is INR20 billion (USD210 million) or more, at a standard value of 30% of estimated acquisition cost.

Indian vendors participating in a Buy (Global) procurement meeting 30% IC need not comply with offsets. Offsets do not apply to single-vendor cases, IGA/FMS, fast-track cases, or option-clause purchases where the original contract did not require offsets. Offsets are discharged through purchase of eligible products, investment, and transfer of technology, with monitoring by the MoD’s Defence Offset Management Wing, which audits annual progress and penalises shortfalls.

For foreign OEMs, multipliers of two to four apply to technology transfer to Indian enterprises and government institutions and to the acquisition of critical technology by the DRDO. Offset credits may be banked.

IC

Each procurement category under the DAP 2020 carries a minimum IC requirement. The highest preference category, Buy (Indian-IDDM) (indigenously designed, developed and manufactured), requires at least 50% IC, and Buy (Indian) requires 50% (rising to 60%, where the item is indigenously designed).

Sovereign Capability

Positive indigenisation lists issued since 2020 bar import of notified items after prescribed dates. The GoI’s Atmanirbhar Bharat (self-reliant India) initiative drives domestic sourcing.

Security of supply is secured primarily through contract. The DAP 2020 requires product support (procured along with the equipment) for at least three to five years beyond warranty. It also requires a life cycle support contract (signed with the main contract) that binds the seller to long-term supply of spares and repairs, active obsolescence management, and at least two years’ notice to the buyer before a production line closes.

India’s defence sector FDI conditions also require investee/joint venture companies to have product design, development, maintenance and life cycle support capability in India.

Another safeguard under the DAP 2020 is that any change in vendor name for any reason (including merger, acquisition or amalgamation) during the procurement process requires MoD consent.

Evaluation is sequential, not weighted. Technical evaluation tests compliance with qualitative requirements, field trials test performance, and only compliant bids qualify for commercial evaluation (with award ordinarily going to the lowest evaluated price). Thus, factors other than price operate upstream ‒ in the category chosen at AoN, in the eligibility requirements, in the IC requirements, and in security requirements.

Two qualifications exist:

• enhanced performance parameters can earn a credit of up to 10% where the tender provides for it; and
• life cycle cost is evaluated where specified in the RFP.

Under the DAP 2020 and the DPM 2025, bidders may be excluded for:

• failing eligibility or technical requirements;
• absent licences;
• false declarations;
• breach of the pre-contract integrity pact;
• prior suspension or debarment; or
• national security concerns.

Bidders must disclose bans affecting them and their subcontractors and technology partners.

The DAP 2020 specifically requires bidders to certify they are not currently banned, debarred or suspended by the GoI or any other government organisation and to disclose relevant past debarments. Cross-debarment across GoI ministries is not the default position and requires a Department of Expenditure (DoE) order.

National security is an express ground for disqualification. GFRs permit restrictions, including prior registration, on bidders from countries sharing a land border with India.

Transparency is the default; security is the exception. Tender notices, corrigenda, and award details for unclassified procurement are published on the Central Public Procurement Portal and the defence e-procurement portal, with certain exemptions (confidentiality/national security/classified nature).

Modification after award is by written amendment signed by both parties and approved at the applicable level of delegated financial power. Generally, the contract itself is flexible, including:

• option clauses for additional quantities;
• repeat orders;
• price variation; and
• delivery extensions on stated conditions.

The standard contract prescribed in the DAP 2020 provides termination grounds such as default, insolvency, prolonged force majeure, corrupt practice, and false declarations. It also allows the government to terminate for convenience on written notice, with a takeover or compensation mechanism for in-production goods.

India does not have a dedicated defence procurement tribunal. Aggrieved bidders typically petition the jurisdictional High Court or the Supreme Court, where a fundamental right is breached. Standing ordinarily lies with tender participants and public interest petitions by non-bidders are entertained sparingly.

The court reviews the decision-making process, rather than the commercial merits of the decision – for example, in the Rafale litigation (Manohar Lal v Narendra Modi), the Supreme Court declined to go into pricing or choice of the OEM’s Indian offset partner. Grounds for review are illegality, irrationality, procedural impropriety, bad faith, and public interest. No standstill applies to the procurement process during pendency of court proceedings, unless the court specifically grants an interim relief.

The usual remedy is for the court to quash the decision and direct reconsideration. Damages are typically not awarded in writ proceedings.

Export controls in India operate through the FTDR Act and its allied instruments ‒ ie, the FTP and its Handbook of Procedures 2023 (HBP), which carries the strategic trade control procedures. The FTDR Act imposes controls (including catch-all controls) on the export, transfer, re-transfer, transit and brokering of specified goods, services and technologies.

