A borrower app that asks only for the phone permissions you can justify, KYC through licensed providers, bank data by Account Aggregator consent, a Key Fact Statement with the APR before anyone signs, money that moves only between the borrower and the lender, and a back office where credit, operations, collections and compliance each see what their role needs. Built for NBFCs, small finance and co-operative lenders, leasing companies, LSPs that partner with regulated lenders, and advisory firms in Mumbai, Navi Mumbai, Pune and across India.
Reply within one business day · Navi Mumbai team · Website, app and admin under one roof
The borrower’s phone, the lender’s credit desk and the collection team working from one loan record, one consent log and one audit trail.
A product website that explains each loan plainly and shows who the lender is, with a portal for applicants and existing borrowers.
An Android and iPhone app to apply, sign, track and repay, built to ask only for the permissions each step needs.
The panel where credit, operations, collections and compliance teams work, each seeing only what their role allows.
Most of the lenders who call us are not large banks. They are NBFCs with a small or mid-size loan book, a leasing company that has run on Excel and Tally for twenty years, a co-operative credit society that wants an app for members, or a startup acting as a lending service provider for one or two regulated partners. Their day looks similar: leads from DSAs and WhatsApp, documents scanned and emailed, a credit analyst copying bureau and bank data into a spreadsheet, a sanction letter made in Word, and an operations team that sets up mandates and disbursals by hand.
Applicants drop off when asked to scan six months of statements. A credit decision takes three days because two people must re-key the same data. A borrower later says nobody told him about the processing fee, and there is no record of what he saw or when. An EMI bounces and the collection team learns about it a week late. A staff member who left months ago still has a login with full access to Aadhaar copies. None of these is visible in the loan management system until an auditor or the RBI asks.
The RBI’s Digital Lending Directions of May 2025 replaced the 2022 guidelines, and require a Key Fact Statement with the APR before disbursal, a cooling-off period in which the borrower can exit, money that moves only between the borrower’s and the lender’s accounts, data stored in India, and every digital lending app reported to the RBI. In November 2025 the RBI also issued function-wise master directions that consolidated thousands of older circulars, and the DPDP Rules 2025 were notified the same month. Software built three years ago may now be out of step.
Infoways, a web, app and software company in Mahape, Navi Mumbai, builds loan apps, borrower portals, loan origination and servicing back offices, collection apps and CRMs for lending and leasing businesses. Our leasing CRM case study shows the kind of back-office work we do. Below is how each module works, the rules it must respect, and an honest comparison with the lending platforms many lenders already license.
Talk to us about your fintech businessEight modules, who works on each screen, and the edge cases that decide whether an audit goes smoothly.
Used by applicants and borrowers. The app shows the regulated lender’s name on every screen, and where an LSP works with several lenders, which lender is offering the loan. It asks only for the phone permissions each step needs, at the moment it needs them, and never for contacts, call logs or media files. Each consent is recorded with its purpose and time. The borrower can see their application, KFS, agreement, schedule, receipts and complaints, and can withdraw consent or ask for their data to be deleted where the rules allow.
Solved in your appUsed by the operations team and applicants. PAN is verified, Aadhaar-based KYC runs only through licensed KYC providers, documents can be fetched from DigiLocker with consent, and existing records can be pulled from the Central KYC Records Registry with the customer’s KYC identifier. Where your policy allows video KYC, the call, location check and officer’s decision are recorded. New KYC records are uploaded to CKYC as the KYC directions require. Aadhaar numbers are masked on every screen, and full documents are visible only to named roles.
Solved in your appUsed by the credit team. Instead of uploading statements, the applicant approves a consent request through an Account Aggregator, and the lender, as a Financial Information User, receives the bank data for the period and purpose shown. The consent artefact and its expiry are stored against the application. The bureau report is pulled with consent. The system reads monthly credits, existing EMIs, bounces and cash withdrawals, and feeds them to the rules engine. Statement upload stays as a fallback for banks or customers not yet on the network.
Solved in your appUsed by credit managers. Your credit policy is written as rules, not code: age, income, FOIR, bureau score bands, existing obligations, location, sector and ticket size. Clear approvals and rejections go through at once; edge cases go to a credit officer with the reasons shown. Deviations need an approver at the right level, and each one is logged with who approved it and why. Policy changes are versioned with a start date, so you can always show which rules applied to a loan on the day it was sanctioned.
