Beyond the Permit Raj: A Legal and Operating Model for Trust-Based Regulation

Executive judgment

The Permit Raj is no longer a single code that can be repealed. It is a recurring administrative pattern. A person or firm must obtain permission before acting; the applicable criteria are scattered across statutes, rules, circulars and local practice; several authorities ask for overlapping information; deadlines are weak or absent; officials can raise sequential queries; and the applicant has no inexpensive route to a reasoned, timely decision. Even where every underlying policy objective is defensible, the combined system creates an economic barrier and a market in administrative access.

India’s reform record is material. Industrial delicensing after 1991 removed central controls on entry and production in most sectors. The Jan Vishwas (Amendment of Provisions) Act, 2023 decriminalised 183 provisions across 42 central Acts. The 2026 Act went significantly further, amending 784 provisions across 79 central Acts, including 717 decriminalisation measures. The National Single Window System now guides users across central departments and states and has processed hundreds of thousands of approvals.¹ These are not cosmetic changes. They recognise that a state can protect health, safety, consumers and the environment without treating every procedural defect as a crime or every business activity as presumptively suspect.

Yet repeal, decriminalisation and digitisation address different failure modes. Repeal removes an obligation. Decriminalisation changes the consequence of breach. Digitisation changes the interface. None necessarily changes the legal test, the number of authorities involved, the evidence demanded, or the discretion exercised behind the screen. A bad process rendered online can become a faster way to produce an opaque rejection. A “single window” that merely routes an applicant to multiple departmental back offices is a useful front door, but not a single decision.

Zwarte Peper’s position: regulatory reform should begin with the risk to be controlled, not the form to be preserved. Low-risk activities should ordinarily proceed by notification or registration. Ex ante permission should be reserved for material, reasonably identifiable harms. Where permission is justified, the state should publish the decision rule, reuse data it already holds, decide within a binding period and give reasons that can be challenged.

The objective is not a regulator-free economy. It is a state that concentrates scarce inspection and enforcement capacity where harm is serious, while allowing compliant citizens and firms to act without buying access to discretion. Trust-based regulation is therefore not indulgence. It is a more demanding operating model: clearer law, better data, risk-based supervision, stronger ex post enforcement and public measurement of administrative performance.

1. The modern Permit Raj is a systems problem

From industrial licensing to distributed administrative friction

The historical License Raj controlled industrial entry, capacity, product choice and imports through an extensive licensing system. Research on progressive delicensing finds that removing entry and production controls increased manufacturing performance, but that gains varied with complementary state institutions. Industries in states with more supportive labour-market institutions grew more quickly after delicensing.² The lesson is more subtle than “remove licences and growth follows”. Formal liberalisation creates an opportunity; institutions determine who can use it.

Today’s burden is distributed. A manufacturing facility may face land-use permission, construction approval, environmental consent, electricity connection, factory registration, labour compliances, product-specific licences, fire certification and municipal permissions. A food business, clinic or small trader encounters a different chain. Many requirements protect real interests. The problem arises where authorities regulate the same risk repeatedly, ask the applicant to reproduce state-held information, demand permission for low-risk conduct or retain procedural leverage unrelated to the public objective.

This accumulation changes competition. A large incumbent can maintain a compliance department, retain advisers and absorb delay. A new or informal firm cannot. Fixed regulatory costs therefore operate like a regressive tax: the effective burden is highest where turnover and administrative capacity are lowest. Complexity also rewards experience with the system rather than productivity in the market. That is how an ostensibly neutral process protects incumbency without an explicit protectionist rule.

The political economy of administrative complexity

Complexity persists because its costs are dispersed while its benefits can be concentrated. Each individual form, renewal or inspection may appear defensible and impose only a modest burden. Across the complete journey, however, those burdens compound. No single department owns the total user cost, and removing a requirement may reduce an agency’s information, fee income, staffing claim or bargaining power. Incumbent firms may privately prefer simplification in general while resisting reform of an approval that discourages new competitors.