The WMD Act governs activities relating to weapons of mass destruction and their delivery systems and supplies the penal provisions applied by the FTDR Act. The Customs Act 1962 provides for border enforcement; the Arms Act and Arms Rules govern arms and ammunition; and the Chemical Weapons Convention Act 2000 and the Atomic Energy Act 1962 apply to their respective categories.

The licensing and administrative regime of Category 0 (nuclear and nuclear-related) items is governed by the Department of Atomic Energy (DAE); Category 6 (munitions) items by the DDP; and items in other categories by the DGFT. Applications are assessed by an inter-ministerial working group (IMWG) comprising representatives of relevant ministries and departments (including the MEA, the MoD, the DAE, the Department of Space, and the Cabinet Secretariat). Border enforcement is undertaken by the customs authorities and the Directorate of Revenue Intelligence (DRI).

India maintains a single consolidated control list – ie, the SCOMET list, published as Appendix 3 to Schedule 2 of the Indian Trade Classification (Harmonised System) of export and import items. The list is organised into nine categories (0 to 8):

• Category 0 ‒ nuclear materials;
• Category 1 ‒ toxic chemicals and precursors;
• Category 2 ‒ micro-organisms and toxins;
• Category 3 ‒ materials and related equipment;
• Category 4 ‒ nuclear-related equipment;
• Category 5 ‒ aerospace systems and missile-related items;
• Category 6 ‒ munitions list;
• Category 7 ‒ advanced semiconductors, quantum technologies and cryogenic systems (added in 2025); and
• Category 8 ‒ electronics, computers, telecommunications and information security items.

Category 6 corresponds to the Wassenaar Arrangement Munitions List and the remaining categories track the Wassenaar dual-use, Missile Technology Control Regime, Australia Group and Nuclear Suppliers Group lists.

The SCOMET list is generally updated annually.

Export of any SCOMET item requires prior authorisation from the concerned licensing authority, which is generally granted on a transaction basis against end-user documentation. For Category 6 items, the DDP issues authorisations for defined purposes – ie, export for military end use, export for civil end use, participation in exhibitions/tenders, re-export after repair, return to the OEM, and testing/maintenance.

General authorisations under Chapter 10 of the HBP dispense with transaction-specific authorisations in defined situations ‒ ie, repeat orders, stock and sale arrangements, export after repair, intra-company transfers (multiple exports under a global authorisation for intra-company transfers (GAICT) or single exports), specified telecommunications and information security items, specified chemicals, and certain drones.

As regards munitions items, the DDP issues the open general export licence (OGEL) to allow export of specified munitions list items to approved destinations (excluding UN-sanctioned or embargoed destinations and an unpublished list of sensitive countries) without needing individual permits for each shipment. The OGEL is a single framework, valid for three years, covering major platforms and equipment, parts and components, and intra-company transfers of technology. The OGEL may be aligned to the term of a long-term contract with a foreign OEM and operates on one-time registration with quarterly reporting.

Applications are made online – ie, on the DGFT’s portal for dual-use items and on DDP’s defence export portal for munitions items.

Applications are typically accompanied by:

• the end-user certificate in prescribed format (EUC);
• technical specifications of the items;
• the purchase order/contract;
• profiles of the parties;
• a description of company operations;
• an internal compliance programme (ICP) for handling defence and dual-use goods (for the OGEL and GAICT); with
• additional documentation as may be queried during processing.

The IMWG’s processing timelines vary with sensitivity of the items and destination and usually take at least six to eight weeks. For munitions items, the DDP’s published processing time is two to four weeks, depending on whether stakeholder consultation is required.

Applications are assessed against national security and non-proliferation criteria rather than purely trade considerations. The FTP requires the licensing authority to consider, inter alia:

• credentials of the end user;
• credibility of the stated end use;
• integrity of the supply chain;
• risk of diversion to weapons of mass destruction programmes or non-state actors;
• export control system of the recipient country;
• nature of service and use of technology involved in the export; and
• India’s international obligations and bilateral arrangements.

The FTDR Act also confers a catch-all power covering items not listed in SCOMET, where the exporter is aware of or has reason to suspect a weapons-related end use ‒ in which case, authorisation must be sought. The human rights record or regional stability of the destination are not express criteria under the FTP and such considerations, if at all, form part of foreign policy assessment.

An EUC is required with every transaction-specific application. Issued by the foreign end user, the EUC:

• identifies the end user;
• specifies the end use and contractual value; and
• contains undertakings against diversion and against re-transfer/re-export without prior consent of the GoI.

The licensing authority may impose post-shipment conditions, including verification and end-use monitoring, as well as post shipment audit and reporting. Post-shipment verification is undertaken in select cases. Exporters are required to maintain records of controlled exports for five years and, in the case of munitions exports, to additionally file the reports required under the DDP’s procedures.

