Part 09 — Data & Integrations

Data Vendors Map

How to think about data vendors

Data vendors in Indian SME lending should be mapped by underwriting need, not by brand deck. A lender needs identity, business existence, financial behaviour, tax compliance, bureau risk, fraud signals, collateral evidence, legal risk, collections contactability and post-disbursement monitoring. One vendor may cover several needs, but no single vendor should become the lender’s only evidence layer.

The practical map below is written for banks, NBFCs and embedded-lending platforms building the integration catalogue in system blueprint.

Identity and KYC

Identity vendors verify individuals, businesses and signatories. Common checks are PAN, Aadhaar offline XML or masked Aadhaar flows where permitted, voter ID, driving licence, passport, face match, liveness, penny-drop bank account verification, CKYC search/download, address parsing and document OCR.

IDfy positions itself around identity verification, video KYC, background verification, merchant and business due diligence. Its KYC page says it supports ID card verification, OCR extraction for Aadhaar, PAN, voter ID, driving licence and passport, and identity matching against databases (IDfy KYC). Its main site claims 400 million-plus records processed, 140-plus enterprise APIs and 500-plus risk signals (IDfy).

Signzy offers KYC, KYB, AML, fraud and digital contracting APIs. Its India API marketplace lists KYC, KYB, liveness, face match, deepfake detection, mule detection, data-breach detection and OTP-based consent/eSign style workflows for banks, NBFCs, fintechs and insurers (Signzy India API marketplace). Its banking page describes biometric face match, liveness, document-forgery detection, PEP/sanctions/watchlist checks and bank-account validation (Signzy banking).

Perfios/Karza is frequently used for KYC/KYB and business-data APIs. Perfios says its KYC/KYB suite covers proof of identity/address, entity IDs, professional licences, vehicle details, income, credentials, document text extraction and anti-spoof checks, and claims 500-plus APIs and 1,000-plus active customers (Perfios KYC/KYB). Perfios’ about page shows Karza Technologies as an acquisition in its timeline (Perfios about); the acquisition was also publicly reported in 2022 (Economic Times on Perfios-Karza).

Selection rule: use identity vendors for verification and workflow speed, but keep the regulated entity’s Know Your Customer (KYC) policy as the source of truth. Vendor “green” should not override beneficial-owner, high-risk industry or sanctions policy.

Business, GST, MCA and Udyam data

Business verification is about whether the enterprise exists, is active, is controlled by the declared persons and has operating substance. Data points include GSTIN status, legal/trade name, registration date, filing frequency, Udyam status, PAN linkage, MCA master data, directors, charges, shareholding, financial statements, auditor remarks, EPFO, IEC, FSSAI, shop licence and court/NCLT records.

Probe42 is a major company-intelligence vendor for banks and NBFCs. Its site says it collects data from 743 validated public-domain sources and is used by top Indian banks for client, vendor and competitor intelligence (Probe42). Probe42’s resources state that it aggregates MCA, GST, ROC, litigation and other sources into structured business intelligence (Probe42 business intelligence). Its ICAI listing says it covers MCA records, court and NCLT filings, GST data, company financials, credit bureau information and ratings (ICAI Probe42 listing).

Perfios OneView is another MSME/business-data product. Perfios says OneView helps find and onboard MSME clients, using a database of 30 million businesses, 60 million signatories, 750-plus sources and MCA, GSTIN, PAN, TAN, IEC, Udyam, financials, sanctions, PEP and court/FIR data (Perfios OneView).

Signzy KYB verifies businesses and beneficial owners, runs registry lookups, screens against watchlists and supports local database checks in India and other jurisdictions (Signzy KYB).

Selection rule: for proprietorship and partnership SME loans, combine GST/Udyam/vendor business data with field verification. For private limited and LLP borrowers, always include MCA charges, director history, financial statements and litigation checks.

Financial data and income analytics

Financial-data vendors convert evidence into underwriting variables. Needs include bank statement analysis, AA data ingestion, GST return analytics, ITR analytics, financial statement spreading, payslip analysis, bureau pulls and transaction categorisation.

Perfios is a dominant financial-analysis vendor. Its document analyser page lists bank statement analyser, tax statement analyser, payslip analyser, credit-card analyser, financial statement analyser and credit appraisal memo support. It says reports can be shared through LOS/LMS systems and that inputs can include AA, bank statements, audited financials, IT returns, payslips and GST (Perfios document analysers).

