Credit underwriting is the process by which a lender decides whether to lend, how much, at what price and on what terms. In an Indian NBFC it is also the place where regulation, data, judgement and turnaround time collide. This guide lays out the end-to-end credit underwriting process as it is practised in 2026: from lead to KYC, bureau, income and bank statement analysis, verification, ratios, the credit appraisal memo (CAM), committee, sanction, disbursal and post-disbursement monitoring.
It is written for credit heads, underwriters, ops leaders and product teams at NBFCs, HFCs, small finance banks and fintech lenders who want a shared mental model of the flow, a checklist for each step, and a clear view of where automation genuinely helps. For the technology layer specifically, read automated credit underwriting software in India after this one.
Credit Underwriting in Indian NBFCs: The Shape of the Process
- 11 stages — From lead capture to post-disbursement monitoring in a typical NBFC flow
- 4 bureaus — CIBIL, Experian, Equifax and CRIF High Mark, all RBI-registered credit information companies
- 5 Cs — Character, Capacity, Capital, Collateral, Conditions: still the backbone of every credit policy
- Minutes to weeks — TAT range across products, from digital personal loans to secured MSME term loans
- FOIR, DSCR, DBR, LTV — The four ratios that appear in almost every CAM
- Policy + judgement — Rule engines handle the policy; underwriters handle the exceptions
Underwriting vs Credit Appraisal: Are They the Same Thing?
In Indian lending vocabulary the two terms overlap heavily, but they are not identical. Credit appraisal is the analytical work: assessing the borrower's ability and willingness to repay, evaluating the purpose, the security and the structure of the loan. Credit underwriting is the broader decision process that wraps around appraisal: applying policy, pricing the risk, deciding the terms, documenting the rationale and taking the case through the approval hierarchy.
In practice, a credit analyst "appraises" the case and writes the CAM; the sanctioning authority "underwrites" it by approving, modifying or declining. The distinction matters for workflow design: appraisal can be heavily automated, while the decision on non-standard cases still needs an accountable human.
The 5 Cs of Credit in the Indian Context
Character: willingness to repay
Bureau history (DPD, write-offs, settlements, enquiries), GST filing discipline, litigation and CERSAI checks, promoter background, and reference checks through CPV and field investigation. For thin-file borrowers, GST punctuality and utility payments stand in for bureau history.
Capacity: ability to repay
Salary slips, Form 16 and ITR for individuals; GST returns, bank statements, audited or provisional financials for businesses. The output is a surplus or cash-flow figure that feeds FOIR or DSCR.
Capital: skin in the game
Net worth, promoter contribution, margin money, and in MSME cases the ratio of own funds to total borrowings. Highly leveraged balance sheets with thin equity are a classic early warning.
Collateral: what secures the loan
Property, vehicle, gold, receivables, FD or shares. Valuation, legal title search, encumbrance checks and CERSAI registration determine the loan-to-value (LTV). For unsecured products this C is replaced by stricter capacity and character thresholds.
Conditions: purpose, sector and macro
End use of funds, industry outlook, seasonality, geographic risk, regulatory exposure and concentration against the lender's own portfolio limits. This is where sector caps and negative lists in the credit policy bite.
The End-to-End Credit Underwriting Flow
The sequence below is the common denominator across retail, MSME and small-ticket secured lending. Products differ in the depth of each step, not in the order.
1. Lead and application capture
The application enters through a branch, DSA, partner platform or digital journey and is created in the loan origination system (LOS) with product, amount, tenure and purpose. Dedupe against existing customers and blacklists happens here, as does the first policy filter: age, geography, product eligibility and minimum income.
2. KYC and CKYC
Identity and address are established per the RBI's KYC Master Direction: Aadhaar-based e-KYC or offline verification, PAN validation, a CKYC search and download where a record exists, video KYC where permitted, and officially valid documents otherwise. For entities, KYC extends to the business (GSTIN, Udyam, incorporation documents) and to beneficial owners. Cross-document consistency of name, date of birth and address is checked here, usually by OCR and rules.