Although not expressly stated in export regulation laws, brokering of munitions and dual-use items is – in the authors’ view – not permissible under Indian law. The view rests on three elements, which are:

• Section 14A of the FTDR Act, which applies the WMD Act to brokering in specified goods, services and technologies;
• Section 12 of the WMD Act, which prohibits Indian citizens from facilitating transactions prohibited or regulated under the WMD Act; and
• the MoD’s stated position that brokering of munitions list items is prohibited under the WMD Act and the FTDR Act.

India does not have a separate brokering registration regime. No authorisation for brokering is available.

Transfer of a controlled item, software or technology to a group company outside India constitutes an export requiring authorisation, irrespective of the mode of transfer (including electronic transmission and cloud access). Two general authorisations are available, as follows.

• For dual-use items, the GAICT permits repeated transfers of specified dual-use items, software and technology (under Category 8 of SCOMET list) to a foreign parent, subsidiary or affiliate in notified countries on the basis of a one-time approval by the DGFT (assessed by the IMWG). The GAICT is valid for three years, subject to an ICP, quarterly reporting and record-keeping.
• For munitions items, the OGEL covers intra-company transfers of technology on the same one-time basis.

A transfer within India, including to a foreign-owned Indian subsidiary, is not an export. Access by foreign nationals to licensed defence facilities is separately controlled (see 5.2 Security Vetting and Clearance Requirements).

Contraventions of export control requirements attract the following consequences primarily under the FTDR Act and the Customs Act:

• penalty of up to five times the value of the goods, services or technology involved, subject to a minimum of INR10,000 (USD105);
• confiscation of the goods in question;
• cancellation, suspension or refusal of licences, the importer-exporter code, and other instruments conferring benefits;
• imprisonment under the FTDR Act, which applies the imprisonment terms prescribed under the WMD Act (extending to life imprisonment for the gravest contraventions) for contraventions involving specified goods and technology; and
• penalties and imprisonment under the Customs Act.

Enforcement is undertaken by the DGFT and customs authorities, with the DRI leading intelligence-based cases.

A voluntary self-disclosure procedure for SCOMET contraventions (except those involving nuclear and chemical weapons schedule items) was introduced by the DGFT in January 2025, with disclosures assessed by the IMWG. Bona fide disclosures accompanied by remedial measures are generally treated as a mitigating factor ‒ although settlement is not a matter of right.

India implements UNSC sanctions and does not have an autonomous sanctions statute comparable to the Office of Foreign Assets Control (OFAC), EU or UK regimes – ie, there is no general power to designate foreign persons, freeze their assets or prohibit dealings with them on foreign policy grounds, and India has no consolidated sanctions list. The relevant instruments are as follows.

• The UNSC Act – UNSC measures are given domestic effect through orders issued under the UNSC Act.
• The UAPA – this provides for designation of terrorist individuals and organisations under domestic criminal law, as well as mandatory freezing of the assets of UN-listed persons.
• The WMD Act – this imposes restrictions on proliferation financing and related dealings.
• The FTDR Act and the FTP – these provide for trade prohibitions, including India’s first autonomous country-specific trade measure (ie, the prohibition on direct and indirect import and transit of goods from Pakistan imposed on national security and public policy grounds). This is a trade control measure rather than a sanctions designation, to the extent that it restricts goods rather than persons and does not create any list, licence, or asset freeze.
• FEMA and the Reserve Bank of India (RBI) directions – these provide for the regulation of foreign exchange payments.
• The Prevention of Money-Laundering Act 2002 (PMLA) – this provides for reporting and enforcement through the Financial Intelligence Unit–India and the Directorate of Enforcement (ED).

The MEA issues UN implementation orders; the MHA administers UAPA designations; the DGFT administers trade measures; the RBI supervises compliance by regulated financial entities; and customs authorities enforce at the border.

Sanctions imposed by the USA, the EU and the UK have no legal force in India, which does not have a blocking statute. Exposure of Indian entities to such sanctions arises commercially – ie, through dollar clearing, correspondent banking and US-origin content.

Arms embargoes imposed by the UNSC are given effect through orders under the UNSC Act and corresponding prohibitions under the FTP, covering the supply, sale, transfer and transit of arms and related material to embargoed states and entities (eg, North Korea and the Islamic State of Iraq and the Levant (ISIL) and Al-Qaeda sanctions list).

Exceptions are available only as provided in the relevant resolution. India does not impose unilateral arms embargoes by legal instrument. However, export authorisations are in practice denied for adversary states, and the OGEL excludes negative or sensitive countries. India continues defence trade with states subject to Western but not UN sanctions.

In India, banks and other regulated financial entities are required to screen customers and transactions against UN sanctions lists and UAPA designations under RBI’s KYC directions and freeze assets on a match .

Defence contractors are not subject to prescriptive screening requirement under Indian law. However, given that prohibitions on dealings with designated persons apply to all persons, screening is the practical means of compliance.

