What financial businesses in India need
An NBFC in Nagpur, a gold-loan chain in Vidarbha and a payments startup serving kirana stores have different licences but similar software problems. They need to onboard a customer with verified identity, move money reliably, keep a ledger that always balances, and show a regulator or auditor exactly what happened and when.
Most start with a licensed core product plus spreadsheets around it, or with a generic CRM bent into a loan tracker. Both break at the edges: field collection agents working offline, partial repayments, top-up loans, and the reconciliation between what the payment gateway says and what the bank statement shows.
The useful software here is unglamorous. It is a correct ledger, a state machine for every loan or transaction, idempotent payment handling and an audit trail that nobody can edit.
The hard parts
- Regulatory context. RBI's guidelines on digital lending, KYC and outsourcing, and NPCI's rules for UPI, set expectations for how data flows, who touches money and how customers consent. We build the technical controls those norms generally call for, such as consent capture, data storage in India, access logs and encryption, but the licences and the compliance sign-off belong to you and your compliance officer. We do not hold certifications and will not claim your product is compliant.
- You do not talk to NPCI directly. UPI and card acceptance go through a bank or a licensed payment aggregator. Your software integrates with their APIs and handles their callbacks, retries and settlement files.
- Card data must never touch your servers. Use a gateway's hosted checkout or tokenisation so PCI DSS scope stays with the gateway, not with you.
- The ledger. Floating-point money, mutable balances and missing double-entry are the three most common defects we find in existing systems. Every rupee should be an integer of paise, and every movement a pair of entries that sum to zero.
- Idempotency and reconciliation. Payment callbacks arrive twice, late or never. Every operation needs a unique key so a retry cannot double-credit, and a daily reconciliation job should match gateway, ledger and bank.
- Personal data. Loan applications carry PAN, Aadhaar-linked identity, bank details and income proof. The DPDP Act, 2023 governs their collection and retention; we design for purpose limitation, masking and deletion schedules.
- Field reality. Collection agents use low-end Android phones in areas with no signal. Receipts must be issued offline, synced later and impossible to tamper with in between.
What we build
- Loan origination and management systems: applications, credit checks through your bureau provider, sanction, disbursement, EMI schedules, prepayment and closure.
- Collections apps for field agents with offline receipts, route lists, UPI QR collection and cash reconciliation.
- Payment integrations with Razorpay, Cashfree, PayU or your bank's aggregator, including webhooks, refunds and settlement reconciliation.
- KYC flows using licensed providers for PAN, Aadhaar-based and video KYC, with consent records.
- Wallet and ledger services with double-entry accounting, immutable audit logs and exportable statements.
- Customer apps and portals for statements, repayments and support, in Hindi, Marathi and English.
- Dashboards for portfolio health, overdue buckets, agent performance and regulatory reports.
- Automation of reminders, NACH mandate handling through your provider, and support chat where volume justifies it.
A typical stack
We favour boring, well-audited components. The API layer is Node.js (NestJS) or Python, with PostgreSQL as the system of record and strict transactions. Redis handles queues and idempotency keys. Every sensitive column is encrypted at rest and every request is logged with who, what and when. Front ends are React for back-office staff and React Native for customer and agent apps. Infrastructure stays in Indian data centre regions.
| Concern | Our default | Why |
|---|---|---|
| Money values | Integer paise in PostgreSQL | No floating-point rounding |
| Payments | Aggregator APIs with webhooks and retries | Cards and UPI stay outside your scope |
| Audit | Append-only event table | Nothing can be silently edited |
| Secrets | Managed vault, rotated keys | No credentials in code or chat |
A collections app with a back-office portal typically runs ₹4–15 lakh; a full loan management system is scoped separately because the product rules drive the cost.
Related work
We have not yet published a fintech case study, and we would rather say so than dress up unrelated work. What we can show is the kind of system described above, our ledger and payment patterns from RightSutra, our business suite with billing and payroll, and the Indian finance calculators in RightYantra. We are happy to walk through code and architecture under NDA.
Talk to us
If you are an NBFC, microfinance company or payments startup that has outgrown spreadsheets and a generic CRM, describe your product. We can scope it under custom software development and mobile app development, and we will tell you plainly what a compliance consultant should handle rather than a developer.