3. Bureau pull
A credit report is fetched from one or more of the four credit information companies: CIBIL (TransUnion), Experian, Equifax and CRIF High Mark. Underwriters look beyond the score at the trade lines: outstanding and overdue amounts, days-past-due history over 24 to 36 months, settled or written-off accounts, recent enquiries and the number of active unsecured loans. For MSMEs, commercial reports on the entity and consumer reports on the promoters are both pulled.
4. Income, GST and bank statement analysis (BSA)
This is the capacity engine. For salaried borrowers it is salary credits and Form 16. For businesses, three sources are triangulated: GST returns (GSTR-1, GSTR-3B) for declared turnover and filing discipline, ITR and financials for profitability, and bank statement analysis for what actually moved through the account. BSA, increasingly via Account Aggregator, surfaces average balance, credit summation, bounces, existing EMI debits, cash deposits and circular transactions. Divergence between GST turnover and banking credits is one of the most useful over-statement signals; see AI credit scoring with GST data and bank statement analysis for MSME underwriting.
5. CPV and field investigation
Contact Point Verification confirms the applicant can be found at the stated residence and workplace. Field investigation goes further for secured and higher-ticket cases, assessing the business, premises, stock and local standing; tele-verification of employer and references often runs in parallel (see CPV vs FI vs tele-verification). Modern lenders trigger these from the LOS and get geo-tagged, time-stamped reports back into the file; the economics of agencies versus platforms are covered in CPV agency vs digital CPV platform.
6. Financial ratios: FOIR, DSCR, DBR, LTV
- FOIR (Fixed Obligation to Income Ratio): All fixed monthly obligations including the proposed EMI divided by net monthly income. Retail policies typically cap FOIR in a band that rises with income; it is the primary retail affordability gate
- DSCR (Debt Service Coverage Ratio): Cash available for debt service divided by total debt service for the period. Used for business and term loans; policies typically require a minimum above 1.0x with a cushion
- DBR (Debt Burden Ratio): Often used interchangeably with FOIR; some lenders define it on gross rather than net income. Clarify which your policy means
- LTV (Loan to Value): Loan amount against collateral value. RBI prescribes ceilings for certain products such as gold loans and housing loans; lender policy is often tighter
7. Credit appraisal memo (CAM) preparation
Everything above is consolidated into the CAM, the document on which the sanction decision is taken and recorded. Its contents are covered in the next section.
8. Credit committee and delegation of power
Every NBFC has a board-approved delegation-of-power (DoP) matrix: a branch credit manager sanctions up to one limit, a regional head up to another, and above that a credit committee decides. Deviations from policy, such as a FOIR above cap or a negative-list pin code, escalate the approving authority regardless of amount. Committee notes and the vote are part of the record.
9. Sanction
A sanction letter sets out amount, tenure, interest rate, fees, security, covenants and conditions precedent. Under the RBI's fair practices and digital lending expectations, the Key Fact Statement with the annual percentage rate and all charges must be shared with the borrower before execution. Sanction validity is usually time-bound.
10. Disbursal
Conditions precedent are verified: executed loan agreement, security creation and CERSAI filing, NACH or e-mandate registration, insurance where applicable, and end-use documentation. Funds go directly to the borrower's account (or to the seller or builder in asset-backed products), consistent with the Digital Lending Directions' requirement that no third-party pass-through account sits between the regulated entity and the borrower.
11. Post-disbursement monitoring and early warning
Underwriting does not end at disbursal. Monitoring covers repayment behaviour, bureau refreshes, GST filing continuity, bank statement refreshes via AA, covenant compliance and collateral revaluation. Early warning signals (EWS) feed collections and renewals; an EMI bounce is a late signal, a missed GST filing an early one.