India does not maintain a consolidated sanctions list. There is no statutory ownership-and-control test comparable to the US 50% rule.

India does not have a general sanctions licensing regime. Relief (where available) is limited to exceptions in the relevant UNSC resolution and corresponding domestic order (eg, for basic expenses and legal fees), invoked by notification through the MEA to the relevant UN committee of the intention to:

• authorise access to frozen funds for basic expenses or legal fees; and
• access proceeds in the absence of a negative decision within 48 hours of such notification.

Applications of this nature, if any, in the defence context are not publicly reported.

Sanctions imposed by foreign governments have no legal effect in India.

Commercial exposure nevertheless remains, particularly from US secondary sanctions’ authority over foreign financial institutions dealing with Russia’s military industrial base, which has made Indian banks cautious in processing Russia-linked defence payments. Countering America's Adversaries Through Sanctions Act (CAATSA) exposure (whereby sanctions may be imposed on countries purchasing major defence equipment from Russia) occasioned by India’s purchase of S-400 air defence system from Russia – as well as the December 2023 US executive order authorising secondary sanctions on foreign financial institutions dealing with Russia’s military-industrial base – are illustrative of this tension.

Indian defence-sector participants typically manage such exposure through:

• sanctions clauses in contracts;
• payment structuring; and
• assessment of US/EU touchpoints in components, financing and logistics.

The DGFT’s ICP framework for strategic trade is the only regulator-issued guidance on compliance programmes. A certified/approved ICP is a pre-condition for the GAICT and is treated as a mitigating factor in enforcement. RBI directions prescribe the screening standard for regulated financial entities. Beyond these, expectations are typically contractual.

An effective ICP for a defence-sector participant would generally comprise:

• management accountability and item classification;
• screening against UN, UAPA and relevant foreign sanctions lists;
• end-user and end-use verification;
• payment channel review, training and record-keeping for at least five years; and
• an escalation and disclosure protocol.

Terrorism and terrorist financing offences under the UAPA are punishable with imprisonment extending to life. Contravention of a freezing order is separately punishable.

Offences under the WMD Act attract imprisonment of five years to life.

Contraventions of trade and export control measures attract the civil and criminal consequences. Customs offences attract confiscation and imprisonment.

Contraventions of FEMA attract a penalty of up to three times the sum involved, with the option of compounding (ie, settlement of the contravention on payment).

India does not have an OFAC-style voluntary disclosure programme for sanctions violations; available mechanisms are the export control self-disclosure route and voluntary payment of customs duty. Co-operation, an effective compliance programme and early remedial action are generally treated as mitigating factors.

No domestic enforcement action against a defence-sector participant for a sanctions contravention has been publicly reported during the past 12 months.

Three developments in the past 12 months are relevant.

• First, there have been significant foreign designations, whereby:
1. the US designated 21 Indian entities in October 2024 in connection with Russian energy and military industrial trade – of which, four were delisted in 2026;
2. EU sanctions packages listed Indian companies in 2025 and June 2026; and
3. the UK designated Indian refiners and port operators in October 2025, bringing Indian defence-adjacent businesses within the scope of foreign sanctions.
• Second, the National Company Law Tribunal (NCLT) Ahmedabad bench held that placement on the OFAC Specially Designated Nationals and Blocked Persons list does not have automatic legal force in India. However, in April 2026, the NCLAT granted interim relief – keeping the NCLT order in abeyance and clarifying that it should not be treated as a precedent until the appeal is decided. The parties settled, with the appellate court explicitly keeping open the substantive question of whether foreign sanctions can constitute a valid excuse for non-performance under Indian law.
• Third, the trade prohibition against Pakistan continued, and changes to UN lists were implemented through domestic orders.

The statutes relevant to national security in India are as follows:

• the OSA ‒ covering espionage, prohibited places, and unauthorised disclosure of secret official information;
• the UAPA and the WMD Act ‒ covering terrorism, terrorist designations and counter-proliferation;
• Bharatiya Nyaya Sanhita 2023 (BNS) ‒ covering offences against the State such as acts endangering sovereignty, unity, and integrity; and
• the Information Technology Act 2000 (the “IT Act”) and the Telecommunications Act 2023 ‒ covering cyberterrorism; interception, monitoring or blocking in the interest of national security; and temporary control of telecommunication services during a public emergency or war.

Administration and enforcement of the above-mentioned statutes may not rest with a single agency. For instance, the OSA is administered by the MHA (including prosecution sanction) but investigation rests with the Central Bureau of Investigation (CBI) and state police forces. Similarly, the UAPA is administered by the MHA, but investigation rests with the National Investigation Agency (NIA) or state police.

India does not have a unified security clearance system. Security vetting operates at two levels, as follows.