This explains why consultation alone does not guarantee deregulation in the public interest. The participants best equipped to respond are often established firms, professional intermediaries and administrative units with experience of the existing system. Informal enterprises, prospective entrants and citizens who abandoned an application are missing from the record. Reform teams should therefore study non-users and failed journeys, not only current licence holders. They should publish who bears the fixed cost, who benefits from restricted entry and which public outcome the permission demonstrably changes.

Technology can alter—but not eliminate—these incentives. A transparent platform reduces the informational advantage of intermediaries and creates performance data. It can also centralise control, make informal requirements harder to see and encourage departments to encode every legacy demand before anyone has challenged its necessity. The governance of digital reform must therefore include legal, economic and user-experience authority, not be treated as an information-technology procurement.

Political sponsorship matters most at the points where optimisation is insufficient. Departments can simplify fields and screens; only ministers and legislatures can decide that the state will no longer demand permission, that another authority’s data must be accepted, or that administrative silence will have legal consequences. A serious reform programme needs an escalation forum capable of resolving these distributional conflicts and an evidence standard that requires retention—not removal—to be justified.

The empirical signal remains serious

The World Bank’s India Enterprise Survey 2022 reports that senior management spent an average 12.6 per cent of its time dealing with government regulation. Firms reported an average 23.8 days to obtain an operating licence and 24.7 days for an import licence. More importantly, 27.2 per cent experienced at least one bribe-payment request, and 38.7 per cent were expected to give gifts in connection with a construction permit.³ These indicators do not prove that every permit produces corruption, and survey responses have methodological limitations. They do show that administrative contact remains a material business risk rather than a historical anecdote.

Corruption is not caused by discretion alone. Low detection risk, political patronage, weak internal controls and social norms matter. But a repeated face-to-face or bilateral interaction in which one official can delay a valuable approval creates favourable conditions for extraction. The bribe may buy a decision that should have been granted, accelerate an under-resourced process, overcome an ambiguous defect or procure unlawful leniency. In each case, the market exists because administrative power is valuable and its lawful exercise is insufficiently predictable.

2. The legal problem: permission without disciplined power

Administrative law does not prohibit judgment. Legislatures cannot specify every factual situation, and regulators need expertise to apply standards. The legal defect is unstructured discretion: power exercised without a sufficiently clear statutory purpose, relevant criteria, evidentiary standard, time limit, duty to give reasons or effective review. Digitisation does not cure that defect. It may simply conceal it inside a workflow or algorithm.

A defensible permission regime should answer seven questions in law rather than custom:

1. Authority: Which legal provision authorises the state to require prior permission?
2. Purpose: What specific harm or public interest is the regime designed to address?
3. Threshold: Why is ex ante approval necessary rather than notification, standards and ex post enforcement?
4. Criteria: What facts must the applicant prove, and which grounds justify refusal?
5. Procedure: What information may be requested, by when, and how often may an authority raise queries?
6. Decision: What is the deadline, what happens on administrative silence, and what reasons must be recorded?
7. Remedy: Who can review the decision quickly, independently and at proportionate cost?

These questions operationalise the rule-of-law requirements of publicity, equality, accountability and avoidance of arbitrariness.⁴ They also improve economic performance. An investor can price a demanding but clear requirement. It is much harder to price an apparently simple approval whose real duration and evidentiary demands depend on local practice.

Proportionality should govern both substance and procedure

Regulatory proportionality is often discussed only in relation to penalties. It should begin earlier. If the underlying harm is low and reversible, compulsory prior approval may itself be disproportionate. If harm is serious but detectable after entry, registration combined with risk-based inspection may be adequate. Prior licensing should be concentrated on activities where failure could cause severe or irreversible harm and where pre-entry verification materially reduces that risk.

Procedure must also be proportionate. A microenterprise should not face the same documentation architecture as a hazardous industrial facility. Renewal should not be automatic where the relevant facts do not change. A regulator should not request a certificate already issued by another state authority when a reliable data exchange can verify it. Criminal sanctions should be reserved for conduct involving culpability or serious harm, not used as a default response to a late filing or technical defect.