Solved in your appUsed by operations, and seen by every borrower. On sanction, the system builds the Key Fact Statement from the approved terms: amount, tenor, interest rate, all fees and charges, third-party charges, the APR worked out from them, the repayment schedule, the cooling-off period, the recovery process and grievance contacts. The borrower must open and accept it before e-signing the agreement, and the time is stored. Charges not in the KFS cannot be added later without fresh consent. During the cooling-off period, an exit button shows exactly what must be repaid.
Solved in your appUsed by operations and finance. Disbursal goes directly from the lender’s account to the borrower’s, never through an LSP’s or a third party’s pool account, as the directions require. Repayment is set up by eNACH mandate or UPI AutoPay, with UPI and net banking for part payments and foreclosure. Mandate registration, presentation and bounce codes update daily. Receipts go out at once on email and WhatsApp. Foreclosure and part payment amounts follow your policy and the KFS, and every adjustment is logged with who made it.
Solved in your appUsed by the collection team and field agents. Reminders go out before the due date, not after. Accounts move into DPD buckets automatically, and each bucket has its own workflow: calls, payment links, field visits and settlement requests. Field agents use an app that logs each visit with time and location, records the borrower’s response and accepts payment through a link, not cash in hand where you can avoid it. Calling hours and scripts follow your Fair Practices Code, and the names of recovery agents are shared with borrowers as your policy requires.
Solved in your appUsed by the compliance officer and auditors. Every complaint gets a ticket and the grievance officer sees time limits; a complaint not resolved within 30 days can be taken by the borrower to the RBI’s complaint system, so the ticket shows that path. A register lists every app and LSP you work with, ready for reporting to the RBI’s CIMS portal. Access is by role, with masking, encryption, data retention rules and logs of who saw or exported what, which the DPDP Act 2023 and the directions both expect.
Solved in your appTell us your product, whether you are the lender or an LSP, and what software you run today. We will list the gaps to close first.
These apply to RBI-regulated lenders and the service providers they work with. Co-operative lenders, advisors and distributors have their own regulators and rules.
| Term or rule | 1What it means | 2How the software handles it |
|---|---|---|
| RBI (Digital Lending) Directions 2025 | Issued on 8 May 2025 for banks and NBFCs, replacing the 2022 digital lending guidelines and the 2023 default loss guarantee guidelines. The multi-lender LSP provisions took effect on 1 November 2025. | Lender, LSP and app details, consent, KFS, cooling-off, data storage and grievance flows are built as the directions describe, and checked with your compliance team. |
| Regulated entity, LSP and DLA | The regulated entity (RE) is the bank or NBFC that lends. A lending service provider (LSP) acts as its agent for sourcing, servicing or recovery. A digital lending app (DLA) is the app or platform the borrower uses. | Every screen and document names the RE. An LSP app working with several lenders shows each matching offer with the lender’s name, as the multi-lender provisions expect. |
| Key Fact Statement and APR | From 1 October 2024, all retail and MSME term loans need a KFS in a set format, with the APR covering interest and all charges. Charges not in the KFS cannot be levied without the borrower’s explicit consent. | KFS built from sanctioned terms, APR worked out by the system, acceptance time-stamped, and fee changes blocked unless fresh consent is recorded. |
| Cooling-off period | A period, set by the lender’s board and not less than one day under the directions as reported, in which the borrower can exit by repaying the principal and proportionate APR without penalty. A processing fee disclosed in the KFS may be kept. | The cooling-off end date shows on the KFS and in the app, with an exit button that works out what is due. Exits are logged and closed cleanly. |
| Flow of funds | Disbursals and repayments must go directly between the borrower’s bank account and the RE’s, with no pass-through or pool account of an LSP or third party. | Payment and disbursal flows run only through the RE’s accounts and its payment providers. LSP access is limited to status, never to funds. |
| Data, consent and phone access | Data is to be collected with the borrower’s consent for a stated need, stored on servers in India, and phone resources such as contacts, files and call logs avoided. The DPDP Act 2023 and the DPDP Rules notified in November 2025 add duties on notice, consent and security, phased in over 12-18 months. | Purpose-wise consent screens, Indian hosting, no contact or call-log permissions, retention rules, and a consent and access log per borrower. |
| Reporting apps to the RBI | REs had to report every DLA, their own and their LSPs’, on the RBI’s CIMS portal from 15 June 2025, so the RBI can publish a list borrowers can check. | A register of apps, LSPs and their details is kept up to date in the admin, ready for your compliance officer to report. |
| Credit limit increases and default loss guarantee | No automatic increase in credit limit without the borrower’s explicit consent. Default loss guarantee from an LSP is capped at 5% of the portfolio, as reported. | Limit increases need a fresh consent step in the app. DLG arrangements and portfolio cover are tracked for finance and compliance. |
| Account Aggregator | RBI-regulated Account Aggregators carry the customer’s financial data from the bank (FIP) to the lender (FIU) under a digital consent artefact with a purpose, period and expiry, which the customer can revoke. | Consent requests and artefacts are stored with each application, data is used only for the stated purpose, and revocations stop further fetches. |
| Grievances and complaints | Lenders and LSPs must name a grievance officer and publish contact details. A complaint not resolved within 30 days can be escalated by the borrower to the RBI’s complaint management system. | Grievance officer details in the app, website and KFS, a ticket for every complaint, and time limits shown on the compliance dashboard. |
We have summarised these from RBI notifications and from law-firm and press summaries of them. The RBI consolidated many directions in November 2025, and rules keep changing. Your compliance officer, legal counsel and statutory auditor decide how they apply to your entity. We build what they approve; we do not give legal or regulatory advice.