FinBox BankConnect focuses on bank statement and AA-led analysis. It says BankConnect analyses financial data through AA, statement upload or net banking; detects salary, obligations, recurring expenses and 500-plus parameters; and provides API or CSV outputs (FinBox BankConnect). Its docs describe SDK and REST integrations with enriched transaction and identity outputs (FinBox docs).

CRIF High Mark, TransUnion CIBIL, Experian and Equifax are credit information companies, not generic data brokers. CRIF describes consumer, commercial and microfinance bureau reports with consumer scores and commercial MSME rank/score (CRIF credit information). TransUnion CIBIL describes CV CMR and commercial reports for non-individual borrowers (CIBIL CV CMR).

Selection rule: do not use BSA variables without raw-transaction drilldown. For auto-approval, store parser version, confidence score and exclusion logic. For ITR/GST analytics, store proof of borrower authorisation because the official Income Tax API specifications require taxpayer consent for ERI add-client and prefill flows (Income Tax API specifications).

Fraud, legal and adverse signals

Fraud checks include document tamper detection, face/liveness, device fingerprinting, mule-account indicators, phone/email risk, bank-account name mismatch, synthetic identity, negative lists, sanctions, PEP, adverse media, court cases, FIRs, NCLT, DRT, wilful defaulter/suit-filed databases and related-party networks.

Signzy and IDfy are strong at onboarding fraud: document forgery, liveness, face match, AML/PEP and workflow orchestration (Signzy banking, IDfy). Perfios/Karza and Probe42 are stronger for business-data fraud: fake GST registrations, shell entities, director networks, litigation, MCA charges and compliance gaps (Perfios OneView, Probe42).

For bureau-linked adverse data, use CIC reports and official/public default datasets where applicable. Experian India hosts a default-account search page for suit-filed, wilful-default and large-defaulter views (Experian default accounts). Treat public default searches as supplementary because coverage and update timing vary.

Selection rule: fraud vendors produce signals, not guilt. Create a fraud-case workflow with status, investigator, evidence, borrower response, final finding and cooling period. A false positive on a small manufacturer’s common address can block a good borrower if the analyst cannot see the underlying match reason.

Collateral, registries and legal evidence

Collateral data needs depend on product. Loan against property needs title-chain documents, encumbrance certificate, valuation, geo-tagged technical inspection, CERSAI search and filing, insurance and sometimes ROC charge filing. Machinery finance needs invoice, serial number, hypothecation, insurance and site verification. Receivables finance needs invoice authenticity, debtor confirmation, GST/e-invoice/e-way bill trail and assignment/hypothecation evidence.

For CERSAI, the lender should integrate search and filing evidence into the documentation workflow. SARFAESI section 20 establishes the Central Registry for security interests (India Code, SARFAESI section 20). Central Registry Rules cover security interest over mortgage, plant and machinery, stock, debt/book debt/receivables, intangibles and under-construction property interests (Central Registry Rules).

For debt evidence, NeSL matters. PIB states that Information Utilities store financial information to establish defaults and verify claims under the Insolvency and Bankruptcy Code (PIB on NeSL). IBBI lists NeSL as IU registration number IBBI/IU/01 (IBBI IU list).

For company charge and legal diligence, Probe42 and Perfios OneView can reduce manual MCA/court searches, but the lender should still store official source documents for high-ticket secured loans.

Selection rule: collateral APIs should never be “fire and forget.” The LOS should block disbursement or trigger a documented waiver if valuation, legal, CERSAI search, insurance, eStamp/eSign or NeSL evidence is pending.

Vendor governance checklist

Before onboarding a data vendor, ask these questions:

What is the source of each field: official API, public registry, scrape, partner database, borrower upload or model inference?
Is borrower consent captured, and can it be replayed in audit?
Where is data stored, and is India data residency required by the lender’s policy or regulator?
What are uptime, latency, retry and fallback commitments?
Does the vendor return raw evidence, parsed JSON, confidence score and reason codes?
Can the lender delete, mask or expire data according to consent and retention rules?
Is the vendor acting as a regulated participant, technology service provider, outsourcing service provider or mere data processor?
What happens if the vendor changes source access or loses a regulated integration?

The best architecture is multi-vendor but not chaotic: one internal integration gateway, canonical data model, vendor scorecards, cost monitoring, consent registry and manual fallback for high-value cases.