The 2026 Jan Vishwas reforms illustrate this direction. In legal metrology, specified first-time procedural non-compliance can receive an improvement notice before penalty action. Health-sector reforms replaced criminal consequences for certain minor or technical violations while retaining stronger safeguards for conduct affecting public health. Food-safety reforms approved perpetual validity for registrations and licences and substantially increased turnover thresholds, enabling enforcement resources to focus on higher-risk operators.⁵ The important design principle is graduated enforcement: advise, require correction, impose proportionate civil penalties and reserve criminal law for deliberate or harmful conduct.

3. Digitise the decision, not merely the application

The National Single Window System is a major public digital asset. Its “Know Your Approvals” module helps businesses identify requirements across 32 central departments and 34 states, offers status tracking and allows documents to be reused.⁶ Those functions reduce search costs and unnecessary travel. The next generation of reform should move from interface integration to decision integration.

Four maturity levels should be distinguished:

A genuine decision platform starts with a canonical rule inventory. Every data field and document request maps to a legal provision and identified risk. Duplicate requests are eliminated. State-held data are verified through secure exchanges rather than demanded from the applicant. Departments review concurrently unless sequencing is legally necessary. The system prevents repeated piecemeal queries by requiring a consolidated deficiency notice. A rejection identifies the unmet criterion, supporting facts and review route.

Automation is especially valuable for deterministic checks: identity, legal status, location, payment, document validity, threshold tests and consistency across forms. Artificial intelligence can help classify submissions, identify missing evidence, summarise technical material and target inspections. It should not create an unreviewable second layer of discretion. Where an automated system materially affects a right or licence, the administration should retain a versioned decision rule, record the data used, test error rates and provide meaningful human review.

Silence rules must reflect risk

“Deemed approval” is attractive because it gives the administration a cost for delay. Applied mechanically, however, it may authorise a high-risk activity without substantive review. A better architecture has three tracks. Low-risk activities proceed on notification once objective validation succeeds. Medium-risk approvals receive deemed approval if the authority misses a statutory deadline, subject to audit and revocation for misrepresentation. High-risk activities require an express decision, but delay triggers escalation, management accountability and compensation or fee refund where appropriate.

Time limits must stop agencies from gaming the clock. The law should define when an application is complete, restrict the circumstances in which time is paused and require all reasonably identifiable deficiencies to be raised together. Performance dashboards should report median and tail decision times, not only averages; a system that decides most applications quickly while leaving a politically weak minority indefinitely pending is not performing well.

4. A trust-based regulatory operating model

Trust-based regulation is sometimes caricatured as accepting self-certification and hoping for compliance. Properly designed, it reallocates state capacity. Officials spend less time processing low-risk applications and more time inspecting high-risk activity, analysing data, investigating deception and correcting systemic failure.

Step 1: build a risk-and-obligation register

Each ministry and state should maintain a machine-readable register linking every approval, return, inspection and sanction to its legal basis, policy objective, regulated population, risk tier, data requirements and owner. The register makes duplication visible and allows reforms to be measured. It should distinguish obligations created by legislation from those created only by form design or departmental practice; informal requirements are especially difficult to challenge and often easiest to remove.

Step 2: apply a regulatory hierarchy

For each risk, the state should select the least burdensome effective instrument: public information; voluntary or industry standards; mandatory outcome standards; notification; registration; certification; prior licensing; or prohibition. The choice should be supported by evidence and reviewed after implementation. A licence should expire as a policy choice only where periodic re-verification is necessary. Otherwise, continuing validity with change notification and risk-based audit is more rational.

Step 3: separate facilitation, adjudication and enforcement

The officer helping an applicant understand the process should not privately negotiate whether the legal test applies. Complex or high-value decisions should use documented allocation, dual control or committee review. Inspection selection should be risk-based and, where feasible, randomised within risk bands. Officials should record findings in structured form with time and location evidence. These controls protect honest officers as much as applicants.

Step 4: create graduated, credible consequences

Low-risk first breaches should normally trigger advice or an improvement notice. Repeated, knowing or harmful breaches justify escalating civil penalties, suspension and, where culpability warrants it, criminal prosecution. Penalty amounts should be high enough to prevent profitable evasion and indexed so that inflation does not erase deterrence. The process must also distinguish inability to comply from deliberate deception; otherwise, formalisation becomes least attractive to the enterprises the state most wants to bring into the regulated economy.