Most lenders are choosing between three paths. The first is to license an established loan origination and management platform from Indian vendors such as Nucleus Software, Pennant, Lentra or Finflux, often with ready links to bureaus, KYC providers and Account Aggregators. The second is to build on an open-source core such as Apache Fineract and customise it. The third is a custom build, often a borrower app and origination layer on top of an existing loan management system.
For a mid-size NBFC with standard products and a strong IT team, a licensed platform is often the right answer, and we will say so. It brings tested loan accounting, interest and NPA logic, and the vendor tracks regulatory change for you. Before you sign, check how quickly the vendor updates for new RBI directions, whether you can change KFS formats and rules yourself, where data is hosted, and how you get all your data back if you leave.
A custom build makes sense when the borrower journey is your edge, when you are an LSP that must present several lenders’ offers fairly, when your product is unusual (equipment leasing, supply chain finance, gold loans, co-operative member loans), or when your existing loan system is sound but has no app, no AA link and no audit trail. Our guide on custom software vs off-the-shelf covers the trade-off, and CRM development covers lead and DSA management.
A plain comparison. The right answer depends on your product, your volumes, your IT team and whether you lend or source for others.
| Factor | 1Excel, Tally and email | 2Licensed loan platform | 3Custom app and origination layer |
|---|---|---|---|
| Best for | Very small books with manual lending | Mid-size and large NBFCs with standard products | LSPs, niche products and lenders adding an app to an existing system |
| KFS and APR | Made by hand in Word | Built in; check how easily formats change | Generated from your exact terms and policy |
| Account Aggregator and eKYC | Not available | Often built in through partners | Connected to the providers you choose |
| Multi-lender LSP display | Not applicable | Depends on the vendor | Designed for it from day one |
| Audit trail and consent log | Scattered emails | Vendor’s standard logs | Logs shaped to your auditor’s questions |
| Speed of rule changes | Fast but unreliable | On the vendor’s release cycle | On your own release cycle |
| Time to start | Already running | Typically months, with configuration | Weeks to months, in phases |
Vendor names are given only to help you compare. Their features change often, so check each one’s current offering directly.
Each one comes from the loan, consent and collection records. None needs a separate data team.
Started, KYC done, bank data shared, sanctioned, KFS accepted and disbursed, as counts and as a share of the step before. The biggest drop shows where to fix the journey first. It is usually the bank data step or document upload.
Solved in your appMedian hours from application to decision, decision to sanction and sanction to disbursal, split by auto and manual cases. Manual cases that take days point to a rule that needs rewriting or a team that needs another officer.
Solved in your appShare of applications decided by rules without a human, and share of sanctions with a deviation. A rising deviation rate means either the policy no longer fits the market or it is being bent; both need a credit committee discussion.
Solved in your appLoans exited within the cooling-off period divided by loans disbursed, by product and source. A high rate from one DSA or campaign often means borrowers were misled about terms. It is an early warning, not only a number.
Solved in your appLoans whose first EMI presentation failed divided by loans due for a first EMI. This is the earliest sign of bad sourcing or mandate set-up problems, months before DPD buckets show it.
