Banking, NBFC, insurance and fintech
Decisions fast enough for the customer, reconstructable enough for the inspector
Lending, insurance and payments run on decisions that must be quick, fair and reproducible long after the fact. We build the decisioning, monitoring and document systems that hold up under RBI and IRDAI supervision and under the DPDP Act.
Financial Services
Credit, fraud and compliance systems that can explain themselves to a regulator years later
- Now
- 3 applications
- Next
- 2 applications
- Frontier
- 2 applications
- Constraints we design around
- 5
Context
Three forces reshaping this sector.
What changed recently enough that the old architecture is now the wrong one.
Data stopped being the bottleneck. Governance became it.
Account Aggregator consent flows now deliver clean, structured bank statements and GST data in seconds, so the old excuse — we cannot see the borrower’s cash flow — is gone. What replaced it is harder: proving which consent artefact authorised which inference, for which purpose, and expiring the derived features when that consent lapses. Most stacks were never designed to expire anything.
Model risk management is now a build requirement, not a policy document.
RBI’s guidance note on model risk management in credit put governance, validation and challenger models on the critical path. Supervisors ask for the feature vector behind a specific rejection, the model version that scored it, and evidence that someone independent reviewed drift. A team that cannot produce those in an afternoon is not slow — it is non-compliant.
Fraud moved to real time, so the controls had to follow.
UPI settles in under a second and mule networks reorganise in hours. Nightly batch scoring catches the pattern after the money has left. The shift is toward streaming features over a Kafka or Flink spine, graph signals on the payee side, and network-level intelligence — which forces institutions to run inference in the payment path rather than beside it.
Applications
What we would build here, in order.
Grouped by how close each one is to production today — not by how impressive it sounds in a board pack.
Build it this quarter
Current models, current data. The engineering is understood and the risk is schedule risk, not research risk.
Onboarding document intelligence
PAN, Aadhaar (masked), passports, utility bills, GST returns, ITRs, bank statements and salary slips arrive as phone photographs at 40 degrees of skew. A layout-aware extraction pipeline — OCR, then a document understanding model, then deterministic validators for checksum, MICR, IFSC and date coherence — pushes clean fields into the CKYC record. Every field carries a confidence score and a crop of its source region, so the reviewer checks four fields rather than forty.
AML alert triage and narrative drafting
Rules engines such as Oracle FCCM, NICE Actimize or an in-house scenario library generate alerts at a false-positive rate most analysts would call theatre. A triage layer clusters duplicates, assembles the counterparty history and prior dispositions, ranks by a model trained on past analyst decisions, and drafts the narrative with every claim linked to the transaction that supports it. The model never closes an alert. It decides the order of the queue and writes the first draft.
Credit decisioning with real reason codes
A hybrid policy: a monotonic gradient-boosted model or an interpretable scorecard as the model of record, wrapped in a policy layer expressed as code rather than as a spreadsheet nobody owns. Every decline emits ranked reason codes derived from the same computation that produced the score, not a post-hoc rationalisation. Bureau pulls, AA-derived cash-flow features and device signals are versioned together so a decision can be replayed exactly.
One thing has to change first
Buildable, but gated on something outside the model — labels, a consented holdout, an integration, or a process the business has to agree to change.
Collections prioritisation that models uplift, not propensity
Most collections models rank by probability of default, which sends the field team to accounts that would have cured on their own. Uplift modelling ranks by the change in outcome caused by contact, which is a different and harder target requiring randomised holdouts the business will resist giving you. Add channel and time-of-day sensitivity, and RBI’s digital lending and recovery conduct rules as hard constraints in the action layer.
Grounded copilot over policy, circulars and product terms
Relationship managers and underwriters lose hours to questions answered on page 40 of a master circular that was amended twice. A retrieval system over the circular corpus, internal credit policy and product terms — chunked by clause with effective dates preserved — answers with citations and refuses when coverage is thin. Superseded clauses are the failure mode here: retrieval must know that a 2023 paragraph was replaced in 2025, or the copilot confidently quotes withdrawn guidance.
Scope it as research, with a gate
Credible and worth a prototype. We would run it behind an evaluation gate and say plainly if it does not clear the bar.
Streaming graph signals for mule and first-party fraud
Individual transactions look ordinary. The structure does not: fan-in and fan-out across newly opened accounts, shared devices, recycled beneficiary handles, velocity that appears only when accounts are viewed as a graph. Maintaining graph features under a sub-100 ms budget means precomputing neighbourhood aggregates in a streaming job and accepting slightly stale structure rather than traversing at request time.