What Goes Into a Credit Appraisal Memo (CAM)
A CAM is the audit trail of the decision. Formats vary by lender and product, but a complete CAM in an Indian NBFC typically contains these sections:
| CAM section | What it contains |
|---|---|
| Proposal summary | Borrower, product, amount, tenure, rate, purpose, security, sourcing channel, recommending and sanctioning authority |
| Borrower profile | KYC summary, constitution, promoters and management, vintage, group entities, existing relationship with the lender |
| Business and industry | Nature of business, customers and suppliers, seasonality, sector outlook, concentration and policy fit |
| Bureau and track record | Scores, trade-line analysis, enquiries, overdues, settled accounts, promoter and entity reports, explanations for adverse remarks |
| Financial analysis | Turnover and profitability trends, GST versus banking reconciliation, bank statement findings, leverage, working-capital cycle, projections if relevant |
| Ratios and eligibility | FOIR or DSCR, DBR, LTV, eligibility as per policy versus requested amount, and the recommended amount |
| Verification outcomes | CPV, FI, tele-verification, legal and technical reports on collateral, fraud checks and dedupe |
| Risk assessment and mitigants | Key risks identified, mitigants proposed, covenants, deviations from policy with justification |
| Pricing and terms | Risk grade or score, rate rationale, fees, repayment structure, conditions precedent and subsequent |
| Recommendation and approval | Analyst recommendation, approver comments, committee decision, date and signatures or system approvals |
Policy vs Judgement: Where the Line Sits
A well-run credit function separates what the policy decides from what a person decides. Policy covers hard knock-outs (minimum age, negative pin codes, bureau score floors, maximum FOIR, minimum DSCR, maximum LTV, sector caps), document requirements, and eligibility calculations. These are deterministic and belong in a rule engine. Judgement covers the interpretation of grey areas: an unusual cash-deposit pattern, a one-off bureau delinquency with a plausible explanation, a business with strong GST but weak banking, a borderline DSCR with a strong guarantor.
One failure mode is an over-rigid policy that declines good borrowers and pushes sales to find workarounds; the other is "judgement" that is really inconsistency, where the same profile is approved in one branch and declined in another. The fix is to codify as much as possible, measure deviation rates by approver, and feed deviation outcomes back into policy quarterly.
Risk-Based Pricing
Most NBFCs now grade borrowers into risk bands using a scorecard that combines bureau, income stability, verification outcomes and product variables, and price each band differently. Because the rate and all charges must be disclosed in the Key Fact Statement and be explainable, risk-based pricing needs a documented model, an approval process for model changes, and a grade-to-rate mapping that the underwriter cannot override silently.
RBI Context for NBFC Underwriting in 2026
- Scale Based Regulation (SBR) for NBFCs, 2023: The Master Direction consolidates prudential norms by layer (Base, Middle, Upper, Top), including board-approved credit policies, concentration limits and governance of credit decisions; larger NBFCs face tighter expectations on credit risk management and internal audit of underwriting
- Digital Lending Directions, 2025: Consolidates the 2022 digital lending guidelines: direct fund flow between regulated entity and borrower, Key Fact Statement before execution, borrower consent for data, limits on app data collection, grievance redressal and the responsibilities of lending service providers
- KYC Master Direction, 2016 (as amended): Governs customer identification, CKYC, video-based customer identification, periodic KYC updation and risk categorisation of customers
- IRACP norms: Income Recognition, Asset Classification and Provisioning norms determine when an account becomes NPA (90 days past due for most products), that overdue status is determined at day-end, and that upgrades require all arrears to be cleared. These shape monitoring and renewal underwriting
The consolidated texts are maintained on the RBI's Master Directions page, with Master Circulars on the Master Circulars page and amendments under Notifications. Credit policy should reference the current version of each and be reviewed by compliance at least annually.