Step 5: give the applicant a real remedy

An appeal that takes longer than the commercial life of the project is not an effective remedy. Internal review should be independent of the original decision, time-bound and available online. High-volume regimes need a specialised administrative review function capable of correcting recurring legal and process errors. Judicial review remains essential, but courts should not be the first practical mechanism for obtaining a reasoned permit decision.

Step 6: publish administrative performance

The public dashboard should report application volumes, approval and rejection rates, processing distributions, query frequency, grounds of refusal, appeals, reversals, inspections, violations, incident outcomes and user cost. Data should be disaggregated enough to identify geographic and enterprise-size disparities without exposing confidential information. A low rejection rate is not automatically success; it may reflect weak scrutiny. The relevant question is whether the regime reduces its target harm at a justifiable cost and without arbitrary distribution.

5. A reform scorecard for ministers and public executives

This scorecard changes the reform conversation. Counting forms removed is useful, but it can reward superficial action. A ministry could eliminate ten rarely used returns while leaving one economically decisive permission opaque. Reform portfolios should be prioritised by total social cost: user volumes, time, fixed compliance expense, corruption exposure, effect on entry and the severity of the risk being controlled.

India’s recent reforms demonstrate political capacity for horizontal simplification. Government reporting indicates that tens of thousands of compliances have been simplified, eliminated, digitised or decriminalised, and that more than 1,500 obsolete laws were repealed by 2025.⁷ The next step is independent outcome evaluation. Did entry increase? Did processing time and variance fall? Did bribery exposure decline? Did environmental, safety or consumer outcomes deteriorate, remain stable or improve? Without this evidence, both supporters and critics of reform can claim victory.

6. A 24-month implementation sequence

First 100 days: choose the journeys that matter

Select five to ten high-volume or economically decisive approval journeys across at least two levels of government. Establish a baseline using applicant observation, administrative data and staff interviews. Map every legal authority, hand-off, document, query and decision. Publish the baseline and appoint one senior owner with authority to convene participating departments.

Months 4–9: redesign law and process together

Classify risks, remove requirements without a current legal or policy basis, consolidate evidence, define a common data model and draft the legal amendments needed for notification, perpetual validity, concurrent review, silence rules and graduated enforcement. Build prototypes with actual applicants and officials. The process should not be handed to a software vendor before the legal decision model exists.

Months 10–15: pilot with observable controls

Run the redesigned journey in selected districts or sectors. Measure completion, time, queries, user effort, error, appeal and regulated outcomes. Maintain a manual fallback and an incident process. Publish known limitations. A pilot should test both service quality and whether risk controls work; speed without compliance quality is not success.

Months 16–24: scale, audit and sunset

Scale only after independent evaluation. Require departments to explain material deviations from the common architecture. Introduce a statutory or policy sunset review so the approval must periodically justify its continued existence. Use complaint, appeal and inspection data to refine the decision rule. The institutional product is not a portal launch; it is a cycle through which the state learns whether intervention remains necessary and effective.

Conclusion: administrative permission should be exceptional

The License Raj showed how controls adopted in the name of development could allocate economic opportunity through political and bureaucratic permission. The reforms of 1991 demonstrated the gains from dismantling those controls, while later research showed that complementary institutions shaped the distribution of those gains. The modern task is to apply that learning across thousands of smaller administrative interactions.

India is already moving from criminalisation and recurring permission toward trust, digital service and proportionate enforcement. The direction is right. But the legitimacy of the new model will depend on details: whether rules are intelligible, data are reused lawfully, algorithms remain reviewable, deadlines bind the administration, appeals work and high-risk misconduct is still detected and punished.

A capable state does not maximise the number of acts for which citizens need approval. It identifies serious risks, writes clear rules, makes compliance easy, detects deception and remedies harm. That architecture supports both liberty and public purpose. It also releases entrepreneurial and administrative capacity for problems that forms and files were never solving.