• At the company level, the MHA grants security clearance for applicant companies, their directors and key shareholders (including all foreign shareholders) in connection with defence industrial/manufacturing licences and, for FDI, on the basis of antecedents, foreign linkages and criminal record.
• At the personnel level, the Security Manual for Licensed Defence Industries issued by the DDP (the “Security Manual”) requires character and police verification of employees, positive vetting by the DDP’s nodal office before access to top secret work, re-verification every three years for the chief company security officer (CCSO) and the cyber-information security officer (CISO) and every two years for personnel on top secret work, and quarterly reporting of cleared personnel.

Foreign Nationals

The Security Manual treats foreign nationals separately. Visits to areas where manufacturing for MoD projects is underway require prior clearance from the MoD; visits to non-sensitive areas may be approved by the chief executive or head of the Indian licensed defence company but must be reported; and entry to vital installations on tourist or e-tourist visas is prohibited.

Grant, Revocation and Review

Clearances are administrative in nature. The MHA and the DDP grant, condition and withdraw clearances under broad published parameters (applications to the MHA are made through its e-Sahaj portal). Reasons are typically withheld on security grounds.

Classification of information is administrative rather than statutory. Documents and equipment are graded (“top secret”, “secret”, “confidential”, and “restricted”) under departmental security instructions that are themselves classified.

The Security Manual applies these grades to licensed defence companies and prescribes handling, marking and storage requirements for each. The OSA penalises spying and unauthorised communication of secret official information, with enhanced imprisonment where the offence relates to defence works, establishments or military affairs (see 5.4 Critical National Infrastructure and Defence Assets).

The government may resist production of unpublished classified records in court, but the court decides the claim, and the marking of a document as secret does not by itself exclude it from judicial proceedings (see 7.5 Legal Professional Privilege and Confidentiality).

Although the OSA designates all defence establishments (including private-sector defence industrial and R&D establishments) as prohibited places ‒ spying on which would attract imprisonment up to 14 years – defence assets are not designated as critical national infrastructure under a defence-specific regime.

Under the IT Act, the appropriate government may declare computer resources affecting critical information infrastructure to be protected systems, with access controls and imprisonment for unauthorised access.

India does not have a Cybersecurity Maturity Model Certification (CMMC)-type certification scheme for defence contractors. The baseline requirements arise under general law – ie, the IT Act and directions issued by the Indian Computer Emergency Response Team (CERT-In) that require reporting of specified cyber-incidents within six hours and retention of logs for 180 days, which apply to all entities including defence contractors.

Additionally, MoD tenders and the Security Manual impose information security requirements. The Security Manual mandates:

• ISO 27001 compliance;
• appointment of a positively vetted CISO;
• internal cybersecurity audits every six months and annual external audits by CERT-In empanelled auditors; and
• integration with the Defence Cybersecurity Operations Centre for centralised log monitoring.

MoD tenders typically expect the CERT-In certification.

Supply chain security is addressed through eligibility and sourcing conditions rather than a dedicated statute, as follows:

• the IC requirements and positive indigenisation lists (see 2.7 Offsets, Industrial Participation and Sovereign Capability Requirements), and the preference for the Buy (Indian-IDDM) category;
• the FDI condition that the investee company be self-sufficient in product design and development, with maintenance and life cycle support in India (see 2.8 Security of Supply and Resilience Requirements); and
• the registration requirement for bidders from countries sharing a land border with India (see 2.10 Exclusion Grounds), imposed on grounds of defence and national security.

These conditions are enforced through tender eligibility, verification of IC, and licence and approval conditions. The National Security Directive on the Telecommunications Sector, which restricts telecommunications networks to trusted products from trusted sources, exemplifies a sector-specific trust regime for a defence-adjacent sector.

India does not have a standalone insider threat statute and the relevant obligations primarily arise from two sources, as follows.

• The OSA penalises espionage and imposes a duty to furnish information, on demand, regarding offences or suspected offences under the OSA. Failure to comply is punishable with imprisonment and/or a fine.
• The Security Manual requires licensed companies to maintain a security organisation headed by a CCSO, who must be an Indian citizen and positively vetted, to:
1. control visitor and foreign national access;
2. report security breaches, espionage, sabotage, subversive activities and suspicious contacts to the DDP’s nodal office and the nearest police station immediately on occurrence; and
3. notify any suspicious behaviour of employees handling classified information.

There are no special security agreements, proxy boards or government-appointed security directors of the kind prevalent in the USA. Instead, India addresses foreign ownership, control and influence, ex ante, through approval/licence conditions rather than through mitigation instruments.

