Every founder who walks into Speqto with a lending idea asks the same question first: “How long will the tech take?” Wrong question. The real bottleneck is almost never code — it’s the regulatory maze around it. We learned this the hard way while building the loan stack for a Pune-based NBFC that wanted to launch a personal loan product in eight weeks. The APIs were ready in six. The RBI-compliant data flow, FLDG documentation, and digital lending disclosures took eleven more. That gap is the entire story of lending tech in India.
Start With the Regulatory Skeleton, Not the Screens
RBI’s Digital Lending Guidelines (September 2022) changed the game permanently. If you’re building anything loan-adjacent in 2024, these are non-negotiable:
- Direct disbursement and repayment: Money must flow directly between the borrower’s bank account and the Regulated Entity (RE) — no pass-through accounts of the Lending Service Provider (LSP). We’ve had clients try to route funds through an escrow wallet for “better UX tracking”; RBI doesn’t permit it anymore.
- Key Fact Statement (KFS): APR, all-in cost, and recovery mechanism must be shown before loan execution, in a standardized format. This isn’t a T&C page buried in a footer — it needs its own screen with explicit consent capture.
- Cooling-off period: Borrowers must be able to exit the loan within a specified window by paying principal plus proportionate APR, without penalty. Your LMS (Loan Management System) needs to handle this as a first-class workflow, not an edge case.
- FLDG caps: First Loss Default Guarantee arrangements between REs and LSPs are capped at 5% of the loan pool. For a fintech client of ours partnering with two NBFCs, this meant rebuilding their risk-sharing model mid-project because their original term sheet assumed 10%.
Separately, if you’re not an NBFC or bank yourself, you’ll operate as an LSP under a co-lending or sourcing arrangement. RBI’s Co-Lending Model (2020 circular) requires the originating bank/NBFC to retain a minimum 20% of the loan on its own books. Your tech architecture has to support split disbursement and dual bureau reporting from day one — retrofitting this later is painful and we’ve seen a client lose three months doing exactly that.
The Core Tech Stack: What Actually Needs Building
Strip away the marketing language and a lending platform is five systems talking to each other:
- Loan Origination System (LOS): Application capture, KYC, eligibility rules, document upload. Integrate CKYC (Central KYC Registry) and Aadhaar-based e-KYC via UIDAI’s authorized channels — don’t build your own OCR for PAN/Aadhaar when NSDL and DigiLocker APIs already solve this reliably.
- Underwriting engine: Pulls bureau data (CIBIL, Experian, CRIF High Mark, Equifax), bank statement analysis (via Account Aggregator framework — Sahamati-enabled AA apps like Finvu or OneMoney), and alternative data if you’re doing thin-file lending. For one of our digital lending clients, switching from screen-scraping bank statements to AA-based consent flows cut fraud flags by nearly 40% and sped up approvals from 2 days to under 4 hours.
- Loan Management System (LMS): Repayment schedules, NACH/eNACH mandate management, penal charges (RBI’s April 2024 circular standardized these as simple interest on overdue amount only — compound penal interest is now banned), and the cooling-off logic mentioned earlier.
- Collections and recovery: UPI AutoPay for EMIs, NACH for bulk debits, and a dunning workflow that respects RBI’s fair practices code — no calling borrowers before 8 AM or after 7 PM, and no third-party recovery agents without proper authorization letters.
- Reporting layer: Automated bureau reporting (monthly to all four bureaus), RBI regulatory reporting, and audit trails for every consent captured. This is where most platforms we inherit from other vendors are weakest — consent logs exist, but they’re not tamper-evident or easily exportable for an RBI audit.
Data Localization and the DPDP Act
RBI’s data localization mandate requires payment and loan data to be stored exclusively in India. Combine this with the Digital Personal Data Protection Act, 2023, and you need: explicit, purpose-limited consent for every data point collected, a documented data retention policy, and breach notification workflows. We default clients to AWS Mumbai or Microsoft Azure’s Pune/Chennai regions, with a documented data residency certificate — auditors ask for this specifically now, not just “where is your server.”
Where Projects Actually Go Wrong
In our experience, the failures aren’t technical bugs — they’re sequencing mistakes. Teams build the slick mobile UX first and treat KFS disclosures, cooling-off logic, and bureau reporting as “compliance tasks for later.” Later always arrives two weeks before launch, under pressure, with no time to test properly. The platforms that launch cleanly are the ones where legal and engineering map the regulatory requirements into user stories before a single screen is designed.
A Realistic Build Timeline
For a mid-sized NBFC launching a new unsecured lending product with AA integration, bureau connectivity, and co-lending support, budget 4-5 months for a production-grade MVP, not the 6-8 weeks most sales decks promise. Compress the regulatory mapping phase and you’ll either fail an RBI inspection or rebuild core modules post-launch — both cost more than the extra month upfront.
At Speqto, we’ve built lending stacks for NBFCs, co-lending fintechs, and embedded finance players across this exact set of constraints. If you’re scoping a platform and want a straight answer on what’s genuinely feasible in your timeline, that’s a conversation worth having before you sign off on a roadmap.