Solved in your appShare of accounts moving from one DPD bucket to the next each month: current to 1-30, 1-30 to 31-60 and so on. Roll rates show where collection effort works, and where it is too late.
Solved in your appComplaints received per thousand active loans, by type, with the count open beyond your internal limit and beyond 30 days. Complaints about charges or recovery behaviour need the compliance officer’s attention first.
Solved in your appData exports, full-document views and access changes outside normal roles, per week. A short list reviewed every week is far better than a long one found in an audit.
Solved in your appSay you are an NBFC in Navi Mumbai lending working capital to shop owners through an app and a team of field sales officers. The figures and names here are only to show the flow. A kirana owner in Ghansoli downloads the app after a visit from your officer. The app shows your NBFC’s name, asks for his mobile number and PAN, and runs KYC through a licensed provider. His existing KYC record is fetched from CKYC with his consent. The app asks for location only for the address check, and never for contacts.
Instead of uploading statements, he approves an Account Aggregator consent for twelve months of his current account data. Your rules engine reads monthly credits, existing EMIs and bounces, pulls his bureau report and checks your policy. He clears the rules on most points but his FOIR is just over your limit, so the case goes to a credit officer, who approves a slightly smaller amount as a logged deviation with a reason.
The app shows him the Key Fact Statement: amount, tenor, interest rate, processing fee, insurance premium collected for a third party, the APR, the EMI schedule, the cooling-off period and the grievance officer’s contact. He opens it, accepts, e-signs the agreement and sets up UPI AutoPay. The money goes from your account straight to his. The next day he decides he no longer needs the loan; he taps the cooling-off exit, sees the principal and proportionate APR due, pays by UPI, and the loan closes with a receipt.
His neighbour, who borrowed on the same day, keeps the loan. A reminder goes out three days before each EMI. When one presentation bounces, the account moves to the first bucket, a payment link goes out, and the collection officer calls within your permitted hours. On Monday the credit head sees the funnel, turnaround times, deviation rate, cooling-off exits and first EMI bounces, and compliance sees complaints and access exceptions, all from the same records the auditor will see.
We sit with credit, operations, collections and compliance to write down the product, credit policy, fees, KFS format, cooling-off period, collection process and grievance flow. Your compliance officer and counsel sign off the regulatory points before we build.
You select KYC, bureau, Account Aggregator, e-sign, mandate and payment partners, and complete their onboarding in your entity’s name. We prepare the integration plan and test accounts.
One complete journey first: apply, KYC, bank data, decision, KFS, sign, disburse and first EMI, on one product. The back office, collections and reports follow. You see a working build every two weeks, and Flutter keeps Android and iPhone on one codebase.
Existing borrowers, loans, schedules and mandates are migrated from your current system and reconciled loan by loan with finance. An independent security test and your IT and information security review run before launch, as your policies require.
Field officers, credit and collections teams are trained in English, Hindi or Marathi as needed. A pilot with a limited number of borrowers runs before the app is opened widely, and every KFS, cooling-off exit and complaint is checked by compliance.
The app and LSP details are updated in the RBI’s CIMS portal by your compliance officer, the website shows lender, LSP and grievance details, and the app goes to the Play Store and App Store with the declarations they ask of lending apps.
Maintenance and support continues after launch, including updates when the RBI changes directions, when partners change their APIs, and when your credit policy moves.
Send us your current journey and the platform you are considering. We will tell you honestly whether to license, build or connect.
Every lender’s product and policy is different, so we quote after understanding yours. A product website with lead capture, consent and a DSA-facing CRM is a small project. A borrower app and origination layer for one product, with KYC, Account Aggregator, bureau, rules engine, KFS, e-sign, mandates and a back office, is a medium one. A full stack for several products, with servicing, collections and a field app, multi-lender LSP display, migration from an old system and detailed compliance reporting, is a large one.
The cost rises with the number of products and how different their rules are, the number of partners to connect, the depth of loan accounting needed if you are not keeping an existing loan management system, migration volume and quality, and your security testing and audit requirements. It falls if you keep a sound loan management system and build the borrower app, origination and audit layers around it, and if partners are chosen early.
Timelines: a website, consent and CRM layer usually takes 6-8 weeks. A single-product borrower app and origination back office takes about 3-4 months including partner onboarding and security testing. A full multi-product stack runs about 6-9 months in phases. See custom software development and SaaS development if you plan to offer the platform to other lenders.
