Rebuilding an NBFC lending stack to survive an RBI inspection

Sahaj Credit is an RBI-registered NBFC writing small-ticket unsecured business loans — ₹50,000 to ₹5 lakh, twelve to twenty-four months, to kirana stores and small traders across five states. They came to us with a growth problem and left with a compliance rebuild, because the growth problem turned out to be a symptom.

The stack they had would not survive an inspection

The RBI's Digital Lending Guidelines are unambiguous on one point in particular: all loan disbursals and repayments must flow directly between the borrower's bank account and the regulated entity's bank account. No pass-through, no pooling in an account controlled by a lending service provider or a technology vendor.

Their existing vendor stack pooled collections in an intermediary account before sweeping them to the NBFC. It was convenient. It was also exactly the arrangement the guidelines exist to prohibit, and no amount of feature work on top of it would have made it acceptable.

And the operational numbers were bad on their own terms

• KYC turnaround was three days. Documents were emailed, a human eyeballed them, and a decision came back after the applicant had usually already borrowed from someone faster.
• 19% of NACH mandate registrations were failing, mostly on name and account-detail mismatches nobody validated before submission — and every failed mandate is a customer who must be collected from by hand, forever.
• Balances were a mutable column. There was a loans.outstanding field that code updated. When it disagreed with the bank — and it did — there was no way to determine which was wrong, because there was no history to replay. This is a category of bug that does not get debugged; it gets discovered by an auditor.
• Field collection agents issued paper receipts from a book. Cash reconciliation ran a week behind and depended on trust.

Migration ran a live book of 14,000 loans onto the new ledger over one weekend, reconciled to the rupee against the bank before the cutover was declared. We had rehearsed it three times against a production snapshot.

Results

• KYC turnaround: 3 days → 11 minutes (P50). The parallel orchestration is most of it; the rest is that automated checks now resolve 87% of applicants without a human ever looking. Humans look at the 13% where looking is worth something.
• Mandate success: 81% → 94.6%. Nearly all of that came from penny-drop verifying the bank account before submitting the mandate rather than after — a change of about two days of engineering that had been sitting there for two years.
• Reconciliation exceptions: 0.03% of postings, each with a named owner and an SLA. They now have a number for this. They previously had a feeling.
• Zero rupees in transit through a PRS-controlled account. There is no such account. This was the deliverable the board cared about, and it is the one we are proudest of, because it is the one that would have ended the company had it gone the other way.

What changed structurally

Their compliance officer can now answer a regulator's question about any loan in the book — every state, every transition, every posting, every consent — from a screen, in front of the person asking. Before this, that answer took a week and a spreadsheet, and it was an answer they hoped was true.

Field collection cost per ₹100 collected fell as the signed-receipt system removed the reconciliation lag and, with it, a category of leakage nobody had wanted to name out loud.