Digital Lending Onboarding: How to Vet Your Vendors

Most lending onboarding stacks look fine in a demo and wobble at 3,000 applications a month. The KYC step returns a 'refer' code nobody can explain, the bureau gets pulled twice on the same application, the underwriting engine quietly routes everything to manual review, and your ops team becomes the integration layer. If you run product, risk or operations at an NBFC, a fintech, or a B2B platform extending credit to its own customers, this is the layer that decides your unit economics.

Where onboarding actually stalls

Onboarding is three systems wearing one coat: identity, credit, decision. They fail differently.

• KYC. PAN verification, Aadhaar offline XML, CKYC fetch, V-CIP video, penny-drop bank verification, liveness. Failures are usually mismatch problems — a name that doesn't match between PAN and the bank record, a CKYC entry with a stale address, a video call dropped at the 80% mark. Ask which checks the vendor runs natively and which are routed to a sub-vendor you have never contracted with.
• Bureau. The pull is the easy part: consent artifact, soft versus hard inquiry, score versus full report, refresh policy. The hard part is what you store, for how long, and what happens when an application is revisited 90 days later.
• Underwriting. Policy rules, bureau-to-decision latency, deviation tracking, override authority. If the rule engine can't version policies, you cannot explain to an auditor why a loan was approved in March and rejected in April on identical data.

Ask about the plumbing, not the feature list

Vendor feature checklists are nearly identical. The differences live in the API and the incident log.

• Can we see a full request and response for a V-CIP session, including every error code and what triggers it?
• Do you use an idempotency key on bureau pulls? What happens if our system retries after a timeout?
• Do you push webhooks or do we poll? What's your p95 latency from submission to decision?
• Is the sandbox mocked, or does it hit a real sandbox bureau? Can we test deliberately bad data — expired PAN, closed account, thin file?
• What was your uptime over the last four quarters, and what SLA credit applies when you miss it?
• When you change a scorecard or a rule, how much notice do we get, and can we pin a version?
• If we leave, can we export every application, document and decision log in a usable format?

A vendor who can't answer these in writing within a week will cost you two months during implementation. That's the cheapest signal you'll get.

The numbers you should model before signing

Take a lending platform doing 8,000 applications a month, approving roughly one in five.

A bureau pull at ₹12 per application is about ₹96,000 a month if you pull on everyone. Pull hard bureau at pre-qualification rather than only on the 3,000 that reach underwriting and that line roughly doubles. Penny drop typically costs ₹1-3 per verification. V-CIP runs ₹15-40 per completed session depending on volume and whether a human reviews the recording. CKYC fetch and PAN validation add a few rupees each. Expect a platform fee of ₹50,000 to ₹1.5 lakh a month at this volume, sometimes waived against a committed minimum.

Then add operations. If a manual review takes six minutes and a loaded analyst hour costs ₹200, that's roughly ₹20 per case. Route 2,000 applications a month to manual review and you have spent ₹40,000 and added a day to your turnaround.

A vendor quoting '₹4 per KYC check' is usually quoting one check. Read the line items, and ask what happens to the price when volume halves in a slow quarter.

Compliance questions vendors tend to dodge

• Are you a Lending Service Provider or a plain technology vendor? Who is the regulated entity here, and does the contract reflect RBI's Digital Lending Guidelines?
• Where is borrower data stored and processed? Can you contractually commit to India-only storage?
• What consent artifact do you capture, and can you reproduce it for one borrower three years later?
• Under the DPDP Act, who is the Data Fiduciary and who is the Data Processor? What's your breach notification timeline to us?
• Do you retain raw biometric data from V-CIP, or only the derived verification result?
• Are all sub-processors listed, and do we get advance notice before you add one?

If any of these get a verbal answer instead of a clause, treat it as a no.

Where to start

Pick your 20 highest-volume failure cases — the ones eating your ops team's week — and ask each shortlisted vendor to walk through exactly how their system handles them. Price the survivors against a 12-month volume forecast with 40% headroom, and read the exit terms before you negotiate the discount. In our experience that exercise collapses four vendors into one, usually the one with the least impressive deck.

We build onboarding, underwriting and operations dashboards for lenders and B2B platforms at Maysan Labs, and a fair amount of that work starts with a vendor teardown like this. If you're mid-evaluation, send us the questions you're stuck on — we'll tell you what we'd ask.