Part 05 — The Lending Lifecycle

Due Diligence

Purpose

Due diligence tests whether the file is real beyond documents and algorithms. It covers field investigation (FI), personal discussion (PD), risk control unit (RCU) checks, fraud screens, reference checks and sometimes supplier/buyer verification. It is not a formality after approval; it can change amount, structure, collateral condition or rejection. In the lifecycle it sits between underwriting decisioning and collateral/legal or sanction.

Actors

Actors include FI agency, RCU analyst, PD officer or credit manager, borrower/promoter, neighbours/market references, landlord, supplier, buyer, branch RM, sales manager, credit approver, vendor manager and compliance. For higher tickets, senior credit may conduct PD directly rather than relying on sales narration.

Inputs & documents

Inputs are application, KYC pack, bank/GST/financial summary, bureau report, business address, residence address, references, collateral address if any, negative-list results, document images and credit questions. Outputs are FI report, residence verification, office/shop/factory verification, PD notes, RCU report, reference check, fraud disposition and recommended conditions.

Step-by-step workflow

Trigger due diligence based on product and risk route: mandatory for LAP and larger SME tickets; sample-based or score-triggered for small digital loans.
Allocate vendor cases with masked sensitive data. Vendors should receive only what they need for verification.
Conduct FI at business premises: signboard, stock, employees, machinery, customer footfall, books, ownership/tenancy, business vintage, neighbourhood feedback and geo-tagged photos.
Conduct residence verification for proprietor/promoter/guarantor where policy requires. Confirm stability, family awareness, ownership/rent and repayment intent signals.
Run PD. Ask how the business makes money, seasonality, top customers, supplier credit, cash sales, existing loans, purpose of loan, repayment source, contingency plan and whether any documents were prepared by an agent.
RCU checks documents and patterns: image manipulation, bank statement tampering, PAN/GST mismatch, repeated device/address, fake employer/supplier, unusual bank credits, forged title papers or adverse media.
Reference checks call suppliers, buyers, accountant, landlord or market association where appropriate.
Feed results into credit: positive, negative, inconclusive or conditional.

Exceptions & edge cases

FI can be misleading if done at the wrong time. A small manufacturer may show low stock after dispatch day; a restaurant may be empty at 11 a.m.; a seasonal trader may look inactive off-season. Conversely, staged stock, borrowed signboards and coached neighbours are real fraud risks. PD should test details that are hard to fake: credit terms with top three suppliers, gross margin by product, monthly rent and electricity, GST filing person, last large order, cheque-bounce explanation and why existing lenders are not funding.

RCU negative is not always rejection, but it must be resolved. A name spelling mismatch may be benign; a bank statement metadata manipulation, fake GST certificate or borrower denying the loan request is not. In digital lending, data minimisation matters: RBI requires need-based data collection with prior explicit consent and audit trail, and restricts access to mobile resources such as contacts, call logs and files except limited one-time access for onboarding/KYC needs (RBI Digital Lending Directions, 2025).

Another common edge is the “good borrower, bad premise” case. The business may be genuine but operating from an unauthorised industrial shed, shared godown, co-working unit or family residence where signage is absent. For unsecured loans this may be acceptable with stronger bank/GST evidence and residence stability; for LAP or machinery finance it may affect insurance, end-use monitoring and enforceability of hypothecation. The decision note should say exactly which risk is being accepted.

Systems touched

Vendor management system, FI mobile app, RCU case tool, LOS, DMS, geo-tag/photo store, device-fingerprint system, negative-list/adverse-media screening, call recording, PD note template, audit log and credit workflow. Vendor contracts should align with RBI outsourcing expectations because the lender remains accountable for outsourced activity. RBI’s digital lending directions explicitly state the regulated entity remains responsible and liable for acts and omissions of the LSP in digital lending arrangements (RBI Digital Lending Directions, 2025).

TATs/SLAs

Urban FI is commonly 24-48 hours; semi-urban/rural FI can take 2-4 working days. RCU document screening for unsecured loans should be same day to 24 hours, while property-document RCU may run alongside legal checks. PD should be completed within 1 working day after data pack completion for unsecured files and before committee for larger exposures. Reference checks are usually same day if contacts are valid.

Stage metrics

Track FI positive/negative/inconclusive rate, vendor TAT, revisit rate, geo-tag exceptions, PD completion TAT, RCU negative rate, RCU false-positive clearance, reference-contactability, credit decision changed after due diligence, fraud caught before disbursement and early delinquency by FI/RCU result. Vendor quality should be back-tested: a vendor with very low negative rates and high early defaults is not doing useful verification.

Co-lending/partner-origination variant

In co-lending, one entity often performs FI/PD and shares the report. The 2025 co-lending directions require the co-lending agreement to specify segregation of responsibilities, time-frame for exchanging critical information and customer-interface issues (RBI Co-Lending Arrangements Directions, 2025). Partner reliance should be explicit: partner_accepts_originator_fi, partner_requires_sample_reverification or partner_requires_own_pd. For LSP-sourced loans, the regulated entity should ensure the partner is not coaching borrowers, suppressing negative FI or collecting unauthorised fees.