Do not build first and ask compliance later. The KFS format, cooling-off rules, flow of funds and consent screens shape the whole journey. Get them signed off on paper before the first screen is designed, or you will rebuild half the app.
Do not ask for phone permissions you cannot justify. Contacts, call logs and media access are exactly what the directions warn against, and app stores check lending apps closely. An app that asks for less is also trusted more by borrowers.
Do not let an LSP or a vendor touch the money. Disbursals and repayments go through the lender’s accounts only. Any design where funds pass through a third party’s account should be stopped at the drawing stage.
And do not build a custom origination stack if you lend a few dozen loans a month through branches and a licensed platform already fits. A cleaner website, a DSA CRM and a borrower portal on top of your existing system will do more for you first.
Ask us on WhatsApp. A real person from our Navi Mumbai team replies.
Ask on WhatsAppLending is regulated. A company that is not a bank or NBFC can act only as a lending service provider for a regulated lender, under that lender’s agreement and the RBI’s digital lending directions. The lender stays responsible for the loan. Ask your legal counsel before you design the product.
They were issued on 8 May 2025 for banks and NBFCs and replaced the 2022 digital lending guidelines and the 2023 default loss guarantee guidelines. They cover the KFS, cooling-off period, flow of funds, data and consent, LSP arrangements including several lenders, reporting of apps to the RBI and grievance redressal.
Under the RBI’s KFS instructions, applicable to all retail and MSME term loans from 1 October 2024, it sets out the loan amount, tenor, interest rate, all fees and charges, the APR, the repayment schedule, recovery and grievance details and, for digital loans, the cooling-off period. Charges not in the KFS cannot be levied without the borrower’s explicit consent.
The annual percentage rate is the yearly cost of the loan including interest and all charges levied by the lender. The system works it out from the sanctioned terms and fee schedule, so the APR in the KFS always matches the loan record.
The borrower can exit a digital loan within a period set by the lender’s board, not less than one day under the directions as reported, by repaying the principal and proportionate APR without penalty. A processing fee disclosed in the KFS may be retained. The app shows the end date and an exit button with the amount due.
The directions expect lenders and LSPs to limit access to phone resources, and contact lists, call logs and media files are the clearest cases to avoid. We build apps that ask only for what each step needs, at that moment, with the purpose explained.
An Account Aggregator is an RBI-regulated entity that carries a customer’s financial data, such as bank statements, from the bank to the lender under a digital consent with a stated purpose and expiry. It replaces statement uploads, reduces fraud from edited PDFs and gives you a clear consent record.
Lenders can fetch an existing KYC record from the Central KYC Records Registry with the customer’s KYC identifier and consent, and must upload new KYC records there as the KYC directions require. Your compliance officer decides when a fresh KYC or video KYC is still needed.
No. The directions require disbursals and repayments to move directly between the borrower’s bank account and the regulated lender’s, with no pass-through or pool account of an LSP or third party. We design payment flows only through the lender’s accounts.
Regulated lenders had to report every digital lending app, their own and their LSPs’, on the RBI’s CIMS portal from 15 June 2025, and keep it updated. The admin keeps a register of apps and LSPs ready for your compliance officer.
For a mid-size NBFC with standard products, licensing an established platform is often the right choice. A custom build makes sense for LSPs showing several lenders, unusual products, or lenders who want an app and origination layer on top of an existing loan system.
Borrower names, PAN, Aadhaar details, bank data, bureau reports and repayment history are personal data under the DPDP Act 2023, and the DPDP Rules notified in November 2025 phase in duties on notice, consent and security over 12-18 months. We build purpose-wise consent, Indian hosting, masking, role-based access, retention rules and full access logs.
Yes. We build client portals and CRMs that show holdings or policies, send renewal and SIP reminders and log every recommendation. Advisors and distributors are regulated by SEBI, AMFI or IRDAI depending on what they do, so their compliance team should confirm what the software must record.
A website, consent and CRM layer usually takes 6-8 weeks. A single-product borrower app with origination back office takes about 3-4 months including partner onboarding and security testing. A full multi-product stack takes about 6-9 months in phases.
Talk to our Navi Mumbai team about your loan product, your partners and your current system. We will give you a clear plan, an honest view on licensed platforms, and a price.
Tell us what you want to achieve with your website, software, SEO or AI automation. We reply within one business day, usually the same day, with specific advice, at no cost and with no commitment.
We’ll go through what you send and get back to you within one business day, usually the same day.
Want a faster reply? WhatsApp us