The controls in India comprise:

• government approval for FDI required above 74%;
• government approval for investment where beneficial ownership from land-border countries exceeds the 10% non-controlling safe harbour;
• MHA security clearance for any FDI in the defence sector and, irrespective of FDI, for industrial/manufacturing licences;
• conditions under the industrial/manufacturing licence regimes that require either intimation to (for an industrial licence) or prior approval by (for a manufacturing licence under the Arms Act) the GoI, in the event of change in ownership or change in directors;
• stipulation under the Arms Rules whereby restrictions in joint venture agreement imposed by the foreign partner shall have no legal consequence on the joint venture entity; and
• the Security Manual’s restrictions on access by foreign nationals.

Additionally, the GoI reserves the right to review any FDI in the defence sector on national security grounds (see 6.5 Assessment Criteria).

National security considerations run through each regime described in this chapter: export licensing (see 3.5 Criteria for Granting or Refusing Licences), FDI screening and the government’s reserved right of review (see 6.5 Assessment Grounds), security clearance and licence conditions (see 5.2 Security Vetting and Clearance Requirements) and procurement eligibility (see 2.10 Exclusion Grounds).

There is no apex co-ordinating authority. Co-ordination occurs through the nodal department consulting the MoD, the MHA and the MEA, and inter-ministerial bodies such as the IMWG, as well as the MHA security clearance that recurs across regimes.

FDI in the defence sector may require government approval depending on its quantum and always requires MHA security clearance, irrespective of FDI quantum.

FEMA and the NDI Rules together constitute the overarching statutory framework for government approval for FDI/FDI screening in the defence sector, with details of the screening process prescribed under the Consolidated FDI Policy read with the DPIIT’s Standard Operating Procedure for Processing FDI Proposals last issued in May 2026 (the “FDI SOP”).

The MoD (through the DDP) is the competent authority for defence sector FDI approvals, except for small arms and ammunition (where the MHA decides). The DPIIT, as the nodal department, routes applications to relevant authorities and must concur in any rejection or additional condition; the MHA provides security clearance; and the MEA is consulted.

Industrial/manufacturing licensing under the IDRA or the Arms Act (as applicable) and security clearance for FDI proposals run in parallel with the government approval for FDI. The government can review any foreign investment in the defence sector on national security grounds.

Transactions Covered

FDI in the defence sector encompasses the fresh issue and transfer of equity instruments (equity shares, compulsorily convertible preference shares and debentures, and warrants) of newly incorporated joint ventures or existing investee companies.

Technology licensing, without equity participation by the foreign technology licensor in the Indian licensee company, is not FDI and will not by itself amount to a screening event.

Thresholds

FDI up to 74% is permitted under automatic route for companies seeking new industrial/manufacturing licences. FDI beyond 74% in such companies requires government approval, available where it is likely to result in access to modern technology or for other reasons to be recorded.

For companies not seeking a new licence (including those already licensed) or already holding government approval for FDI, fresh FDI up to 49% requires a declaration to the MoD within 30 days of the change. FDI beyond 49% in such companies requires government approval.

Security clearance from the MHA is required, irrespective of the proposed FDI quantum.

Land-Border Investors

Any investment by an entity of ‒ or beneficially owned by a citizen/entity of ‒ a country sharing a land border with India (Afghanistan, Bangladesh, Bhutan, China, Myanmar, Nepal and Pakistan) requires prior government approval, irrespective of the size of the stake, except in the case of non-controlling beneficial interests of up to 10%, where mandatory reporting replaces the requirement for prior government approval.

Where government approval is required (by reason of quantum of FDI or a land-border investor), it must be obtained before closing. MHA security clearance is mandatory for every FDI in the defence sector, whatever the quantum (see 6.2 Transactions Subject to FDI Screening).

Contravention may attract penalties under FEMA, compounding, and directions to unwind.

Applications for government approval for FDI in the defence sector are filed on the National Single Window System and routed by the DPIIT to the MoD as the competent authority, with copies to the MHA (for security clearance), the MEA and the RBI. The application covers the group structure, beneficial ownership, source of funds, business plan, and downstream investments. Under the FDI SOP, the stated disposal timeline for applications is 12 weeks. Clock stops for queries are common in practice and the approval process typically runs longer than stipulated. Security clearance forms part of this process and is generally the longest step.

As previously stated, such government approvals and security clearance are conditions precedent to investment.

FDI in the Indian defence sector is subject to scrutiny on grounds of national security and the GoI reserves the right to review any FDI in the defence sector where said FDI affects or may affect national security. There is no guidance available in the public domain on what amounts to affecting national security.

That said, such a review may consider:

• the investor’s antecedents and links to foreign states;
• access that the investment provides to classified information, sensitive technology, or armed forces programmes; and
• the effect on domestic capability under the self-reliance policy.

This assessment is inter-ministerial and inherently discretionary.

