How Indian lending actually works, from RBI circular to disbursal

Lendstack is a free publication for people who run NBFCs and MFIs: field-tested essays on credit and operations, and a plain-language tracker of the RBI directions that affect you. Written by the team that builds Finpage.

The lending stack Lendstack covers Three stacked layers. At the base, RBI regulation, with 14 directions tracked. In the middle, lending operations, with field notes from Finpage rollouts. On top, credit and risk, shown as rising bars. Credit and risk Underwriting beyond the bureau Operations Field notes from Finpage rollouts Regulation 14 RBI directions, summarised
Lendstack covers lending from the ground up: the rules, the operations built on them, and the credit decisions on top.

Latest

Articles

Regulations tracker

RBI directions and circulars that matter for NBFCs and NBFC-MFIs, summarised in plain language. Always check the original notification on rbi.org.in before acting on it.

AML/KYC

Implementation of Section 51A of UAPA, 1967 – UNSC Sanctions List Updates

RBI/2026-2027/253, DOR.AML.REC.219/14.06.001/2026-27

Routine but mandatory sanctions-list update circular applicable to NBFCs among other regulated entities, requiring screening against amended UNSC designated-entity lists.

Conduct and recovery

Reserve Bank of India (Non-Banking Financial Companies – Responsible Business Conduct) Third Amendment Directions, 2026

RBI/2026-27/230, DOR.MCS.REC.No.199/01-01-039/2026-27. Effective 1 Jan 2027

A single framework for recovering loan dues and engaging recovery agents. Requires a board-approved recovery policy, call recording retained for six months, IIBF-certified agents, a dedicated channel for recovery complaints, and tight limits on device locking outside device finance.

IT and cyber

Reserve Bank of India (Non-Banking Financial Companies – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026

RBI/DoS/2026-27/461, DoS.CO.CSITEG.55/31.01.015/2026-27. In force immediately

Replaces the earlier IT Framework and IT Governance directions for NBFCs with one consolidated rulebook. Cyber incidents must be reported to the RBI on the DAKSH platform within six hours of detection. Board-level ownership of cyber risk, resilience testing that covers vendors and partners, and obligations that scale with the NBFC's layer.

NBFC

Reserve Bank of India (Non-Banking Financial Companies – Income Recognition, Asset Classification and Provisioning) Third Amendment Directions, 2026

RBI/2026-27/197, DOR.STR.REC.162/21-04-048/2026-27. In force from 1 Oct 2026. Issued with the Resolution of Stressed Assets Second Amendment

Prudential norms for Specified Non-Financial Assets: property an NBFC acquires from a borrower to settle a loan. Unrealised income already booked on such assets must be reversed through P&L by 30 September 2027, and future income from them counts as other income only when received. Details go to the CIMS portal (HFCs report to NHB).

See all 14 tracked circulars

About Lendstack

Lendstack is published by Twinline Business Solutions, the Gurugram company that builds Finpage, a loan origination, loan management and accounting platform used by NBFCs and microfinance institutions across India.

We write about what we see while implementing Finpage with lenders: how credit, operations and compliance teams actually work, and how RBI changes land on the ground. The views are ours, not our clients'.