Typical TAT Benchmarks by Product
| Product | Manual or semi-digital process | Automated underwriting (industry practice, 2026) |
|---|---|---|
| Small-ticket digital personal loan | Same day to 2 days | Minutes for straight-through cases |
| Two-wheeler and consumer durable | 1 to 3 days | Minutes to a few hours at the point of sale |
| Unsecured business loan (MSME) | 5 to 10 working days | Same day to 2 days, with CPV as the long pole |
| Loan against property / secured MSME | 2 to 4 weeks | 7 to 10 days; legal and technical valuation remain manual |
| Supply chain finance (dealer or vendor limits) | 1 to 3 weeks for limit set-up | 2 to 5 days for limit; invoice-level drawdowns in minutes |
These are ranges, not targets. The useful internal metric is the split between system time (data pulls, rules, scoring) and wait time (documents, CPV, approver queue). In most NBFCs wait time dominates, so the sequencing and triggering of steps matters as much as the speed of any one step.
Where the LOS and Automated Underwriting Fit
An LOS is the workflow and system of record for stages 1 through 10. Automated underwriting is the decision layer plugged into it. Three components do most of the work:
- Rule engine: Encodes the credit policy: knock-outs, eligibility formulas, document requirements, deviation flags and DoP routing. Changes are versioned and approved, not hard-coded
- Scorecards: Application scorecards for new-to-lender borrowers and behavioural scorecards for renewals, combining bureau, income, GST, BSA and verification variables into a grade that drives pricing and the approval path
- Document AI: OCR and classification of KYC, bank statements, GST returns, financials and salary slips; automated BSA with fraud checks on tampered PDFs; cross-document consistency checks
Put together, cases that pass policy, score well and verify cleanly can be decisioned in minutes, with the CAM auto-generated from the same data. Underwriters then spend their time on the minority of cases that need judgement, with a pre-filled CAM rather than a blank template. The landscape of LOS platforms is covered in best loan origination systems in India (2026), and the MSME-specific case in closing the MSME credit gap with digital origination.
Common Failure Modes in NBFC Underwriting
- Score worship: Treating the bureau score as the decision rather than one input, and missing fresh enquiries or over-leverage behind a good score
- GST without banking: Accepting declared turnover without reconciling to bank credits, which is exactly where inflated applications live
- Paper CPV: Relying on an agency report with no geo-tag or timestamp, then discovering a non-existent address at the 90-day mark
- Unmanaged deviations: No tracking of how often policy is overridden, by whom, and how those loans perform
- Monitoring gap: No refresh of bureau, GST or banking after disbursal until an EMI bounces
- TAT without quality: Compressing turnaround by skipping verification rather than by automating data pulls
Credit Underwriting Checklist
- • Board-approved credit policy with product-wise eligibility, knock-outs, ratios and a DoP matrix, reviewed in the last 12 months
- • KYC and CKYC completed per the Master Direction, with beneficial ownership for entities
- • Bureau reports on borrower, co-applicants, guarantors and promoters; trade-line review, not score only
- • Income from primary documents; GST, ITR and banking reconciled for business borrowers, with PDF tamper checks on statements
- • CPV, FI or tele-verification completed with geo-tagged evidence recorded in the file
- • FOIR or DSCR, DBR and LTV computed per policy; collateral valued, title searched and CERSAI filed where applicable
- • CAM complete, deviations flagged and approved at the correct authority
- • Key Fact Statement shared before execution; conditions precedent verified; funds flow directly to the borrower
- • Post-disbursement monitoring triggers defined and owned by a named team
How CarmaOne Supports the Underwriting Flow
CARMA Assess is built around the stages above: bureau, GST, bank statement analysis, digital CPV through a managed field network, document AI and configurable scorecards, with the CAM generated from the same data so that credit teams can underwrite in 15 minutes instead of 3 hours for standard cases. The credit underwriting module keeps policy, deviations and approvals versioned and auditable.
CARMA Core provides the LOS, LMS and supply chain finance workflows that the decision layer plugs into, so that lead capture, KYC, DoP routing, sanction, disbursal and monitoring live in one system of record. For a broader view of the data layer, see modern credit underwriting with GST and bureau data.
Underwrite in Minutes, Document Every Decision
Bureau, GST, BSA, CPV and scorecards in one flow, with the CAM generated automatically and every deviation on record.