Conditions are imposed through the government approval for the FDI proposal, where applicable, with such government approvals being granted subject to these conditions (eg, security conditions, compliance with the Security Manual, restrictions on information flows and board access, and reporting) and framed on a case-by-case basis rather than under a published framework. A transaction that the GoI believes cannot be adequately conditioned may also be refused.

Post-completion, the GoI’s right to review any defence-sector FDI on grounds of national security means that any defence-sector FDI ‒ approved or under automatic route ‒ may in principle be reopened and unwound. No unwinding has been publicly reported, as yet.

India does not use golden shares or special share classes in defence companies. Instead, the government’s control over the sector derives from:

• majority shareholding in DPSUs;
• licence and approval conditions;
• the reserved national security review over any defence sector FDI; and
• personnel and access controls under the Security Manual.

Together, these afford the government a veto in substance over changes of control, without a named instrument.

A defence sector joint venture requires the same three approvals as any other FDI proposal, which are:

• FDI approval (where required);
• industrial/manufacturing licence; and
• security clearance, with the joint venture agreement itself being examined in the clearance process.

The DAP 2020 also shapes joint venture arrangements. Examples include the following.

• Certain procurement categories under the DAP 2020 (ie, Buy (Indian-IDDM), Make I, Make II, Development cum Production Partner in design and development acquisitions through DRDO/DPSUs, and the Strategic Partnership Model) are reserved for Indian vendors that are “owned and controlled by resident Indian citizens”.
• A company is “owned” by resident Indian citizens if more than 50% of its capital is directly or beneficially owned by them, and “control” includes the right to appoint a majority of directors or to control management or policy decisions, whether through shareholding, management rights, shareholders’ agreements or voting agreements.
• The Strategic Partnership Model pairs a foreign OEM with a selected Indian partner.

Technology transfer and the allocation of IP between joint venture partners are typically contractual.

Merger control and FDI screening operate independently. The Competition Commission of India reviews combinations based on asset, turnover and deal value thresholds on competition grounds alone, while FDI approval carries the national security assessment. There is no statutory co-ordination mechanism between these two regimes. The GoI also has the power under the Competition Act 2002 to exempt combinations from review on grounds of security of the State.

Investigative jurisdiction is determined by the offence, as follows:

• CBI ‒ corruption in GoI procurement under the Prevention of Corruption Act 1988 (the “PC Act”), whereby consent of the state government is required for the CBI to investigate within a state, unless a constitutional court directs the investigation;
• ED ‒ money laundering under the PMLA, where a scheduled offence (eg, procurement-related bribery or cheating) generates proceeds of crime;
• police ‒ cheating and criminal breach of trust;
• the DRI and customs authorities ‒ export control and customs offences;
• the NIA ‒ scheduled offences affecting national security, including under the UAPA and the WMD Act;
• MoD vigilance units and the Central Vigilance Commission (CVC) ‒ procurement integrity, with references to the CBI/ED, supplemented by audit findings of Comptroller and Auditor General of India (CAG).

In practice, proceedings typically run in parallel ‒ ie, a CBI corruption case, an ED money laundering case predicated on it, and penalty action by MoD.

Investigations may be triggered by:

• whistle-blower complaints;
• first information report (which any person may register with police authorities);
• CVC-directed inquiry;
• audit observation/objection, especially from the CAG;
• intelligence input; or
• court direction, whether suo motu, on public interest litigation, or on application of an interested party.

Under the DAP 2020, a complaint of an integrity pact violation received by the buyer must be referred to the independent external monitors (IEMs) for their comments or enquiry (see 2.10 Exclusion Grounds).

Mandatory reporting obligations are specific rather than general, as follows:

• statutory auditors must report suspected fraud to the GoI;
• listed companies must disclose material events under the listing regulations of the Securities and Exchange Board of India (SEBI);
• the voluntary self-disclosure mechanism for export control contraventions is described in 3.9 Enforcement, Penalties and Voluntary Disclosure; and
• a person compelled to give a bribe escapes liability under the PC Act only if the matter is reported to law enforcement within seven days (see 7.8 Whistleblower Protections).

The CBI, the ED and the DRI have powers to summon persons and documents, examine witnesses, search premises, seize records and property, and arrest. Statements recorded by the ED are admissible in evidence ‒ although court rulings permitting this are under review. The ED may attach property as proceeds of crime, including property of equivalent value where tainted property is untraceable or abroad. Indian agencies may also seek foreign assistance to gather evidence, freeze assets, and secure arrests or extraditions under mutual legal assistance treaties or letters rogatory.

There is no special procedure for classified material in investigations. The OSA duties described in 5.7 Counter-Espionage and Insider Threat Obligations apply, and the government may claim privilege over unpublished official records under the Bharatiya Sakshya Adhiniyam 2023 (BSA), with the court deciding such claims (see 7.5 Legal Professional Privilege and Confidentiality).