Agentic reconciliation and exception desk
Nostro breaks, UPI settlement files, card network clearing files and ledger mismatches consume operations teams who apply the same dozen resolution patterns daily. An agent that proposes a match with its evidence, executes the reversible steps under policy, and escalates anything touching a customer balance is buildable now. What makes it safe is the boundary: a typed action catalogue, per-action limits, and an approval gate on anything that moves money.
Constraints
What makes this sector different.
The part of the build that does not transfer from anywhere else. Every one of these has to be answered in the architecture, not in the project plan.
Explainability is not a feature you add later
If the model of record cannot produce reason codes from the same computation that produced the score, the explanation is a story told after the fact — and it will not survive a supervisory review or a consumer grievance. This constrains model choice upstream: monotonic constraints, feature families a credit officer recognises, and a challenger model run in shadow from day one. SHAP on an unconstrained ensemble is a diagnostic tool, not an adverse action notice.
Residency applies to inference, not just storage
RBI’s payment data storage requirement and sectoral localisation expectations mean the data stays in India — and a hosted model endpoint in another region is a data transfer regardless of whether anything is persisted. Practically: Bedrock or equivalent in ap-south-1 or ap-south-2, or open-weight models on your own GPUs inside the VPC. It also rules out most SaaS AI tooling, which is usually discovered three weeks into a build.
Consent, minimisation and tokenisation pull against each other
The DPDP Act 2023 binds processing to a stated purpose and gives the principal erasure rights, while PMLA record-keeping rules impose multi-year retention floors on the same records. The resolution is architectural: deterministic tokenisation so joins survive the removal of the identifier, purpose tags carried on every derived table, and a documented split between what is retained under a legal obligation and what is deleted on request. Raw PAN or Aadhaar should never reach a model’s context window.
Every decision has to be replayable, not just logged
Logging the output is easy. Reproducing it needs the exact feature vector as computed at decision time, the model artefact hash, the policy version, the bureau payload, and any human override with its justification — written once to immutable storage such as S3 Object Lock. Training-serving skew is the usual culprit: the feature recomputed from the warehouse months later does not match what the online store actually served, and the reconstruction quietly disagrees with the original.
The core banking system is the real integration surface
Finacle, Flexcube, T24 and BaNCS were designed around batch windows and end-of-day cut-offs, and the read APIs you were promised are often a nightly extract. Designs that assume synchronous reads from the CBS fail in week two. What works is change data capture off the replica, an event spine, and an explicit contract stating which figures are authoritative in real time and which are only correct after settlement.
Every one of these is discoverable in week one. Most programmes discover them in month three, after the architecture is already load-bearing.
Outcomes
What we design toward.
Targets and typical ranges for this class of system. Each one carries its basis, because a number without one is decoration.
- Decision latency at the API boundary, features included
- p99 < 200 msDecision latency at the API boundary, features includedDesign target for the real-time decision platform pattern on ap-south-1, assuming an online feature store colocated with the scoring service.
- Field-level straight-through extraction on clean, structured KYC documents
- 90–97%Field-level straight-through extraction on clean, structured KYC documentsDesign target per document class. Public layout-understanding benchmarks such as CORD and FUNSD report this band for well-formed forms; low-light phone captures and handwritten annotations fall well below it, which is why confidence routing exists.
- Replayable with its feature vector, model version and policy version
- Every decisionReplayable with its feature vector, model version and policy versionAn architectural guarantee of the decision log design, not a measured result — it is enforced by writing the inputs at decision time rather than recomputing them later.
- From signed scope to a model scoring live traffic in shadow mode
- 3–5 weeksFrom signed scope to a model scoring live traffic in shadow modePlanning figure from our engagement model, assuming data access and a non-production environment in week one. Procurement and vendor change requests are the variable, not the engineering.
These are design targets and published benchmark ranges, not delivered client results. We do not publish results attributed to clients.
Solutions
What we bring to this sector.
The practices that do most of the work here. Each one is the same discipline applied against the constraints above.
Blueprints
Reference architectures behind this work.
How the systems are actually assembled, with the engineering decisions and their costs stated. Reference designs, not case studies.
Real-Time Decision Platform
A platform that turns database changes into fresh features within seconds, serves a model decision inside a live request, and writes an immutable record of every decision — the inputs, the model version and the policy that applied — so it can be explained, replayed and rolled back months later.
Read the blueprintDocument Intelligence Pipeline
A high-volume extraction pipeline that turns invoices, claims, KYC packs and trade documents into validated structured records, attaches a calibrated confidence to every field, and sends only the fields that genuinely need a person into an exception queue sized to the real error rate.
Read the blueprintQuestions
The awkward questions.
The ones a technology committee actually asks, answered the way we would answer them in the room.
Next step
Bring us the constraint you keep working around.
A 45-minute working session. We'll tell you what we'd build, what we'd not build, and roughly what it costs. No deck.