Technology and IT compliance for NBFCs and fintechs
Systems built to run a lending business, and audited to stand up to the RBI.
Financial services carry a double load: the same pressure to grow as any business, plus regulators who expect board-level IT oversight, tested disaster recovery, controlled access and well-managed vendors. Orgits works on both sides. We build and connect the systems lenders and fintechs run on, and we audit IT against the RBI's Master Direction on IT governance.
What's different about technology for lenders
RBI IT governance (Master Direction, in force since 1 April 2024, for NBFCs in the Middle, Upper and Top Layers)
- What it means in practice
- IT Strategy Committee oversight, annual policy reviews, a CISO independent of IT, tested DR, VA/PT cadence, a risk-based IS audit
RBI IT outsourcing (Master Direction, effective 1 October 2023)
- What it means in practice
- Due diligence on material IT vendors, contracts with audit rights and exit clauses, data stored in India
Audit trails
- What it means in practice
- Who changed a loan record, a rate or a limit, and when, recorded and reviewable
Maker-checker
- What it means in practice
- A second person approves sanctions, disbursements and master-data changes
Customer data protection
- What it means in practice
- Least-privilege access, encryption and logging around borrower data, with the DPDP Rules phasing in through May 2027
| Requirement | What it means in practice |
|---|---|
| RBI IT governance (Master Direction, in force since 1 April 2024, for NBFCs in the Middle, Upper and Top Layers) | IT Strategy Committee oversight, annual policy reviews, a CISO independent of IT, tested DR, VA/PT cadence, a risk-based IS audit |
| RBI IT outsourcing (Master Direction, effective 1 October 2023) | Due diligence on material IT vendors, contracts with audit rights and exit clauses, data stored in India |
| Audit trails | Who changed a loan record, a rate or a limit, and when, recorded and reviewable |
| Maker-checker | A second person approves sanctions, disbursements and master-data changes |
| Customer data protection | Least-privilege access, encryption and logging around borrower data, with the DPDP Rules phasing in through May 2027 |
What we do for financial services
IS audit and IT compliance
A review of IT governance, access, security, BCP/DR and vendors against the RBI Master Direction, with a findings register for your Audit Committee and help to close technical findings. See IS audit · Download the NBFC IS audit checklist
Lending and investment platforms
Loan origination workflows, customer portals, document collection, and investment and exchange platforms with role-based access and audit logging designed in. See custom software
CRM for loan sourcing and collections
Zoho CRM configured for lead sourcing from branches, DSAs and digital channels, with stage-gated applications, document checklists, follow-ups and collection reminders. See Zoho CRM
Payments and accounting
Razorpay collections connected to Zoho Books, and GST-ready accounting with reconciliation discipline. See Zoho Books
Secure hosting
Cloud infrastructure with data in India, MFA for administrators, logging, tested backups and DR documentation. See cloud and DevOps
Guides for financial services
- RBI IT governance for NBFCs: the complete IS audit guide
- The IT Strategy Committee: what the RBI expects
- BCP and DR testing for NBFCs
- IT outsourcing and vendor risk for NBFCs
This is general information, not legal, tax or audit advice. Requirements change. Check the current text of the regulation and speak to your adviser before acting.
Frequently asked questions
[1]Do you work with Base Layer NBFCs?
Yes. The IT governance Master Direction applies to the Middle, Upper and Top Layers, but many Base Layer NBFCs adopt its practices voluntarily, and their lending partners often ask for evidence of IT controls.
[2]Can the same team build our system and audit it?
We can do both for you, but not on the same system without telling your Audit Committee. Where we've built or run a system in scope, we say so, so you can decide whether a separate auditor should cover it.
[3]Do you build loan management systems from scratch?
We build custom lending workflows and portals, and integrate with established loan management systems where that's the better choice. We'll recommend after understanding your products and volumes.
Let's build something that works.
Tell us what you're trying to fix. The first consultation is free.