Unannounced searches are lawful in certain cases. The ED, the CBI, the DRI, and the tax authorities may search business premises and residences on reasons to believe (to be recorded in writing), without a court warrant. The person searched must permit entry and co-operate, but may:

• verify the officers’ identity and authorisation;
• require two independent witnesses; and
• demand a list of seized articles.

Obstruction and destruction of evidence are offences.

There is no right to have a lawyer present during a search or interrogation. However, courts have occasionally permitted counsel at a visible but not audible distance during questioning.

Legal professional privilege is statutory and sector-agnostic, with no national security exception. The BSA protects advocate‒client communications made during the engagement, except those in furtherance of an illegal purpose or revealing crime or fraud after the engagement. However, it does not extend to in-house counsel.

The Supreme Court held in 2025 that investigating agencies cannot summon an advocate in respect of advice given or representation provided, except within the statutory exceptions.

A privileged document seized during search is not automatically excluded from evidence; objection to its seizure should be taken at the first instance and, if necessary, contested in court. On classified material, the Supreme Court held in the Rafale review petitions (Yashwant Sinha v Central Bureau of Investigation (2019) 6 SCC 1) that no statute empowers the executive to withhold sensitive documents from court, with disclosure governed by balancing public interest against the obligation to protect confidentiality in state affairs.

Debarment is administrative and graded, under the Guidelines of the MoD for Penalties in Business Dealings With Entities. An entity may be:

• suspended pending inquiry; or
• banned for a specified period.

Grounds for such action include, inter alia, corrupt practices, breach of the integrity pact, and national security. Courts in India have set aside suspensions that were based solely on the pendency of investigation.

Consequences extend to, inter alia:

• cancellation;
• refund with interest;
• encashment of bank guarantees; and
• exclusion from future tenders.

Under the GFRs, conviction for procurement-related offences may result in government-wide debarment for up to three years.

India does not have a formal self-cleaning mechanism. Affected entities’ process protections comprise:

• a notice to show cause being served on the entity;
• a right of reply;
• a reasoned order; and
• judicial review.

Arbitration under the Arbitration and Conciliation Act 1996 is the usual mechanism for resolution of contractual disputes with the MoD. Foreign awards from notified UN Convention on the Recognition and Enforcement of Foreign Arbitral Awards (the “New York Convention”) states are enforceable in India. Two qualifications apply, as follows.

• The DoE’s guidelines of June 2024 discourage arbitration in domestic public procurement above INR100 million (USD1.05 million) in favour of mediation.
• Criminal matters are tried by special courts under the PC Act and the PMLA.

There is no statutory scheme for classified evidence in civil proceedings; courts adopt in camera hearings and redaction on a case-by-case basis. Separately, tender and contract terms themselves typically restrict disclosure of classified technology in any forum, including arbitration.

Whistle-blower protection in India is fragmented, with the Whistle-Blowers Protection Act 2014 not fully in force. The available protections for whistle-blowers are:

• the CVC’s Public Interest Disclosure and Protection of Informers resolution, which protects the identity of complainants against GoI employees;
• the vigil mechanism required of listed and prescribed companies under the Companies Act and/or the SEBI listing regulations;
• the integrity pact ‒ under which any bidder or third party may report a breach to IEMs; and
• Section 8 of the PC Act – ie, a person compelled to give a bribe is not liable if the matter is reported to law enforcement within seven days.

Reports may be made, depending on subject matter, to the CVC, the vigilance department of the buyer, the CBI, IEMs, or the SEBI.

Companies are subject to criminal liability, and the relevant statutes (eg the PMLA and the Customs Act) follow a common pattern: where an offence is committed by a company, the company and every person in charge of and responsible for the conduct of its business are liable, subject to a defence of lack of knowledge and lack of due diligence. Recently, the Supreme Court clarified that a company can be held liable for offences requiring mens rea, which can be ascertained from its constitutional documents, delegated authority or specific statutory provisions. Although there is no general vicarious liability of directors, Indian law requires either an express provision creating such liability or proof of an active role.

Bribery

The PC Act renders a commercial organisation (carrying on business in India) liable where any person associated with it (including agents, intermediaries and subsidiaries) gives or promises an undue advantage to a public servant to obtain or retain business. Proof of adequate procedures designed to prevent such conduct is a defence ‒ although the guidelines that the PC Act contemplates for such procedures have not yet been prescribed.

Export Controls

Contraventions attract imprisonment terms described in 3.9 Enforcement, Penalties and Voluntary Disclosure. Beyond civil penalty, corporate exposure of critical practical significance is debarment (see 7.6 Debarment and Exclusion From Future Procurement).

Successor Liability

A change of name does not affect the identity of an entity. Any pending investigation, prosecution or debarment continues against the renamed company (see 2.10 Exclusion Grounds).